arsink | c762af1646383bc52c13db55aee64f78eb7284b658588f542a3ecfbddbc79195

Resubmissions

06/04/2026, 19:58

260406-yp5azaev3z10

06/04/2026, 08:26

260406-kb22ssgz9s10

05/04/2026, 02:07

260405-cj3pasc15t10

Sharing

Copy URL Twitter E-mail

General

Target
Android malware.zip
Size 6.0MB
Sample260405-cj3pasc15t
SHA256 c762af1646383bc52c13db55aee64f78eb7284b658588f542a3ecfbddbc79195
MD5 bfd2c802988a5260d04b4cea73dc417d
SHA1 58dfabbdedbd0d1f54fb88fb15d9f7a7f08e47bb
SHA512 ae2e5fea52c9ac8b995a61b2ff8793420dc0ba73c91246abf2c32bb5b4a13d6ba276813bbb868908aaca3f5838fc8cd1a2be292c836a8d85c826dbda1318ce18
SSDEEP 98304:w4F37R8tJtoR1/EfdR4lxH3SPkMlHQLzJuwBNiT9iVdHn80M2iE9NqvpQ2pFxqaD:d7yn6mfdClxH3S3VQEaiT8Vdc+5/qtFb
TLSH
T18B5633DFBB1D41F9C7A204AE00669290F9FD9918F7064DFB0DDBB625348083758269EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  373ed7aa5c726d29483a9d4aee692dbb_sign_sign.apk
- Size 985KB
- SHA256 c59271342ba9c0d6eae9d46ae14d91d62e5eb31c102440249f44f10b32e0e82c
- MD5 f5e0082e7c969b1034cc15a8bba33dbd
- SHA1 6d65a5db63a215b9c749fd01a580d83d3a63038d
- SHA512 e7102bdd67041a7d2fcb7244c2282f2b8f54d1506edd4c35d3863c49974601230e53ca483c3956a83ad37d7783fa18c7cf06f3688db0d3bdf244ba06d9dc6ab6
- SSDEEP 24576:fn4vpFHq97WJVjS6dFjsyYQdFjsyYOVSLJ3u:PMpFHWWJVi1nhu
- TLSH
  T1F52523E8A7CDC0C3F4720F7F461093256F5AEE64B521EA8F624D794E58309910E4AEDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

evasion impact privilege_escalation stealth trojan
- Removes its main activity from the application launcher
  stealth trojan evasion
- Tries to add a device administrator.
  privilege_escalation impact
behavioral1 behavioral2 behavioral3
- Target
  FBI Ransomware.apk
- Size 476KB
- SHA256 4c15bad3486dc4aa0553ad267812aff29b1a4951abcc6ec91ef7c1feed78e7b2
- MD5 645a60e6f4393e4b7e2ae16758dd3a11
- SHA1 8f27ab0f023fa7a5b333d68a377d85c082740bb3
- SHA512 6ce269147600d905eb33214e24001bcc2804d99858dddd469b6fca3d32df768ba33f2f917afc4c558a6fd5d73c893b09d84b557b5a0acd25eb2548a1c96dff7b
- SSDEEP 12288:kt6QL9GaogESC0rBVrLV5bJ2mdd7q6HPN:kt6QoTSHrnrnJ2mddbHPN
- TLSH
  T111A423C0CE82AD14F1D9F2B5493F536328F99C497DB656CE2B052CDD38D0E9788B48A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

impact privilege_escalation discovery
- Acquires the wake lock
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Tries to add a device administrator.
  privilege_escalation impact
behavioral4 behavioral5 behavioral6
- Target
  Facebook_Lite (SARA Locker).apk
- Size 2.7MB
- SHA256 205973d0adf1a4f9ab4cb1fd70a6a343b90d2d5b053650478b3f0a961badf54a
- MD5 1c0ce0937b9073d2b991bd0d8fe733b9
- SHA1 5e1aa782b9b70ccc83dba006b80e60d3bcdf5eb0
- SHA512 c0a843de1f461903c6e34c673750761ef4a0eba6954418a5997db70759bf1edff3874454894960a0791a6a9dac0adcd814935242b52c2de3faa34d4a6a7fbade
- SSDEEP 49152:1Pc5T3jXJjM2M7xZkePc5T3jQJjM2M7xZkYPc5T3jwJjM2M7xZkpPc5T3jtJjM20:1PK3Njkx7PK3KjkxNPK3yjkxcPK3rjkj
- TLSH
  T19BD51311CA63FC84CE9AC231A9DB4FEE279104978DF222375673712D7867A3859E7309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8 behavioral9
- Target
  My Talking Tom Beta .apk
- Size 106KB
- SHA256 e2bebd58f23af2adb69a30b7ea44f557e07b2efd99502c6cc42a84a9f9a8f2c0
- MD5 0b2c6652978263951a728ffe71a741c1
- SHA1 b6507306797d732afc0e06436d21dd5db9b3b12d
- SHA512 0770f64b39bf7613402ee88e7770d1479b24c03c2e154f969559d28406bc20bbe1832d0894e355e8dcdc66f63fe6db14169b76b77fc001916001945133c39f20
- SSDEEP 1536:LuUwBx84E4uAXQlcWrZvS00eV688DANSct9eIAFHLheOTv0:nwBMAghNZV68C69/OVNv0
- TLSH
  T13AB3129ADEE4ED27C8AE88FA88F18025FD716351C2A0A7CF4B157135893B0744DB166F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

collection credential_access
- Requests overlaying windows on top of other apps.
  collection credential_access
behavioral10 behavioral11 behavioral12
- Target
  My_Horror_Ransonware.apk
- Size 1.4MB
- SHA256 31763424c3572d2402eee73fa68d7a4fd1c202ca39d1fa00df6aa0b2d47cbcbb
- MD5 bcc2416c3dccecdbe07305694b34d549
- SHA1 4df9cdac3ae5ee74ba314b931a78824f4ba9cc69
- SHA512 23e8eccf47fe43b26ee6718334198c3cf28be48cd8f1fb9bf06e92fccba5b2b05fe632d9b712a3fc1a066d561ff7b8eccfeca6a092eb82c6fdb27abcc7e6b8ab
- SSDEEP 24576:UDscTzK30jGxKnkN/leD2Hs/yYh21YnCL7UNMESx+st:IY0jLnkN/l62HsaYcpLgNgPt
- TLSH
  T1A165338BF30C59D6E582617AC1F11BA4BDB0DD601B58ABC3A085F3A0F5F856D1B121EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

ransomware
- Changes the wallpaper (common with ransomware activity)
  ransomware
behavioral13 behavioral14 behavioral15
- Target
  android.locker.byGdzawr.apk
- Size 168KB
- SHA256 ba71c7e507e1b0d8202447f9f86f585286b4ab01b58c7e32bb4f495381ef5004
- MD5 b2ea2d2d9c40a5a861237adaf7d4b055
- SHA1 7068716c49447330facbe9df121dbcf943bfc610
- SHA512 9c7a13686f3b33b83accbe9995e4a0237b49737cbbd7c831d6407c5696287329a2c758733d6239ec9def3130fb441351b7bff8a890065b1f5ca39d0209b72e93
- SSDEEP 3072:e64dNgorriQCl0Hukl54YxDFUjwUR+/1NwBMAghNZV68C69/RcTT:e6IgorGQA0pqIDFSf+LhN9CK/iT
- TLSH
  T19FF30267EE284A47CABCA6F9FC5BEE3EBF05238DA09017DF051348927D615610D9D04E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17 behavioral18
- Target
  doublelocker (2).apk
- Size 359KB
- SHA256 79e602a062d05fbb1409afc16e6d41ac0645576b2b5c1899dc93e6852c30a71f
- MD5 85cfbd81ff6729927c968fbbb2d1d84d
- SHA1 01d962f809ae061d1895cf71db9eeb07900929b8
- SHA512 26b24f7ee92e1185aa9f1160582c60cde8a814732dc3d293085eb0bf14fa48efe47f182d40d2bdb06f83f62e505ef542d5a042f2d2fc037811d70eb3c5865c86
- SSDEEP 6144:y4qHaAiB3RywInnBfnn3wy+bl/i2PNSlotYLAynYa9Bv1Mcq:y96AG3RyFnnBfnAy+bFzNSqtYLAyYa9a
- TLSH
  T1417423D76315EAA2E277A13B7734403E65A78EA4CBA4C8DF3224F82459F2D855708FC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access defense_evasion discovery evasion persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Requests enabling of the accessibility settings.
behavioral19 behavioral20 behavioral21
- Target
  Мой говорящий том 2010_1.0.apk
- Size 176KB
- SHA256 12cdca61b9fd586497500ce8731850e1c3e51f8852e8d6e52bbafc3ac786b99e
- MD5 d63ed1d4b7c5b08002ae0050686a3f19
- SHA1 65937ee4da7483e52b29a806d273cb3d1f17f674
- SHA512 f91fb2bc02eb8d21b30e9cda51273f007c803d58dbaf1bfed45b70ef51f57cab02d05c693dedd6a7b0783b0960961bf7f6b01d225ac29f5f2df12dd6c3f30331
- SSDEEP 3072:bra82Z1YqHz+1eV4UMcAgFckEwBMAghNZV68C69/1HKi:y86YqT+1eV1DARk2hN9CK/1HKi
- TLSH
  T16C0412476BD4D807CE6FC87DE8F4E479FAA27673C098D78A0517A0942DA2CB088F194D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23 behavioral24