spyloan | 7ec1cbd8c767a3d87a62fa7da3574da2ba56df753511609bd8d179bc1d2d635e

Analysis

max time kernel
93s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260129-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260129-enlocale:en-usos:android-11-x64system
submitted
02/03/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aaseoy_2.2.6_82375752.apk
Size 26.7MB
Sample260302-ldevqafy2a
SHA256 7ec1cbd8c767a3d87a62fa7da3574da2ba56df753511609bd8d179bc1d2d635e
MD5 91d2b6f18b178de65149006da8585cbd
SHA1 1fc3cf1a47a06c5a2eaf848b43585cfdf6168d1e
SHA512 6cf321a0deec285be494180c6f24e0bbfcca03125febdd16d82ed189a7a27222add0e657511b0f04f00679c5415a4ed27bf478d886f06be1e0b6701c2c8046a4
SSDEEP 786432:FBS1GPzROtfXyvY9Txn8jz7vAMmMyqCG6C6zY81wptWP:FUQUNyA9TxnuwMmMyqCG5JgP
TLSH
T102573397FB28883FC5FA12B39D6A113277729E0486926B173984772C2D3365D4F89BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyloan impact infostealer spyware trojan

Malware Config

Extracted

Family

spyloan

https://6nfk1oop2kry.xszc666.com/
https://J7mkI8.b3h5n3c0.work

AES_key

Signatures

SpyLoan
SpyLoan is an Android malware that pretends to be a legitimate loan app first seen in December 2023.
trojan infostealer spyware spyloan
Spyloan family
spyloan

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046

com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046
1⤵
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4795

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

lv-db

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/databases/lv-db
Size 36KB
SHA256 3651e597fb6ac8a7514690db6e991eb412ad78cef6bca9b4204d6242f4df687b
MD5 67a0e1061bc66aa8b93e3109fa35cf58
SHA1 23a390edaa04b61692aad2c5c1108d5620a77398
SHA512 1889db469b7a9d789c0343123536f652ed3d94c7809dbce9b140a67353edb4b53616a5f71223fbeaa4f8b8ad0e9e8eb09f1548499fbfc4a059e35871ee407a6a
SSDEEP 48:TZJPMFRgm74+kh0CfAICH71AAkjrCIK8HopudEB3hWMWS:VJTE4NSaLCH71AAkfCvkHILT
TLSH
T1F2F2E1EE1BA17B48D6F46433A8A032205CBD693F576363852DA150B29D43A32F5938F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv-db-journal

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/databases/lv-db-journal
Size 512B
SHA256 ee3fb7a01f469094b177100093c1dbfff952d0e01d030d44f92bb1596d85f7df
MD5 3b9b30538238a2e868015c3002b345af
SHA1 4892361f03bf551b40ae3f35e0aa6ca664b5acbf
SHA512 2b70dd76aab5b62f4932d2077afaea31d6f7e8120c7f6f76d73f1bd950fae76a268d0e7b9508bd55b787c259060a1aff0c97a36cb34ef897b9eb5569b070bd8d
MD5 SHA1 SHA512

Submit Download

lv-db-journal

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/databases/lv-db-journal
Size 8KB
SHA256 ebd1188a17ef48158b644d6effbb1c231144accc6e3665d7423f59473ec52792
MD5 b94d62304b71f8ff17eb675a6f42589c
SHA1 2f29be4e30e71577e666f572411092099d9a151f
SHA512 33d54758b4d8b1556bc8453da44d493e1bc66042df233032671cbd8026471694d3a2c28e53d5429c78081f3f967dc42961fea2eaf402382957543000de573183
SSDEEP 6:7+/l9in1dg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKfe:7+tUqLiuWdYRmBEyPbWe
TLSH
T14B02C0CC73800823C82E1677D0D483440E04E72A9571CB1716B00C983C074CCF4F1D84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv-db-journal

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/databases/lv-db-journal
Size 8KB
SHA256 998b34f682ea373ae0f279c6c81b381526f6b08409a02dee63bc7d3724f715c8
MD5 3e77885c3e40029698fdef50d0063e6c
SHA1 bcc475d358b9ec1b2c3b5500f12d261233de5a07
SHA512 dc4ee719c4ca50e84537a7e1545bafe50030f44dec26cff68da97640276c7f6dcdfa565def51e631950f2b294dea8b99800dbc2f5d1715168ee9c771db21bb2b
SSDEEP 6:7+/l9SWMOPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKjVs//qL:7+tUWnqLJdeWRmBEyPbes+
TLSH
T1A90222CA63402803C229277BE0D883981E11AB2892A3CB071691085CAC07ACCA890E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.YFlurrySenderIndex.info.AnalyticsData_4P5Q483SFDBYHRV77PW6_313

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/files/.YFlurrySenderIndex.info.AnalyticsData_4P5Q483SFDBYHRV77PW6_313
Size 88B
SHA256 fe480bde1aded3acfe0a7b3c935d7f2471b03fb6c7879708665f7a89f19bb191
MD5 d5be64883db596a7882c9838316c218c
SHA1 10264f06f90066bc842012926a4b63f1baaad8ea
SHA512 e517e603e1e40900b81709bc01f8cf7e6a604469b9f6b052f29e7af0dca23f06c9e0f7206a41344d7b20567204e7941570ff26a6142f3c6e020f19204a51cc82
TLSH
T1E2B0128029B65315D467603460424909406F8322D0C29BA02351A0011005D1047D0D12
MD5 SHA1 SHA512 TLSH

Submit Download

.YFlurrySenderIndex.info.StreamingMain

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/files/.YFlurrySenderIndex.info.StreamingMain
Size 79B
SHA256 0078d0bd69d06f161229be7fc7a6f5db136826548e447e18f2061d6b552bcca0
MD5 7cedbfb1ff430fc84a9d36f01ad5633f
SHA1 a97e6284ab2d634eaf738c7f7e599f8fa41e1f0a
SHA512 6f4dd9a7d1035adb81c7e0856397f0ee3dbb41bfad4081bd0197153909b65cf7193b4cd5681411b032cef494ec9f7a1357839e6339b042fdca46512053dabbd5
TLSH
T1BFA02282AE23800BCCCF003028B0CC20A002C832B3E00023300280080CFBCB08B0FFB0
MD5 SHA1 SHA512 TLSH

Submit Download

currentFile

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/files/.fstreaming/fInProgress/currentFile
Size 3KB
SHA256 1da9a835f4bc8645b1ecdb8d6bcc89ce4984291f210a748e50fdcc3ed07a86b0
MD5 c12fb0bd4cfd651cae0da1442fe3747a
SHA1 5aac944d539a344e31fa3ebc25001610d3398be4
SHA512 08dd77bc60acc26427bc6979e967cb7716d7a28c203793c3bd87b7349b7871a98d356aad2ab1871fe82c39137ce59ab4ed927bae586776f4cb89efa32b4f3331
TLSH
T15D61C92E7F25C5B3DB4D47B491891617B73E1250B4841686A7A80FE5323B39EB42733E
MD5 SHA1 SHA512 TLSH

Submit Download

currentFile

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/files/.fstreaming/fInProgress/currentFile
Size 3KB
SHA256 34d259df42c8cdd702139349a5af21e77f816f291f235947142d110517b0997a
MD5 e46652918cb36924de3de2c77e3e82bd
SHA1 9a51be8be18ee393ce852b6b36b5caa93adedb50
SHA512 24e6f1366d9e54863a683ba02342fa5834c634f0299d396393379c9c6a0ee322d56c31b3ddf705368648ecebd7151ebc741445dcdf0cb8a513a3d3b11b79598e
TLSH
T17861CC2E7F1AC473CA4D07E8A0D96552B73D4204B8854A8663BC8FE4793B69DB42333D
MD5 SHA1 SHA512 TLSH

Submit Download

.yflurrydatasenderblock.702946db-150a-45e4-b935-17cfb895fe59

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/files/.yflurrydatasenderblock.702946db-150a-45e4-b935-17cfb895fe59
Size 1KB
SHA256 81cbd80d1162cb143ef492c8232cb3f750139a17bedda1f6a6a9fb3a578082ea
MD5 8781f8e662fb92175112d33f06ea989f
SHA1 6ccd603a15a62d65d2c626d4037d1fb295b2fce1
SHA512 476502f4b60fb4d1d580b50f7c89e413ed397ca6243f06fbfa617f168ef8c68283f6cd9a9f0e3cee3f033a927b3560cea18c9e82ca6eab3f79bee9c1fccb2de0
TLSH
T11321D829F5B528B4ECB0A7064C16AC23CB9DE400EB3B4B7930599191A50DD326F98A2C
MD5 SHA1 SHA512 TLSH

Submit Download

event_cache.json

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/files/event_cache.json
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

event_cache.json

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/files/event_cache.json
Size 349B
SHA256 8b4eb8315f729c1b14e05c7bd12ec9761f0b77366277c25952d1dd9e0f892bd6
MD5 fc22b57629d07c8a7ec5c492a801695d
SHA1 3b0119c9b7eff52d9b7f5d4c71f005dbaa4480da
SHA512 80ae08049162068acf9c61f17be973690c32338975ff0652578da1926b0987d995033e1247a0aa9268165d759dd4703168c95ef4c26f593a902af6bac93d1167
TLSH
T1EAE02681C3A5CDF3D7BD854B69D2D85015EA25B3D00426BCB8A82C201C4C382634A08E
MD5 SHA1 SHA512 TLSH

Submit Download

event_cache.json

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/files/event_cache.json
Size 850B
SHA256 f65f644735b7eb6bfbb79ddb93792dd6c0eb1c4ae02876fc6b49f6d1df5f4885
MD5 6c8810765eeb90998fdefab2d60d39b9
SHA1 075c2804d508a7f7d5aed2868c1d54606bee9891
SHA512 b866133a9065aa4dea2149f9248a9688a883b0a8e1ca99d0f051e240035c7a532aced40b84a261f5fd60fb2696ff77df84be299aad88841b5c5ad667ea11aca4
TLSH
T1DC01895A8FE4CDB3C3FD848B69E1985119EA24B3E08515BCBCBC6C20180E796274A18F
MD5 SHA1 SHA512 TLSH

Submit Download

event_cache.json

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/files/event_cache.json
Size 1KB
SHA256 de7f7c5870cae18653166fa26fb9ab23718b4d386055048fdc95451035ef3f83
MD5 7e95fc6620f19fab3cacf8c1dabe19c6
SHA1 ae64346735975574e29e4b191aece7a3989c79d1
SHA512 924127a514a6f1e375c562c40181b6f606e5fee14038c35e521274151eebcdacfe32cae4574f6e2beaefb17281fb3166a10954d4f02b3b0fb4e355cca0818a96
TLSH
T149218E5A8FE4CC73C3FD848B69A5985119FA24B3E08515B8BCBC6C24180E796174618F
MD5 SHA1 SHA512 TLSH

Submit Download

event_cache.json

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/files/event_cache.json
Size 1KB
SHA256 c8f602dd2535f9be3824a1aa7568fe316ea26ce3e83413b1f7e21517b621389d
MD5 50568ae80e5aea32c4d44b6f39563067
SHA1 b6f28cf8df9b220d27e3977728ef7b52a44d0a2d
SHA512 cbf42a745388f0575a6b30499c567e0c21e524b60e572d593414e9b3c016960823b3676f4fbd3ce2d08c52d5797ac808f779c80eadf18964c3c97924e780e2ce
TLSH
T18431AC5A8FE4CC77C3FD848B29A0989219EA34B3E08515B8BCFC6C24180E796174729F
MD5 SHA1 SHA512 TLSH

Submit Download

installationNum

Path /data/user/0/com.androidskhgqw.xuf8b45h3kf90hgb230gb0nbfg2h58674bugfdg.d1768882246836121046/no_backup/.flurryNoBackup/installationNum
Size 100B
SHA256 dd97095a9bb079f4d04e88fffd2887b6e15cbb89573a59e8ac68ab67f3e47a3b
MD5 d7005293045e90239190c66e913f2d46
SHA1 bbb1ea1c46225616ce7479ece74032a1a0dfe2f9
SHA512 44065246f87acda65b00708cc8a6afab8b7cc83fc9dd4f6dfb19b99cc1a855a3b77232c6a7a6d7032d50af0c2d355e2fe89b3a73479b6bd9a93c86ec247b94a8
TLSH
T1FAB012545B6E8430E814C0B45B523811D21D8121100078002360E03C9CD5CE151CAFB9
MD5 SHA1 SHA512 TLSH

Submit Download

journal.tmp

Path /storage/emulated/0/Documents/om/imgCache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

Path /storage/emulated/0/M3u898k/kdbc/kb
Size 16B
SHA256 f9aba0b59f1495f72891f4d573a790745f905ed7ea4f5a8d304d29726ecc8c44
MD5 40d05d54ebe98c03599dc0634d60e1d4
SHA1 905e486146ec51281a89f36e14a1e982061b4ba3
SHA512 508c1801999db40612858af8c53291dd0b486d22f662fb978373c12f953e33df2c4363a2a752093a26313fbacbf1cd213cbc62148b7efd599ffbfb8379cfe9dd
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads