darknimbus | e852dacd77734975b38ed087ccb416a4f72ee0c915b24f7d7c74481205e1e153

Resubmissions

17/11/2025, 18:58

251117-xmq5wsxmen10

17/11/2025, 18:58

17/11/2025, 18:54

14/11/2025, 15:02

26/12/2024, 17:24

26/12/2024, 17:20

Analysis

max time kernel
11s
max time network
155s
platform
android-10_x64
resource
android-x64-20250917-en
resource tags

arch:x64arch:x86image:android-x64-20250917-enlocale:en-usos:android-10-x64system
submitted
14/11/2025, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5af767c90035a88d9a4d329c24631de21ba0a9481e0e540e058c9cfa4709a7a2.apk
Size 6.6MB
Sample251114-sewm7aslfx
SHA256 5af767c90035a88d9a4d329c24631de21ba0a9481e0e540e058c9cfa4709a7a2
MD5 079c14eb237a32c2d7897e46a22fff7e
SHA1 e0ddaa8052421451442276b763c797f6fce0339f
SHA512 d93503002648c2e40514059635c2ed723d3b49f899ae92ccd628dd68ee21d837aaf4d7165cba7f8010d7a118d2c6fa4c41983a99595613ff7655d3fbf7bb7d22
SSDEEP 196608:3kyBaKsrhXLA6cofiiJdrXjqDTjqqLUlu23/uoo4:JaxlAcRtUqeg/uoo4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor collection discovery evasion darknimbus infostealer persistence trojan

Malware Config

Signatures

DarkNimbus
DarkNimbus is an Android backdoor used by the Earth Minotaur threat actor.
backdoor trojan infostealer darknimbus

DarkNimbus payload 1 IoCs

resource	yara_rule
behavioral2/memory/5015-0.dex	family_darknimbus

Darknimbus family
darknimbus

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.android.asys/app_impl_jar/pl_100.jar	5015	com.android.asys

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.android.asys

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/raw_contacts	com.android.asys

Reads the content of the browser bookmarks. 1 TTPs 1 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://browser/bookmarks	com.android.asys

Reads the content of the call log. 1 TTPs 1 IoCs

collection

Call Log

T1636.002

description	ioc	Process
URI accessed for read	content://call_log/calls	com.android.asys

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.android.asys

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.android.asys

com.android.asys
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Reads the contacts stored on the device.
- Reads the content of the browser bookmarks.
- Reads the content of the call log.
- Acquires the wake lock
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5015

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

Lateral Movement

Collection

Data from Local System

T1533

Protected User Data

T1636

Call Log

T1636.002

Contact List

T1636.003

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pl_100.jar

Path /data/data/com.android.asys/app_impl_jar/pl_100.jar
Size 75KB
SHA256 324454011a53cd2852e8624aa4e91d59d54393f39d0562762cad2abb331fde0c
MD5 1cbcfc98ca900687c022d81149c72112
SHA1 94f43f6b766b1d85d904e98482e3b394609d7182
SHA512 580e8d5c8b0e89ee91be6583851dffee8864466d66563007722fd0edd8fc87c62f76ca9929cd0ce177d5584a826f6482cbdbbc87c56589eb22047a6d002941bf
SSDEEP 1536:BAZalnpq5uzGSPFi3xaMwgVMY32yqDd5ov9RsBtJ79R/4WWGkuS4/se8:ByaX6d3x0tCkd5ov9SzBT/4WY2/sD
MD5 SHA1 SHA512 SSDEEP

Submit Download

libnetcore.so

Path /data/data/com.android.asys/app_lib/libnetcore.so
Size 342KB
SHA256 564ca2dbf01104c82bdbcc871af0075b855ce6201d4166e5b3090a186d729c97
MD5 a76131260dfa9e485a0427a6a887b8ea
SHA1 ffedc24480fffb0e6fe0c5ff37111af2c474f3b1
SHA512 fb8ea0a035705b93516253e2afef0f8eb2f11669de31cffab233d9b18cb07f028579fca8ef4a2117cf9f2abc428647fc8c903abca9e65c6d715db175cbd9882f
SSDEEP 6144:HmZv0SV7Mvq0xwrJCJxf9cqf7qXcEdZ7p0RkKMug6OYPVum:HmZv7Gq0ekXn2sE/10RkZYOuum
MD5 SHA1 SHA512 SSDEEP

Submit Download

libnetcore.so

Path /data/data/com.android.asys/app_lib/libnetcore.so
Size 332KB
SHA256 f46de822f41c160fce44f3d46f5166f30eaed786bc9717bc7d4444eaf85bca58
MD5 79d0a31ee80fb2c42a7ee1ef3780d40e
SHA1 6827c932fbfa80ea720b29b39f85bddfbb3de137
SHA512 675b028213e06f610980a878c386e763c22da864e61f992b77f5b996923832732e57ccbca277757e6064c84b547012adccd3a51e7191f3653b6b72f4e83f8259
SSDEEP 6144:YfsbfmquZr6S/jPuHCnCA2fG+eaFGF5S0bDzVXqZG7lf:YfsbfmqkD920k0Hz0Glf
MD5 SHA1 SHA512 SSDEEP

Submit Download

libnetcore.so

Path /data/data/com.android.asys/app_lib/libnetcore.so
Size 361KB
SHA256 6261cbf1ccd84c1ad2374d4c548841dbd3c0d1e208dd26b5467a8dae6d3d4916
MD5 130dc2ffa8651966c0c2edf69eedcf5d
SHA1 698d72da22e826504e27fae141d786423cb3b7bc
SHA512 0fc17f60662ce3e5dca641732139dea1d15d44b724e8f1cda9e9e6d83c2c16c16bd459c687b565a2377cc04c4b503b6b487762738ed04186db85f285db19f95f
SSDEEP 6144:q1RfZlGh1UMyRo5tBm7GtwUdl7jRTGKBLXmXGgg1ce/n76YBQ3nIS4hQ:MRfJzct47M5tDLXyLg1Z76YZQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ansec-Asys.db

Path /data/data/com.android.asys/databases/Ansec-Asys.db
Size 84KB
SHA256 f6721268e3751317d66b64a20dbe518eadbab6e7ea9069232c421b088ca345ba
MD5 3bd94680e31014f723679bd10e627b01
SHA1 34c496603cb086fa462c7f1e54294fd261862566
SHA512 d826b39abfb7820439abf153b1b4a5eb626158abba312d7cf7205235c43f8b931fb8645ef944deedfd690e4ebde4e9a45e7f174e9080182d4a01bab1e6516ad7
SSDEEP 96:1lal650ckcu2ckcuF5zf4DcWik7cuTaNonPO35g7SqA5cktTk:1qKL0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ansec-Asys.db-journal

Path /data/data/com.android.asys/databases/Ansec-Asys.db-journal
Size 512B
SHA256 027b2655241e15881c669df14a2962156b58ef0761a14950f12d56607aebd0fc
MD5 77b8ed54246cc8f25c33f00fee2fb59d
SHA1 b6d5c1273af321bb853528930170dfce5a3d9bc8
SHA512 4d9749cff8a7fb475dff235700a0a45e3d95e0eb87733b53f20b84a1d76b042b4ce4258b585d3418e63462e5ef7368b3e28296a177dc740d9dd079dc59508e7f
MD5 SHA1 SHA512

Submit Download

Ansec-Asys.db-journal

Path /data/data/com.android.asys/databases/Ansec-Asys.db-journal
Size 8KB
SHA256 27a339365d450fc5f01f64d835f26dc2440caa26fc1f7a0bcdc114caa05190a5
MD5 6769463bf3dd367391f8794c0280768a
SHA1 2c62a1c8d6222c24ed263db8a117ebb1893286e1
SHA512 e63acea9537b2fcd2e5a2f6df1b41306d0481bdf9f83bdd4acb0cd560b079c4a845ad667da8478b5f22e60a00a39c6db0124e63130221e2e41cb16da03290ea0
SSDEEP 6:7+/l9On15g9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKqh:7+t8qLiuWdwRmBEyPbbh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ansec-Asys.db-journal

Path /data/data/com.android.asys/databases/Ansec-Asys.db-journal
Size 8KB
SHA256 1eabeb2f733f024d4707b5f15e7c06f9888be0d4a1a17b868b9391f997aba78d
MD5 b0afdea655f834ecc68350318ee5b3cf
SHA1 fa9711d9ad38c45da1b3b2c18847db2c845b8413
SHA512 be862728d693446f80c31f815ad7a4c60ade9c06d24bf04a82011d5f1522983d743a252740571d8224a62d8dc73013a0afd8111fe58617c4b93cebbb2a381229
SSDEEP 6:7+/l9hgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK2M/b:7+tX4qLJdTRmBEyPb/sb
MD5 SHA1 SHA512 SSDEEP

Submit Download

pl_100.jar

Path /data/user/0/com.android.asys/app_impl_jar/pl_100.jar
Size 214KB
SHA256 5e2b47f14241b04bb3720b829901f664ac61ba6f866fc682cdce18d8727dd5ba
MD5 416da22e7aa299691e66254c472344bc
SHA1 08626a2ce1e0a84d7dbc0f738318da1ec56b8224
SHA512 45b2d8597f4bee7ee0cbdebebdc714de58518943d834a170f7dbd029718577597cf93089133ad048bfeb2a331c441d5e4dc2a3be1881f7dab988f4e35c7543ae
SSDEEP 3072:A8HX8MWUgL/r+5KB+iH1aYHU+n8S5Y9xC1byP4nj4A:AklWUgL/C5XiVaWJqYjr
MD5 SHA1 SHA512 SSDEEP

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads