133ef3da9ef542a22c07bc297d422a4836fd453d0a780fbe73a719a2f3560f48

Resubmissions

08/01/2026, 11:36

260108-nq2alaap6t10

08/01/2026, 11:20

260108-nfph2szreq7

Analysis

max time kernel
6s
max time network
17s
platform
android-13_x64
resource
android-33-x64-arm64-20260105-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260105-enlocale:en-usos:android-13-x64system
submitted
08/01/2026, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
133ef3da9ef542a22c07bc297d422a4836fd453d0a780fbe73a719a2f3560f48.apk
Size 11.0MB
Sample260108-nfph2szreq
SHA256 133ef3da9ef542a22c07bc297d422a4836fd453d0a780fbe73a719a2f3560f48
MD5 b09a989daf66c08c4912f6f780e010ae
SHA1 c151f8cbb390e570b22a686c18400c06663c1540
SHA512 99f427cb6d1021617652b1cce9fc95f6612612bc67cd1fa7244f4cbb78694f5af2fbda657981243d364ac9e37213695846c72fc02d5cce92a23e529aadd2bae0
SSDEEP 196608:2GnXxL3muEE88mGm4f2o/gJpBAvQUJMTcGf1TsT0EVtmYZtNC5FUieYXAetEZF:2CJ2uN0GF2mgJElMl9TsT0CmYZtY5FUN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/wlaabw.epewgh.bhlamd/app_horse/ybi.json	4133	wlaabw.epewgh.bhlamd

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

wlaabw.epewgh.bhlamd
1⤵
- Loads dropped Dex/Jar
PID:4133

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ybi.vdex

Path /data/user/0/wlaabw.epewgh.bhlamd/app_horse/oat/x86_64/ybi.vdex
Size 29KB
SHA256 b8d826cbb4fa1f852a16ae391a4a5f0cd4b9e8d1edd4cfc6d2a5dfb6ce846ed9
MD5 61942fe5f62f9454b3ccee4ad996be22
SHA1 ae3f0499cd2239ffbe3bd8ddb13d276d27981b10
SHA512 9064b4b31b22e79c920f6ec2927818e8a6e4821192296ad26ad487064f20d9a3598e80542ec3f6d733407564cdb08d4cac66c15583ab689963ed88a942717999
SSDEEP 384:p9qUUDwCBJfYunOp1a2EbtlGTHCIp5kWdaAsq8GT92gdmRz9ByB:p98ZfbI1HEbtlzy5WqqgcRryB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ybi.json

Path /data/user/0/wlaabw.epewgh.bhlamd/app_horse/ybi.json
Size 573KB
SHA256 b3cf1686cc4e48e04a819f029cbc937645be7cd9303bae3413a80f1a8c77f447
MD5 2694e682e9ec51b3b2f35b45c481b224
SHA1 e23d0d4d3ccada8f762f9eb15a25bcf9f59d5503
SHA512 a5a3420f72dd2479407947420552926a67dee3bc721268d6b278dc2f73d93787e0d9ee65e537908f236dab368bfd193a3778d9d51239365c8683728b062d0895
SSDEEP 12288:UbFTNI/2oJdrD3oDgPq20GW7KHF0XFEogebY6QGY0wPL33:UbFTwJdrDYDxYW7W80G7wj33
MD5 SHA1 SHA512 SSDEEP

Submit Download

ybi.json

Path /data/user/0/wlaabw.epewgh.bhlamd/app_horse/ybi.json
Size 573KB
SHA256 4b341beb3621cf83695f1d70bfa59593f092b1cdc666681f80cfffb0d81701c7
MD5 33e8f8fb95ee2ed61f6155f236a513a2
SHA1 b76b075ae76e8ed0aaf87bf0613d7bb8ed0feb55
SHA512 6f03ca96cd06dfca4a5ecdcd599c97f09993c1aae58b70eb0f217eb62d343cc7708e560372c73f992aa8cdae56b8a38eeed181ac14a4efa4c90f268866f72176
SSDEEP 12288:PWaFlPRfMgH0WWwzwEjcwz62fICEIQ8Dd10pvEyB:PthugH0WWw9BNg2LI28
MD5 SHA1 SHA512 SSDEEP

Submit Download

ybi.json

Path /data/user/0/wlaabw.epewgh.bhlamd/app_horse/ybi.json
Size 1.2MB
SHA256 47bc656b8b8fbd70eb4337cde7bf8b459790cc1eb2638d8d97220944d01dda79
MD5 31980686c6bdbf20ce21daeab37db779
SHA1 3d0ea01e9e6d95c912720cfcbd5b70630e82718d
SHA512 9081173acf193b371f4e07a9995b384f75fcfb68131469fd735831cb5bb6075016c97a1e6868d0d5e96033b6d932beff18bbca4740a4c21d662411fd27975b14
SSDEEP 12288:h0wIMcvN2XT8pas6e/Qpl3J7iJKExJPhR3930jY0TRmuxM0HKiA9l3omjId+MX4v:h0wIMq6T8pasIlhiLVl0r5HtA6DXuV
MD5 SHA1 SHA512 SSDEEP

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads