3269a0116ce0915afdd32e8d87b05ae9f5c00fcf0a6729add39a6a87aaf30089

Resubmissions

03/08/2026, 08:50

260803-krt15ascnc10

23/12/2025, 14:30

251223-rt4rnsspex7

Analysis

max time kernel
147s
max time network
151s
platform
android-10_x64
resource
android-x64-20250917-en
resource tags

arch:x64arch:x86image:android-x64-20250917-enlocale:en-usos:android-10-x64system
submitted
23/12/2025, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dexopt.sssgf.apk
Size 6.9MB
Sample251223-rt4rnsspex
SHA256 3269a0116ce0915afdd32e8d87b05ae9f5c00fcf0a6729add39a6a87aaf30089
MD5 b7555d45ec31adc23ea13ff173926251
SHA1 eb53b2e264c2eb9561b75ece770a259d55319820
SHA512 b70075402ba6d11f8b2dfe059acf1320389d8a995ed722f699679017724276f99daf53f13bbcdc441082fa35cbfdcf17d2470ad22e6346ccbb8767467ceb2c7e
SSDEEP 196608:ymztyyGUWebdmCr+0B7ed2HoCdKyOG9cw:y0YUWepr+Ac2H0yOG9cw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker defense_evasion discovery evasion execution persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.nmz.nmz/app_fix/ql.json	5058	com.nmz.nmz
/data/user/0/com.nmz.nmz/app_fix/ql.json!classes2.dex	5058	com.nmz.nmz

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nmz.nmz

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.nmz.nmz

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nmz.nmz

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.nmz.nmz

com.nmz.nmz
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:5058

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ql.json

Path /data/data/com.nmz.nmz/app_fix/ql.json
Size 3.6MB
SHA256 c8b988b62a303a591116fe6464facdfe978235b38617ff0c1b3a2a4eafe55208
MD5 a923deb7607199e2cefe9f3bb74c5bf6
SHA1 5fdd4871f1fa8235beafe19e9014c3f0009d78a0
SHA512 e61b4872c86b4997a2dd127110e17a4e2153bae556e6b7000181f17b7dd6e13419a1aa36d396e2800a37b1e6139d895dec1799a9896a60497228b7002e8f5c47
SSDEEP 98304:CloOI69AmwV5y8Qq825eaRSRs3JGWRQaMDC/gAH:QI6umw5NQs5IszJMDC/gAH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ql.json

Path /data/data/com.nmz.nmz/app_fix/ql.json
Size 3.6MB
SHA256 ba9be26e035e007eb72919b5273c80bf52512f3da1cd0443bb0b3c0238272e50
MD5 7802242f0fd3e5e1816f5ede4a9a1f01
SHA1 5ab7685d26829357a0d2691c656feece1a6a4a1d
SHA512 5efac840b40c0d630a1449ff1ce0f269d97bcbf501c32077dda242da5b8b133195561f57aeaaecc4fe7c1e2a3995644381f7e1c07accee81ab8ba62b747ddad1
SSDEEP 98304:fct6GEbFLF+Ntc8yoG5cbTTQz//GMwZPLTJQUaVW9R0csw0arm0z7Ue:fct9E9UNKhoG5cbfC//KPXSFVW3rm0v5
MD5 SHA1 SHA512 SSDEEP

Submit Download

profileInstalled

Path /data/data/com.nmz.nmz/files/profileInstalled
Size 24B
SHA256 d1e15092d1bfefc4574a6d7bc5a387b645a8f130183cfc4961085c028179bd2a
MD5 b15c9fcc18618dee86324b6f8c28151c
SHA1 a727e35b377b928bf11cf3e3a1e8607137be8860
SHA512 b9327c1ef5a0d89bd34e4ed38d1f100baae4dccabde8b93e36dc473b2b3df1782ff77af7799035f5e58c94ac1201c9de21e96db16be10a499fc76756231d98e3
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.nmz.nmz/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.nmz.nmz/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 62f6ab8679ba135177b1995d1ca4d5b01ecd3c0906e18606556083bace7fe70a
MD5 53dfa7d08c8fbd5080ad3b3aa87c3d65
SHA1 147e8289941b02985e3421773d855f8927ff55ad
SHA512 d58c0583f84b9bb19f34e537d0c34ab3ba09b3b5e06fd0e0c033174ff12a5b2dd7a4d0025119b78da7adef086b203000575e29fe6a3ad5c44a9a962376f6a3c3
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.nmz.nmz/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nmz.nmz/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 e50c77ffde8e4e37592580b27119c5990b8aec48ee18f947a35b47218e916412
MD5 14976ea3dbffac1ac8f3a67d49469a9e
SHA1 ba962a9546044ffce996fb3e1099f40bc549e8ff
SHA512 b5b09e087c8902746d7ecb3d70b02990011372d56f4205fcf32bb78f54723bd4cda9167299a66bbd08156423749e0bc1a67060fdedef051be4b62ae1a2606461
SSDEEP 6:KaGpF/sr19FZdrlOERX4PBX4ogLugMBX4suuK+/B/oDXlP9fIBViOw2:KLpFIjzdTRmBEyPbP/BYd9fkiOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nmz.nmz/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 f588aac6eeaae699f6e001d8d1638a62a59aedafabe053bfb534bcd2c306b7fb
MD5 102bcdd6bcd5d74d164ca45441623deb
SHA1 1f9e53db8fbb3fd1654f68d4fd16b4d908a89e99
SHA512 4e7fd11e1c134e54f1d47daa5c82216ef3674b1747265e0a68944618c9999c61b35efde26356708331cc8d06d4dcd2e4f9c7c99c151da4407cf9b1512f0e2e0f
SSDEEP 96:y/g5LWf6+etidjnZRWzzb8/KeKcK+zSOddKz+ZD86u0ExV:hWEtidjnfWzzb83zSOde+ZD86u0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nmz.nmz/no_backup/androidx.work.workdb-wal
Size 213KB
SHA256 a71a74fdaa7bf0e591a453e56b7a2cfdfd8ad1a813f0a6e83d05bc7479e08e92
MD5 0798e84e5307271c845db901e21bb005
SHA1 0c7377493de3ff265cd44c8c40fdc1171e339355
SHA512 d1cef6cc28a918f9f71ba56d958e7b97751642514e9e277f3c9c916eb1da186ae82c0c5577b6391c39af379e7fdd94d2b575143f402524a6541bcd579e058f56
SSDEEP 192:b701DtYA5Y1DtYq1DtYjF1DtYmP51DtYq5:b701DtY6Y1DtYq1DtYjF1DtYmP51DtYm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ql.json

Path /data/user/0/com.nmz.nmz/app_fix/ql.json
Size 9.1MB
SHA256 a1ed3680956862e0b42a8237a5a57669fb127cc76937a6494ed684404d98a92b
MD5 1b3e751ff8d8765dcc94b5e00b416a62
SHA1 900cf6d0119296db60794a25f09241e7440ffc76
SHA512 affa37da0a9adcf781b86268139d5137afb8f2b97500ee309155b8f86a515ff66c5b95fd49053f0dbcaca6c8f5fa8c5a76cbdeb02f188c402132e2a22a86394b
SSDEEP 98304:XGGvqlRkiQyE9jLmMqFsme3XwczMRXS/ghFN0tedXf8OR:XG8qlRkLzFzMRNv3v
MD5 SHA1 SHA512 SSDEEP

Download

ql.json!classes2.dex

Path /data/user/0/com.nmz.nmz/app_fix/ql.json!classes2.dex
Size 396KB
SHA256 4a8a948659b56e63fd61b85f426f6d74ea981e3838c6a637b345014d20e0ac2f
MD5 8059ed50821caa10edbd7c3d436cec59
SHA1 0fd54297fd515ea5a67f492ced2aa5f0581c3053
SHA512 ad9caa4a68d8ba75a9f9d9151324c9c8d8f726424d408a688d35d63bd5dc5d19fd94f2caa51b644011ab6f40edddb90d5216abd366d10519a89b54ea1a82d0cb
SSDEEP 6144:s9V87MbZQfmS3HCVoe+4t7RzBvlNDIqo1Yo06CxOc:yV8gbifuVou5BvnD5UYRHOc
MD5 SHA1 SHA512 SSDEEP

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads