Analysis
- max time kernel
149s - max time network
153s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
03/04/2026, 16:50
Behavioral task
behavioral1
Sample
Google.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Google.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Google.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target Google.apk
- Size 4.4MB
- Sample260403-vccteabs71
- SHA256 b600af54745d2cf6529d048e701b579368af19ff69a08b5ae26d1f0d0a706047
- MD5 00042fa56e1113e00c44f7630ee3e428
- SHA1 a1ebf362592c10a00b892a6dec930134be6163d5
- SHA512 0bf9a4a4815bfcbf1d30d2d1d24690ddb7a1a80adc75236d85aac704fa5af52dd3334ad1e7049991374f4d0570775949bd839b340d7fa608fbb087c7d86bea09
- SSDEEP 98304:AT8OFRGW75+bJ8UvBVMyLbGmzozBXTE0t4g98L5:LExQZVMyL9zM33e
- TLSH T11E26F103FB54D68BDAAE83F26F270C9916175F14C692A6D740107A7E2EB72C10DC6ADC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.whh.premium - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.whh.premium - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.whh.premium - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.whh.premium - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.whh.premium
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-04-03.txt
- Size 13B
- SHA256 ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab
- MD5 de2c41a51ee9246eb1708f65b511add0
- SHA1 2f442d634c8a18760a232c8829d4b5d74a52f074
- SHA512 7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-04-03.txt
- Size 21B
- SHA256 e0d37f5f3fec0ce59d296137e3d49c3b0765e41da28703d397a8dcc3a3fbfef0
- MD5 62155ad61e5ad1fb0a6877237b69a99b
- SHA1 f517a5ec81830af3ac41babe8d9505667f16640d
- SHA512 5aeb47d0334c090b3776649819b693176f12644f74eef2e5d46f2f7ed832511dabde96cf79c90c7bd7af9d9b677d24345dfab0c49911cb4b7891964034085d62
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-04-03.txt
- Size 25B
- SHA256 076eb89055ff3d929eb732e1002a0105652e628682a741151388ce1df3b6ec9d
- MD5 bdb821a955117250611e94cd23842584
- SHA1 81edcea1b44f94cfc140710c8410d0696b760c67
- SHA512 e52ffed4ee84acc414c530c239c8876d9e99c1f2b2c7626c0ed7fbe0c59b9cb8f8a5e9e983541bea3dfdb849dd3b9593df054c2482ed8bcda7c70ebd960ca268
- MD5 SHA1 SHA512