30a5c763921dd716f4ec0e1d911371ac176807d98d92a775139629551137a0e0

Resubmissions

26/03/2026, 09:45

260326-lrh5asft3110

25/08/2025, 22:22

250825-1986rsssev7

Analysis

max time kernel
149s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20250619-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20250619-enlocale:en-usos:android-11-x64system
submitted
25/08/2025, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30a5c763921dd716f4ec0e1d911371ac176807d98d92a775139629551137a0e0.apk
Size 4.2MB
Sample250825-1986rsssev
SHA256 30a5c763921dd716f4ec0e1d911371ac176807d98d92a775139629551137a0e0
MD5 bb18503c5386269ea5eee63734f21b9a
SHA1 f54df19fdb0e1bf7e1547630db1bc4a44a37ff96
SHA512 c1f4799232537eef52b13c2b2973c2a19f86df39c5f4c44315d227b83a3f63cb1cf8ebfba7609633cb4f72d2d221d8b9ed0f665a63896215647f7107f0356b5f
SSDEEP 98304:uoTYrVJR92cMCBR1iAHOmr2H5FmxVlFO7ta6HYIZg:RpQ1iAuJH5QxVga64IZg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	dvytezhb.wphwjcvi.ksxgrfec
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	dvytezhb.wphwjcvi.ksxgrfec

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	dvytezhb.wphwjcvi.ksxgrfec

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	dvytezhb.wphwjcvi.ksxgrfec

Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	dvytezhb.wphwjcvi.ksxgrfec
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	dvytezhb.wphwjcvi.ksxgrfec
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	dvytezhb.wphwjcvi.ksxgrfec
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	dvytezhb.wphwjcvi.ksxgrfec
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	dvytezhb.wphwjcvi.ksxgrfec
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	dvytezhb.wphwjcvi.ksxgrfec

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	dvytezhb.wphwjcvi.ksxgrfec

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	dvytezhb.wphwjcvi.ksxgrfec

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	dvytezhb.wphwjcvi.ksxgrfec

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	dvytezhb.wphwjcvi.ksxgrfec

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	dvytezhb.wphwjcvi.ksxgrfec

dvytezhb.wphwjcvi.ksxgrfec
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4644

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

accessibility_logs.db

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/databases/accessibility_logs.db
Size 60KB
SHA256 1850f0c855c2c730c6bcad6f7182be08d42e8b038c76bc458d9321aa03dc566a
MD5 a838f846c5e09b99aeddec451dbd9fbd
SHA1 6bdf33080ef7ec47f98a583b2c2cc2aad26c4c36
SHA512 414d19e79ca240a09468cc3da60caf8bfcfc6532e2e16de72141761404a9291f2294f7fe28e7c08157dd2f284cb3b26ebc03fe90fa7cec7f011972e505bf2bfa
SSDEEP 96:W2VOTPVMIPulklTIj/0hsghljJh/Blmrlwx0beW+yoH7BKJWz2CMJeiKsfAzK/zm:fVOT6aT/70L4zKBCFv
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/databases/accessibility_logs.db-journal
Size 512B
SHA256 bbbb99243765f6be3c4e0fea8b57ac7f883d54d80c5cd4abe70be6531e9e0250
MD5 8839fd68086d70afb029350d0765e704
SHA1 695e62c261224744ef1eebad23bd6f7cca48033b
SHA512 0cfc19ca9efc93fd4200fa0bfe0392fa6fbe06e481517afd35a053fe76d30a6f577b6a6ddf9580d2ba6ff1963ac11c2fadc812ad85803e83a29256053bc63f2b
MD5 SHA1 SHA512

Submit Download

accessibility_logs.db-journal

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/databases/accessibility_logs.db-journal
Size 8KB
SHA256 e9e6342338166adba1788261d2458ebf4c3350ef9e238f151a293dbda16d865d
MD5 872d02342ffae6b3ee914a04b2934ad6
SHA1 74e3b1ade1211208c35747c0ef332adb0416ff29
SHA512 5caeda2f855b1f0706eaad7e1481e4dabde22b737495291e8c1754b488de3c77f9960c3904e568dc137585b4a5b09eecbb9dbb55563528e7c09507b1220a4812
SSDEEP 6:7+/l9Jlgn17llng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK0:7+tPUpqLiuWdYRmBEyPbv
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/databases/accessibility_logs.db-journal
Size 8KB
SHA256 7f6f1fdc735eefe981ae03f5fd3efc3d610fdd5516deb4b4b2fe316ef22be74c
MD5 38a416600b76a414e7e6ef2ef71fbe71
SHA1 20a4c5f5dae3951ff5427ea013e0a47708ce181c
SHA512 3ef9d6980ae3d4e9b660372dca603739c86c8eed9ab171711b4501828959ce564e03af5cf69627b8868541050bd1a443346b02f537c8b030faa38eda204c4bf9
SSDEEP 6:7+/l9oOPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKVK//z8:7+tNqLJdeWRmBEyPb7z8
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/databases/accessibility_logs.db-journal
Size 52KB
SHA256 eedb6c68101e9ea15370b03103c853b6cb3270993a7c5898741c9391987d0bcd
MD5 a54ec0767a0a4a669624c3a2f9c82577
SHA1 3e2186e4f748de8fc60ffd2556c0713c1df4d122
SHA512 5de47ffae2a4b732aec8ba4f65d4e421df0c0b4c350c098bee737d9bd4d224dceb2024bc881fa8cd6dea8380f1c9a692cf5e2075bb2d7b480f2b8864e94b0e54
SSDEEP 48:7MoJ+qzB5zZz3mg0P4hHjb+Txvms9DvmwHxkvhSk:7lkgVOTPVMIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/databases/accessibility_logs.db-journal
Size 52KB
SHA256 3419032e046df654dc7547b840d97d1a15d795153c7080cc61c845dd256c0d2e
MD5 97c1c6ea84a4139d32b0bdc4ad78aceb
SHA1 de9ce2dfb5f70579cf2eefa7284b4caa44a4a8d4
SHA512 f1b44ee3b28e164eb62d612ed05e22e8a09e8537026d4412713089d866a459329dc009d47deccb2c87a30bfc3721e1482b37ad1088ec608159b6155fe3569b5c
SSDEEP 48:7MTTPs94EEBQWqDB5zZz3mg0P4hHjb+Txvms9DvmwHxkvhSu:7oE94EEBQWwVOTPVMIu
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/databases/accessibility_logs.db-journal
Size 52KB
SHA256 b5c0795e99df5cb616e318b9e856fec390d0a126944c2666b5d678e0f748f35a
MD5 2660e58fb14e9d20935c86a1fd037ec9
SHA1 b33d4c4bc722593a6fdaa60e0350a7f4cff1caab
SHA512 1b961e506d30e9c5b18ee0f2fe65a6279e1a9f306c1d0abd3f6b8b3f1c5287d2518988f16cde65290cef740bc2016b4ebf4d1960e80b50bcc1e763b01a4d2cb5
SSDEEP 96:7TG291N4f6E3TIjuWMorhWRzGrUgmfaJWz2CMJeiBsflklTIj/0hsghljJh/BlmJ:7TXCsZTZcaTpyAVOT1
MD5 SHA1 SHA512 SSDEEP

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 0d84e68b0e7674cb1fc5dded556a6ba5371c501d595e524d41ef52f21793d7c6
MD5 531df4b50a691d295cba505290dbf8e2
SHA1 4553ce99d46d972a4004bfb98d662f8558f1d883
SHA512 286c99a88a7e15bc60f4573378efee9d1a9f680b215241960920621ba23151b41c94dfacfe7dc8e4aed5a5d9f6a6b89859f01d630e7e8911cd411babd9cd0a4b
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/files/service_heartbeat.dat
Size 13B
SHA256 e59119a92234f2ada22ba6a4a607ae2dbe3ae51a9b84d9488024d2412b9f6833
MD5 478ef0557437fc1e362b7f68b0540c5e
SHA1 3cd3ce16d079131321a38c937178a4413c0990e1
SHA512 61ec5a2e65082b6029d94382f57d613f902b0d74e7dff38e3734b231c9868f865a1c80c3f1169410c1b7570f4b574f8841228abe4c68858b8917e84c1edd58c5
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/files/service_heartbeat.dat
Size 13B
SHA256 01168af0bbd33eb29e4afe5b77fcc00b93261601814da81117ecc93fa2bc1f1c
MD5 9006eff8220ee6d00361d541466c1417
SHA1 6de90fb8945bfee01c7bdafbae624811dd2cb1cb
SHA512 abee06f16b7e8d583363efe70113523460070af2ddf872cc1e6328efae76447b3a4eb138140f3b9ec03cd1fd3af7f92ee1b959b5b9af94a9b9d61948ee398a5e
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/files/service_heartbeat.dat
Size 13B
SHA256 e1f74314a738e89202359dfd12a303e439b71fdcef3a6efb5a0d00a96555e150
MD5 b17cd7446d150a2944c39ecaeaaec811
SHA1 012daf3915aba74a1ca0f8290f85add442e02550
SHA512 9002e6fca23893a890cd0f4ce9ef9da6980f0c20f3dc9e4a103541a8d7ea903c51a88c1c954b5d613e711adf6ac791dc0866db3ec3778ab2f56329d920a31249
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/files/service_heartbeat.dat
Size 13B
SHA256 ed45550ff534a2e162ba1be99c5964f5038ed45b7b0d2d788cb29f64b11419d4
MD5 a7751101c74ec080b91c1b17d0af2dc1
SHA1 2042aa9870ce9ed6f176d93f99cbac329c972e01
SHA512 899b086d98ebc4314fc956337d4f62a943a040f9f3c8e9ad7cd138eea663e7e9f4fd457729494e13f812a52e7702ef11259570876bdfaaf1960c7304e62fdbc8
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/files/service_heartbeat.dat
Size 13B
SHA256 50929d9818941f1524bdf1d51df64a5d102dc95a81fc9e2b33488d2080055862
MD5 d515f49f94ab738461149a59ac493098
SHA1 1596a7104ac1b1a5fc666c05f5b429b551e6890d
SHA512 fca6eb9eebf5ac18aa985c479b3a91ab668aaa224ffd45dd4d4676f7390b4c365c21b5a318ad45c66d4c88ec19476b8ed42bcbcc2add3b74abc7069ead29b04f
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/files/service_heartbeat.dat
Size 13B
SHA256 db9c6af33d83d9e5c32c282a18cb99846d31cd87bf8ed16aefadc1078db82e65
MD5 47aa5a9c21da523100afabfd2c78324b
SHA1 f929bd60e63234ab1d5d35a1141458328031b2cc
SHA512 50dabf63d4cccf4f9d62305a62ab5dfbeb3ec12b6f3c3ea1765a870bfc58b51c038de612ab2625faf89e9da9c00d77dbdddb7e412cf54e488a888b827aca915f
MD5 SHA1 SHA512

Submit Download

service_status.dat

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/files/service_status.dat
Size 1B
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/no_backup/androidx.work.workdb
Size 100KB
SHA256 df4636a002b49d5fd9b3e6072525daad352bbdd588a8efcf92193731f53216bc
MD5 fbe135d9e6bb621cc10b43372f7da266
SHA1 d2ae21d2b14f70d51bec688af570454e8f0882b6
SHA512 8dd43890d060aa4607f63d399a9585e6677fcbd1aa43894c97fbd03be6616bb1e5b979824541709ca055f7437acd9e752a5aae74598d911204b443ff1d33eef8
SSDEEP 192:YtYBtYNF1xqindjnHt9S/f8JzSV+6D86T0ED:YtYBtYNx7ndjnHt9S/f8JzSk6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-journal

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 31c54ddad8583afb27e9024bb5b88c191de6f92275db381bbc7c30e24da030b7
MD5 f8ed5e0c6f57d781fd957e40d6d828e5
SHA1 37defc92c6ffb3323139f9ee452f056a3e9630a6
SHA512 69de10418cf38fe6cdf601c4c028ce2172cddf58cbfafab3bb0536b62176bc212c6f17d96ef94185fdb892e8de67253b6e642194b855e8794e7768a56e2ff4b1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 69aed431d0402d4e45e28a5dac9a780272f2b58021ec47a9e33ebae219f58fa5
MD5 7b39ce441dabbabc2219256a029487b5
SHA1 27bc3ae887da018aeaa0f2afb088533663214b09
SHA512 da7ddba650e31020c6266077dddefc28a92852f63e5ecaad47050473c2da2338d83cffbec2a2b853fe8a352fd720b12ac10b28540f01e695c1d134316364a0ae
SSDEEP 12:KBroAz8r97JzdeWRmBEyPbP/rr3S2ZwSyOw2:KR897JzKGSP/3i2Zpg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 1e46423c2c2f472f1f4bd0c006ea1c9827b0edbf004d913701512223c8313b83
MD5 39715c3572cae0362c843c74d58d1953
SHA1 21f7fa42a6ac2c85f4b42715c2f41716854266f5
SHA512 99dfc47a6447305dadf607da0beb7795589c8a13fccbe01a06abed94d5cfbf9d2b44c51d817739f61e4a4f4a2a3dc189cd4ee5d8b873d0f33c59fc77a81cd337
SSDEEP 96:BhQER0xWpDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:Yq0xIndjnHt9S/f8JzSV+6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/dvytezhb.wphwjcvi.ksxgrfec/no_backup/androidx.work.workdb-wal
Size 402KB
SHA256 d29888b82ca03d57fd2195266f94e11f5ef0bb35d9fef770003374a84290f212
MD5 5aa9c5baf6bc7c626aff4828c01a643e
SHA1 357892903a4c7515d7e7e8ec6acc2ee17b333253
SHA512 ea92b7e666b076e38cde0c5805c4b02e882fcce6aa54e3d00bcee2bba5a74db0c546492a2c4ead4c7e4e7d6981645c6d85528eac62a8d2d0db2fdaf4bc74cea8
SSDEEP 1536:iYFYMYQY5YfYuYpY9YsYmYgYhYtY6YSYlYhYWYFYNYFYcYMYxYmYUYFYkY/YbYLQ:q
MD5 SHA1 SHA512 SSDEEP

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/dvytezhb.wphwjcvi.ksxgrfec/primary.prof
Size 1KB
SHA256 e3637aaaaecd3a2b858dc2e3ded5904c6c8e4501f91b074afd3294de28146495
MD5 df3abbae50e9b13ed00df99939ff3641
SHA1 93ed35c535760f2d82992706c6204eba60f316ad
SHA512 8032f21835c113402df231ad0d543469a6081a8f5fd24a48ffad446fb182924afb1d5d634499f3173634d5c733f1ac4892c76b146970944cf5e31866f9462f8f
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/dvytezhb.wphwjcvi.ksxgrfec/primary.prof
Size 2KB
SHA256 817432d08dbb61196c417e8633c9c35612dd80b87c79bc8b0cea25c6048b5c80
MD5 8847a245b8afd32eb5599ccb8e03eee8
SHA1 bd62b2a5a6e12060f1959d29bbe53d4a22aabc8a
SHA512 741ff593a1e308381e0ec12f4757080991a19c65f8216590f5aa16f360d65bdea1748c368458a9635387c1f764e3e7cdc107c70b1918260aa72625c2a9b58d44
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads