39901ffa746a6f6ac3de2b36d9e61e0d60b221f4d9510436fd3cb3d2d7362130

Resubmissions

15/04/2026, 19:35

260415-ya4e5abv9y7

15/04/2026, 12:57

260415-p7ectshv2t7

Analysis

max time kernel
143s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
15/04/2026, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39901ffa746a6f6ac3de2b36d9e61e0d60b221f4d9510436fd3cb3d2d7362130.apk
Size 10.6MB
Sample260415-p7ectshv2t
SHA256 39901ffa746a6f6ac3de2b36d9e61e0d60b221f4d9510436fd3cb3d2d7362130
MD5 31514358bf684a1e466a9e8069c11031
SHA1 71e292745c4d86ef0d5c69b724d93379915dab15
SHA512 9631a9b14919d145122152899be32abea2e621af46a7b7986b7b2e7fa6ccac650ede729acf5ddbd3ed4b8f77edb88f0fabf81e14d9f55462e2ff59732a738020
SSDEEP 196608:0lS8A1d2Dzj8ORCWEEtit462b1ISD3YiFgNxqjX/aK+JBW/X2XBS3e2bo+2:0RA1wDzRuEosbewmNxQXC16/X2REe2b6
TLSH
T11BB623C6F7A89D2FC8B710B68D6A66B1125A4C12C7839F477944371C38776E80F99BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4768	gov.lens.net
/system_ext/framework/androidx.window.sidecar.jar	4768	gov.lens.net

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	gov.lens.net

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	gov.lens.net

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	gov.lens.net

gov.lens.net
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
PID:4768

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation1190841629749093380tmp

Path /data/data/gov.lens.net/files/PersistedInstallation1190841629749093380tmp
Size 90B
SHA256 a553a76bde68ab15de1925bfa59ddc379bfda0e7962513d231a9c7d238a3bf76
MD5 2b807d49ad8bf8ce7db8c9d16234d436
SHA1 35319727f52fa6e7e83042174bf60c9197dbcc36
SHA512 d4265aa66a79152b9016c2bdbeb04d71f711f609d567c0445e77895d3bdfd9b707dbdba1d642cf727db093c11cd4c9d54eb3a0ff622d8c2342efffabfeb9d842
TLSH
T1C3B01284873642418AC7F2022C4EB3046D401880480B8E484A0CE48040831F08103DB5
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation1686322469157527638tmp

Path /data/data/gov.lens.net/files/PersistedInstallation1686322469157527638tmp
Size 569B
SHA256 b291abbfc5cb95fe177d5133fae1ef69763b8ac93ef952c4ca06be75b7a3c211
MD5 1e76dd753e40c9c833ea4df5fc84bade
SHA1 cd558e0bfda811434e4f1e3f51ef6827febcab61
SHA512 69566917c0c804299c4d5c0ca3826fc5fcb1d30370ba1ce69ce9f587a324cc22118ced559aa603422766fe505c42a69db2bf0c230fdae32fbfd7bc491dd063e5
TLSH
T144F0E199F326430DDECEA4015C5C68600D0A0CEB724602AB269A8D341ED3A7D6147C4A
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/gov.lens.net/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 895fd5cc1f773184cea1c39ae1421fa2cb3b5d0b9b192c658bb346b34f69f7bf
MD5 70de104b4293058ff83c415756f3963c
SHA1 df4f9eede37501e4c0c116f27e1437b416d4e528
SHA512 0b29883ae0800a0cd90540cc37abb775d3106a38b6f4214149fa1b251e91f52c2f9eb972788ca3b2f7a9fe593df377bbd6635f92edbb9c4898e1d71860439e31
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/gov.lens.net/primary.prof
Size 4KB
SHA256 bf23ee715a0425d567f50f975f2fc05628f3bf867230a69c6f48094c0f2c6dcf
MD5 3925b471ec4cb0cae004f8395d9ba2f1
SHA1 b89b2365a97870499d0314a541f57b29b6d7b680
SHA512 0353f7576717a0247fc518cb843ef6ab6c1ab0cd401c0ad6b8cf734b0d1ae5cd8a3da464af5346eb9375dad48f15ff19145bab17634458b4bdd51ffbfffaa708
SSDEEP 48:lbUW7eBYPBG99Ub8iVSuIxgMs4c33O3M9gvGxSnXpQKM6nwnIeyKH6u+w5kxpGSZ:1tPBGy8iVx5+8TSXaROKb5kKlUN/pN
TLSH
T166812B190459491A8BF77492FFB2EA845934FDE43A5C334879F17A032AE4863AEF11C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/gov.lens.net/primary.prof
Size 12KB
SHA256 37ffb76cbbace304a3291a40e51f91c4b095839168585b65ce5c83070af31cec
MD5 63578de311ad9a6eaec0d583e296faca
SHA1 49e0359ad352e64c64da8331065e41fb662fc234
SHA512 33d0d84b659acd6e86603037e37c5b85ab7766aa230dffb6d3e26d9cfa145b503f7678c506194b700abfa5c346d8589ce20f8046418b10162163ed4faa0218d3
SSDEEP 384:KgIsKTFLpcRXAw0IZfETnt3A87CABf4eA6Qe1u:ZIbtzlIEjVA877gEu
TLSH
T1F742AE1D1C385422A121A749017E6CFF0CEEEF76DE6097A8C4F8D7DB883412999D86B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads