0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d

Resubmissions

21/04/2026, 09:56

260421-lybnssft31

05/12/2025, 04:28

251205-e3xcqsskay10

03/12/2025, 12:23

251203-pkwnlayrdk10

Analysis

geolocation tags

eueuropefrfrance
max time kernel
13s
max time network
179s
platform
android-15_x64
resource
android-35-x64-arm64-20250917-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20250917-enlocale:en-usos:android-15-x64system
submitted
05/12/2025, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d.apk
Size 4.7MB
Sample251205-e3xcqsskay
SHA256 0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d
MD5 0e73498f73c059a94e465ca5a4ebdf05
SHA1 6c9382d4c715ca9915105b5183d5fb7019af0015
SHA512 1a6c4630c0fdca1f9ba34a1922cc3fda6f3899ca64610d009c69c237076ad7d1be310d400ec6ecdb863676ad0684234d99f094c39ae75be238e6ef0c998891b3
SSDEEP 98304:3iOQbTgr4C7V1X/JJU+9FA31amsSYSizvITd/ee0VrJG:3LQeP7V1Xzu1nsSYSlpGef
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access defense_evasion execution impact persistence

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.uvxuthoq.noscjahae

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

defense_evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.uvxuthoq.noscjahae
/dev/qemu_pipe	com.uvxuthoq.noscjahae

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.uvxuthoq.noscjahae

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.uvxuthoq.noscjahae

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.uvxuthoq.noscjahae

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.uvxuthoq.noscjahae

com.uvxuthoq.noscjahae
1⤵
- Checks Android system properties for emulator presence.
- Checks known Qemu pipes.
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:3361

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3361.tmp

Path /data/data/com.uvxuthoq.noscjahae/cache/oat_primary/x86_64/base.3361.tmp
Size 180KB
SHA256 80bfa6c5bf360730f9c1e061719f2d053fd7bf392dbe5956f291774c501c59c6
MD5 1ad6b9be71f10a5baca2e717faee59b5
SHA1 920978359f702229eb9be500e508235a47d40943
SHA512 45359fb409019d38e9f3a83c7d1e40bb7734d0551bbaaa53a342ecf1fe6ad5e97b0a251ae69c88bcc0da5c65c270215cb4a41e5471fe908411d230be44a7d7c8
SSDEEP 3072:ISv1aQcEWt2ZdTU/MM9cOUaMQnVf7C7BRt67p50elm7wJzdZsmHut:ISZJUl99UtQV29D67p50elm4/TU
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb

Path /data/data/com.uvxuthoq.noscjahae/no_backup/androidx.work.workdb
Size 4KB
SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
MD5 f92de9b7aca81136a5f2712adbd9ae8d
SHA1 8612ffa8ecae146263660d878c1e74d3da282d00
SHA512 9c2b923253b6871e68b7c513a1cbd80d39e270749933dc8e08d5add372f5f432c183768854e699cbd68c105b4e81a5500caa1d3fb2b194743c2b76b6095a526e
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.uvxuthoq.noscjahae/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 8b0a7b1bb3afa78cdac7370c43f98dece0418507d9a21e058d9e0990e002143a
MD5 cf199ae30686478b772c7170afae0bca
SHA1 b2ef6eb913e6c491e6e2bcd70a73bc3f65148aaf
SHA512 373d3af31b2eb9139bade6e0af92c9e2f4f327637ca64bc9f0fc2751716829e8dba4836ca497ce05e487a5850fa874568e7040802ff41dbd901ff7406637d9c4
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.uvxuthoq.noscjahae/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.uvxuthoq.noscjahae/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 5b9299ba6ed771be2639974851046b6cd730b57489021afb22aab0876cf26262
MD5 ea99a41ded9225249c8f9889b8a481c3
SHA1 ebb6c6d1577929c7612d5a9548c502105ee1b85f
SHA512 39b668c447e0dc7a6191a8cb4aa4e291afcea3d61d6472580395493b42f798540c247473142fe02a574ce9ccd8779929de09badbaab4b301c12efbd5f51092da
SSDEEP 6:KgAMyk7yZy9FZdvlWlOERX4PBX4ogLugMBX4suuK+/OxX9l/tFqfLiOw2:KxQi8zdvloRmBEyPbP/KvtFAiOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.uvxuthoq.noscjahae/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 c4b657bde2ce54ad7885365ea0c3cf375697017308c4a650eda1c96e3237084f
MD5 81e9c5c955ce3cfb911a4a572379dc83
SHA1 70ae6d969d3c08cdcf43b5d0803b6cdc226e3800
SHA512 513b2407cf0b4be82983242d60e696716167f9b48d906372b9f60df2c63938b23cc52dd7e6d14e0dc6a4f640ede146d6ecfa826941e5399fc2a608348fcd5e33
SSDEEP 96:ue6gvUcpN6+etidjnZRWzzb8/KeKcK+zSIdxKz+ZD86u0ExV:QrqOtidjnfWzzb83zSIdK+ZD86u0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

device_status.db

Path /data/user_de/0/com.uvxuthoq.noscjahae/databases/device_status.db
Size 4KB
SHA256 df1945170c1b233925893e0ea20c1b2bab8d66fe9496688b1f6b48466b9fe567
MD5 2551f5f2fbb96470dcbce2a28bf7583f
SHA1 39e71e8b5dbc4580bee5467d2b2b663d7d8957eb
SHA512 0393526082856c3e9b21cca22e797d7e38ecb1479cace203a01b3158edf3642b85b50ddd07c2339a6c192c46c1f6bdeb795cd2df609e183c5398fbeb51045f67
MD5 SHA1 SHA512

Submit Download

device_status.db

Path /data/user_de/0/com.uvxuthoq.noscjahae/databases/device_status.db
Size 12KB
SHA256 fcc764519d2c607f2501288ae7200254f30f2a4c0eb78ea63a5c3385357e44bd
MD5 669a1499747a6bff54f4c3683523716c
SHA1 8894f3d69ad571b69ee9908508d9f992d2309ae4
SHA512 d86792c7a9a2ab4e93b9ae69f26a4a2a144f420a864e27fa1ec931c5ba9dc6651ae838ecc26b4d219619c4cf1aa40281d79dd1be4aba64da6ad53117fbd456d1
SSDEEP 6:l9bNFlLdvlWlOERX4PBX4ogLugMBX4suuKTqiOw2:TLJdvloRmBEyPbsOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

device_status.db-journal

Path /data/user_de/0/com.uvxuthoq.noscjahae/databases/device_status.db-journal
Size 8KB
SHA256 aa0b8b461c47dbe913c9dae0044fcac8645a28da51dd14a867134a5d47bc814e
MD5 32006b176c24d62fc76348bfa0008f07
SHA1 526cf8c35f488be95ec348eb5da85529cec3069f
SHA512 fdf520bc432995f08cbdfe713a1217b3497caa1ceaf3701f73067f08c4becbf9ad9e857946c7e1e9d00870e60608ed82ce3c4844bf8762c4a6a5fb70599bc1ef
SSDEEP 6:7+/l94Fn1rVfg9bNFlEuWdkG4lWlOERX4PBX4ogLugMBX4suuKW:7+tCPhqLiuWdQoRmBEyPbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

device_status.db-journal

Path /data/user_de/0/com.uvxuthoq.noscjahae/databases/device_status.db-journal
Size 4KB
SHA256 c440ce6dceb5e82a6174c0e83cccd77c0430fd7f70d64c5ae7b11e0bfce4fdda
MD5 e8a4b0f560c1f361664f4e6ebe9c0fcf
SHA1 29c1c353709f5298d294dfda2befc8a3d305c0b5
SHA512 45dcafcced51335ff7ca674e77e06e29018595ac6076fad19f23709a925a0b7c628a7a9ce6588c061c2d47dc1c213466a2a68ee53171c246dbd5bd4fddec7262
SSDEEP 6:7+/lXHPg9bNFlLdvlWlOERX4PBX4ogLugMBX4suuKY:7+tXvqLJdvloRmBEyPbf
MD5 SHA1 SHA512 SSDEEP

Submit Download

device_status.db-journal

Path /data/user_de/0/com.uvxuthoq.noscjahae/databases/device_status.db-journal
Size 512B
SHA256 7092625dbc51105c9fffc9f7f38b5bf1fb74ab706fda5ef7792d7140dde102bf
MD5 514c6cc5c7fa6db9b524d72512446322
SHA1 8c788567df982e8614d352b5555ef988f2734337
SHA512 9957b5f410281caa29bc58c8dc2a8b9707dc3daa2cfead386973544684339ea6769edf78b787b91d7b5e874d6fda30e26fe83a5b428f991226b3277f71ee2768
MD5 SHA1 SHA512

Submit Download

device_status.db-wal

Path /data/user_de/0/com.uvxuthoq.noscjahae/databases/device_status.db-wal
Size 36KB
SHA256 af1e4193953d1c84045ce20fc9cc89c94bb9a34be26c56da5f7fa6c64e657e9e
MD5 0f853f261afa59894c20bb42d11b11a8
SHA1 9047c69b50ca25993d2b64433b7a0120c575d1ae
SHA512 3c86a6c410b2b75e5637d81d9e98c08924dc703ada1f62d53df5ccfd83acdd3aa211b226421f6a918025f72369535cbcd11bbfd74e13e03157f54f266e9d6920
SSDEEP 24:K51pNvMKpUWY82V08WsL08z886vG9bA8hePMGSP/eYsZU1otiS:u1pRMKp5RoWGpXbpEjSP/Moo8S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads