Overview

overview

7

Static

static

6

5G_4.0.1 mooz.apk

android-13-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    110s
  • max time network
    107s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
  • submitted
    16/04/2026, 00:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5G_4.0.1 mooz.apk
  • Size 9.0MB
  • Sample260416-afc85act5n
  • SHA256 8123369befaa134cd0d4f9a22cc746e4431827743c22b08bf4448a433a66cd0f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Requests enabling of the accessibility settings. 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    defense_evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • queue.guardianx.dispatcher
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Requests enabling of the accessibility settings.
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4206

Network

        MITRE ATT&CK Mobile v16

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1603

        Persistence

        Foreground Persistence

        1
        T1541

        Scheduled Task/Job

        1
        T1603

        Privilege Escalation

        Defense Evasion

        Download New Code at Runtime

        1
        T1407

        Foreground Persistence

        1
        T1541

        Hide Artifacts

        1
        T1628

        User Evasion

        1
        T1628.002

        Impair Defenses

        1
        T1629

        Prevent Application Removal

        1
        T1629.001

        Input Injection

        1
        T1516

        Virtualization/Sandbox Evasion

        2
        T1633

        System Checks

        2
        T1633.001

        Credential Access

        Clipboard Data

        1
        T1414

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Discovery

        Software Discovery

        1
        T1418

        Security Software Discovery

        1
        T1418.001

        System Information Discovery

        2
        T1426

        System Network Connections Discovery

        1
        T1421

        Lateral Movement

        Collection

        Clipboard Data

        1
        T1414

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Screen Capture

        1
        T1513

        Command and Control

        Exfiltration

        Impact

        Data Encrypted for Impact

        1
        T1471

        Data Manipulation

        1
        T1641

        Transmitted Data Manipulation

        1
        T1641.001

        Input Injection

        1
        T1516

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        classes.dex
        • Path /data/data/queue.guardianx.dispatcher/code_cache/classes.dex
        • Size 7.2MB
        • SHA256 9b0f7f6701da7a35dbfa5a29928023a900a2692b4d23c299f6a5a2db3cd0ff88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        geo_state.dat
        • Path /data/data/queue.guardianx.dispatcher/files/geo_state.dat
        • Size 1B
        • SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
        • MD5 SHA1 SHA512
        Submit Download

        profileInstalled
        • Path /data/data/queue.guardianx.dispatcher/files/profileInstalled
        • Size 24B
        • SHA256 8e49c3194c2dd4f16d7ca343c72f0e59a678ac72882528c89d9332f6e75480dc
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb
        • Path /data/data/queue.guardianx.dispatcher/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/queue.guardianx.dispatcher/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 eecd74e827574e48a4dee0db7164278069d3a2cf6efabf56ebd01c748cc73273
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/queue.guardianx.dispatcher/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/queue.guardianx.dispatcher/no_backup/androidx.work.workdb-wal
        • Size 205KB
        • SHA256 933409ad2233fa6473d30652aac4d306fd792d8f73dfccc1c037d4794cc23d99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/queue.guardianx.dispatcher/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 a4e17736784b81f4084ba551ca55cf9dbdb7bc3192632612af7af40355a44988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/queue.guardianx.dispatcher/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 bf19265fb9dddd908efd3017f95b6f4f0658882c35afa0e496fe1a0d1f68a0e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-04-16.txt
        • Path /storage/emulated/0/IC/KSTR/2026-04-16.txt
        • Size 44B
        • SHA256 f6bca73d39d01209319f68a155adef4110bfe0a41690f7ba065a8429a255a46c
        • MD5 SHA1 SHA512
        Submit Download

        2026-04-16.txt
        • Path /storage/emulated/0/IC/KSTR/2026-04-16.txt
        • Size 32B
        • SHA256 c02be7ff83149dd2dad418a4ba929b444416fd70a40b8dd3f52a094bef5f7464
        • MD5 SHA1 SHA512
        Submit Download

        2026-04-16.txt
        • Path /storage/emulated/0/IC/KSTR/2026-04-16.txt
        • Size 28B
        • SHA256 2226a3a0f6064db193db776e617f7ebbee617111fe8ce5cc569d56beb1e888dd
        • MD5 SHA1 SHA512
        Submit Download

        2026-04-16.txt
        • Path /storage/emulated/0/IC/KSTR/2026-04-16.txt
        • Size 89B
        • SHA256 107be9f25c30ac2e32263daa366ed71f942062fbba5e22bad795fc911872253f
        • MD5 SHA1 SHA512 TLSH
        Submit Download