ac21ddc972b50c66a9876f1a470f0a29f4df58c1557b8fa0ba649fc0b255dd37

Analysis

user interaction
yes
max time kernel
21s
max time network
87s
platform
android-13_x64
resource
android-33-x64-arm64-20260306-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260306-enlocale:en-usos:android-13-x64system
submitted
14/03/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
InstPizza.apk
Size 12.6MB
Sample260314-e6lqeahv6m
SHA256 ac21ddc972b50c66a9876f1a470f0a29f4df58c1557b8fa0ba649fc0b255dd37
MD5 f2cfdf73a58d7b72c17076d172a5dbc4
SHA1 7954dfa77e92b8bf16f7d3e598aea3c02017bcd5
SHA512 d96cb049f3a5174907e2acb8a723ef341f6dc11a1070fc4f7d5738752ccbeb361b5c5b27a5bc16917647cb791068fdd1e512dee56e3853bcdb70a74d31482e3e
SSDEEP 196608:49g50p5SBomd9vG4NW1WGzBcAKj/qtOLqOTWqVxszqXI/AfTGYayi6SOHgzeg:49wnU4Q1WGCAHZOTW6lXI/AfPSOHq
TLSH
T1A7D61267F708992FC4F342B38979076222475C26874386D76954723C18BBAD82E9DFEC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/nvyfee.dcvxvm.zsakxl/app_just/oinymxI.json	4551	nvyfee.dcvxvm.zsakxl

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	nvyfee.dcvxvm.zsakxl

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	nvyfee.dcvxvm.zsakxl

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	nvyfee.dcvxvm.zsakxl

nvyfee.dcvxvm.zsakxl
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4551

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

oinymxI.vdex

Path /data/user/0/nvyfee.dcvxvm.zsakxl/app_just/oat/x86_64/oinymxI.vdex
Size 29KB
SHA256 e04bd4beb6b0385b4cd1b0a340793988f068c103198f4b8507072b6397dc2880
MD5 9eee1f0654eab0fc86de8647e7db2575
SHA1 a1eb22f87502787a920a7f3576136e6f2d451094
SHA512 00e67905c129a0de3b37785515a428afa81bc77b8e67598017c60f863ec4a6df5358617ea83ffa5a2296609d831148a1f831aa0bf8f86664495af0427a8eff3a
SSDEEP 384:F9/EypzdOUVYUrTJyOHumyI52dwgt3zbx3cRI7t0fzXoyF5vC9oh/49QGY5UP/aZ:F9/Z1TcbmNGPRtmXXK9o69QGYYyum
TLSH
T178D23ACFF058AF76E1E595F9CD79E77BD88E11ABA633A3F1A0549841036422333484A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oinymxI.json

Path /data/user/0/nvyfee.dcvxvm.zsakxl/app_just/oinymxI.json
Size 573KB
SHA256 7875c0a572e921e4d221ed8255b426c7c98629353021edd9424edc0da30ec10c
MD5 99be98d760a58801bb82a3f9788601fd
SHA1 d7591c536fafa579df64183f2b6fbfb0a2c30187
SHA512 8f2f3db7d6c457f4195b4204c78d1c995e9bcfb5b9ea2045bfeaf7fa89426603096e224f524a635480b3bd78c12c206e251bbcf93fa70252670dd5d475464190
SSDEEP 12288:MsR0PBXu4BHLDfbPp5TXW98jmnQ0rWzzTCVlLfibCV:MEQXuCDplWWjqQ0rWzzWGm
TLSH
T18AC4233461CD3633F7734327E65B4F0BB2219EA746133284BA121DAD9B6AB1CDC67906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oinymxI.json

Path /data/user/0/nvyfee.dcvxvm.zsakxl/app_just/oinymxI.json
Size 573KB
SHA256 a0ce409777b04aa737e63febac6757611efc94e8c150e9d8df32d54428386225
MD5 b659263fd18f339c4a40894225acfb7c
SHA1 4d09adbe6a2deea4bbf62efc8e1fc015161f6e53
SHA512 1e88216f937ce99b86c518ce2d154404ad93c90e7ddc77ae0efac3e44706cf8a234c8f1b732d669d8bbbd9ddcf717f74d7e4afba5c9b6ac72c977d68fbfb57c0
SSDEEP 12288:4CTw9lZcVjoF3UdrXlMNlXHcwJQCkDkR60UnnDihiqAUkOqgvTUtNEzEuCIGFp:Vw9Y4Ud7lKWTCaDCiRUfq+TUHjnFp
TLSH
T156C423ED9D2D0F81D6DCB960381471B3D39FACCAD404A80BD7C56A3AB1A9590284F6F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oinymxI.json

Path /data/user/0/nvyfee.dcvxvm.zsakxl/app_just/oinymxI.json
Size 1.2MB
SHA256 5bc610d03a86817069ea52bb7b3c94c58c37b0b1e775a9e76bfe60ffba5b7f9e
MD5 73b3570bc6bedf1ff664c46e86bea4a2
SHA1 d2cbf220ce302cc48b3a304d33e1c5ef9b7b7573
SHA512 cfeb2e8476d5fca1f187b085be3b813a6ef0ccf458ae4f0ff96954eda03321e60ee471dd634de6ded5c69e8de64bc18a68d48e4353affcd51587784d2d31b81a
SSDEEP 24576:+fWyHsbRfsa4cY0RT8pLso0aBi+IVc6XgJU:6Hda4c1T8p6SHysU
TLSH
T134457D46EA429F76C8AD937A28E7034033392688BFC75F1B8809D5B5BC437D567C668C
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads