52b11991a7f54f351fdc2d6bb80564840671c1d82f2b2d0c4df038f51708a62c

Resubmissions

11/05/2026, 13:29

260511-qrdl2aaz9v8

11/05/2026, 13:28

260511-qqxnhses9r8

11/05/2026, 11:06

260511-m7ex9af1918

Analysis

user interaction
yes
max time kernel
3s
max time network
54s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
11/05/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
سکس ایرانی.apk
Size 3.0MB
Sample260511-m7ex9af191
SHA256 52b11991a7f54f351fdc2d6bb80564840671c1d82f2b2d0c4df038f51708a62c
MD5 aea3978f165fe143d60e2eb5d7f663fe
SHA1 445a53c4246ed06a3aa58cf2eec17340dd223b46
SHA512 2707316c9930f406a8090fc5313b49fb390e6f1385a143e046c220031a4cb619fff61e315be47c04d009a553a6ba369b224567532899199e9d846528cd887925
SSDEEP 49152:xu7YWUcB/5d8wctdFUyBIcxmvPqO2HF4z29HKJyOTSgd5gMi9LBiNgfVVBD6+:2UcJ5dnKQy6wQPqOKA2vqSgd5gMKysp
TLSH
T174E5F252B3FA9A28F2F76F35E975519259B9FD829E35C11E0200B11C0DB7E809B50FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

banker defense_evasion discovery evasion execution persistence stealth trojan

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/data/local/xbin/su	com.opic.sla
/data/local/bin/su	com.opic.sla
/system/sd/xbin/su	com.opic.sla
/system/bin/failsafe/su	com.opic.sla
/data/local/su	com.opic.sla
/sbin/su	com.opic.sla
/system/bin/su	com.opic.sla
/system/xbin/su	com.opic.sla

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4960	com.opic.sla

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.opic.sla

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.opic.sla

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.opic.sla

com.opic.sla
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4960

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db

Path /data/user/0/com.opic.sla/databases/OneSignal.db
Size 20KB
SHA256 eb72b30ab2d0113e90ec8136d94e5b236c5f04f7164b69ae427b0c52d61f6f92
MD5 fd10aa90dbe453ea36e60b5a198abc4c
SHA1 321591172291841d4e9f9a7f7174849a5f37f0a9
SHA512 3cc9f2ac9269a1ed13d27be55dbeda332a36b59d98fa4d07eaecf3383354a6b7d563fae049d5f41f548a995493bd539a831e9207a0b81f4d35c8b621f4d944ae
SSDEEP 12:TLtjIuVQH2uIVBAee6x+xFwgiTrO/njWPtFzEpwcRmBEyPbAVOw:TLtj9Eyr2k+xGTrOPjwV+OGSE
TLSH
T10C9247CF9B811281EEC710B3142342D84A3B611E8DA397672BE710509D02B86C763C59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/user/0/com.opic.sla/databases/OneSignal.db-journal
Size 512B
SHA256 24a467c6f44bc89378c0b4fe00c00991c136826da2c0b062e90543443acf9b07
MD5 00efe05333283688b8f6bb803433d2c8
SHA1 b9afe7a3a62a8319c199f720718b779764d1285b
SHA512 09bf27af98eb82d7eaf31257da30c568fe1129ab87eb7d4e6608ec5b0be5ed7873aee148d14d53609205b2b988970bc73d0134efeee91b3b97fded502bdced78
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/user/0/com.opic.sla/databases/OneSignal.db-journal
Size 8KB
SHA256 994aeef92d397d407e82cea3ac258192c974686cb2b912618c86459ad0d96d43
MD5 3caae8fa2bbc7ac10beff3dfa6f0deed
SHA1 73382968f81ba12f057607aba0bc9e4b859e3313
SHA512 eeed40953f7b457c30a62ecce6a3f3556f24962fcff4fee28a6969f7eceb3d1396bf472c3d3e9bf9dc24a62364fb3fb71efc318dbc69bceef7bf5e468e0621e8
SSDEEP 6:7+/l9e4on1vvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKE:7+tYRvqLiuWdYRmBEyPbP
TLSH
T15C02228A63840912CA29167B98E483800F01EF388161CB27269008A82C074CCA8E0E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/user/0/com.opic.sla/databases/OneSignal.db-journal
Size 8KB
SHA256 f8b7704adae95a54375c946712525cc6d4d2ae62a4fc7e369a79cadea65a8c35
MD5 84750d132a288309cb498e8000d5288b
SHA1 45e5d186ebc1a7aaa6f8975fc5a63b26c31f97e7
SHA512 014f625faa626c0b289c9856b9b709710282c91a029b3745e20238a84eb0e362b9da8fd17e5bf19f7ca1a13f571efc420aba554fbba9111b4123ab8da0d275d8
SSDEEP 6:7+/l9aPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKX7/D:7+tUqLJdeWRmBEyPbID
TLSH
T19E02228867401A03C02E1B77A0C883941E10A7289323CB072E9108543C866CDA890D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__pushe_base_lib_db

Path /data/user/0/com.opic.sla/databases/__pushe_base_lib_db
Size 24KB
SHA256 55ba022e5aa9eb87c256026289112e4c0531a41d0d56380fcf845de71ff99ca0
MD5 2cdf77d5c14dd3f313b60c691579a0b9
SHA1 6a74a7a3170cabead82152871c90749afdd6f310
SHA512 eaf21f0acf8b98ac8bf4bce81e66a07d6a501483b141bfb7a2ef476a8dc9927ccd39971f4e0d1f7969576dbf7abb7befb3bec04e40c5a9b28fa7a2f15ae7a98c
SSDEEP 12:TLXKFormG4NK0COnHdOnHXy1TOnHyilc36/QN6/uJaEcZVMJwRPVz27VNgRINOR4:TLjxSe7TlcK///IoVM9cREGSzGQ
TLSH
T168B25CA36FD83520E8C9547749E6836049B8B14D1027A6FB2FA094799D4264AF06BFFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__pushe_base_lib_db-journal

Path /data/user/0/com.opic.sla/databases/__pushe_base_lib_db-journal
Size 512B
SHA256 3250377a7d9e344cfaf1f5e5a259198e0966414eb3ad884cd3fecc431503d39a
MD5 96344b6c82467217c0a31dd4ff4d1139
SHA1 5fd01b0baaacde51f2759cb946e78690cd84f2c6
SHA512 5518e9d3a51f106840135892c5d6091c45a86ab0a909028aa371e261f29a347dd7803ed15040ddac8c5eac420adde045f9a526d23f31fd062674de233d76a682
MD5 SHA1 SHA512

Submit Download

__pushe_base_lib_db-journal

Path /data/user/0/com.opic.sla/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 904f8e99f90fc471e7fbb10bf2e5553e81a1ac61a32a106f124dfdbc9263be20
MD5 597a013abbb499073d839dd89f7beabc
SHA1 5a0f5d7bf6bf0bf1ed2d0c2b286c13ee4805454c
SHA512 a1ad51c52829892c876e983560cf806dc267bb3bd912b5fa489ae6db62e36152e45a62e95c87adc9fc6e3d313163f43d5619c5baec763b2f16285ff3ad82cad5
SSDEEP 6:7+/l9SGn1apg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK7:7+t0qLiuWdYRmBEyPbE
TLSH
T17502C09CE3C01823C83D1B77D4D883400D09E73D9571CB1726D008943C078CCE8A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__pushe_base_lib_db-journal

Path /data/user/0/com.opic.sla/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 9a816a3df9e923f8ee9f65f8f29651569f91048535286f88a9ba550db7a0e460
MD5 ca109301e4629cef717e9a0f128ac85f
SHA1 7e937e3a9f47125ed8f19b34d45b4875bdf3a738
SHA512 056b4fcbfdd61777ac2cabc53146b473d01791701bf2d6042aa87cbe90765baad674f6c775dd7f829066ce2f4edffdb1a8b39c745df521b0e39ec2a1efec0650
SSDEEP 6:7+/l9kgPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKltM/gn:7+tK4qLJdeWRmBEyPb2tsgn
TLSH
T1B102128967421913C539977FA4D983941E15A7299263CB7B169108D86C466CCE890D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evernote_jobs.db

Path /data/user/0/com.opic.sla/databases/evernote_jobs.db
Size 16KB
SHA256 dc4f8a73f49d2a6b41ff425fd08b85c1eba5280c438a1a1ff9832e91dfa56cbb
MD5 47080e3bfcf2db9b8620f2faf6c5857a
SHA1 6f63c1851255e0fa99567f047382074b086d38bc
SHA512 e757043d82798926a5ddd716457accf6616894ad1ad79ec832293a1f662910b663239f899bf05a5c8d90fed5bcb093c5529e5bc842fe9003c1d5902f9ed84473
SSDEEP 12:TLpLPRulQ0KkYrZASBMAB1G0d/P6dMboAGy3vAz9rxvW3dOeRmBEyPbBvOw:TLFQVKRvTZc+UGSN
TLSH
T1277278869B802902EF8C0E325114C3C01A79D24F16D0C3EB11B8CDB05CC1D19A1BEF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evernote_jobs.db

Path /data/user/0/com.opic.sla/databases/evernote_jobs.db
Size 16KB
SHA256 d62b752d27d8aaacff0d4478907d210304ba8a010abf540f17e8389580c182f9
MD5 c028b23740faa9b1ad0d5927356f1bef
SHA1 201ee9bd412ba83484e82aadf732e190a14f54fa
SHA512 b84936ba18765c59ea9a2d7658c863e92dd7145a38d060918f719a317cf47279fec700b5600b6b85f94a7ff04afae9366def4af6673b09754d885890081f143b
SSDEEP 12:TL8LIRulQ0KkYrZASBMAB1G0d/P6dMboAGy3vAz9rxvW3dOeRmBEyPbP/QGEvE:TLw7VKRvTZc+UGSP/tEvE
TLSH
T1BD727646AB902912EFDC4E711245C3C01A39D28F66E0D2EB1179CEB49CC2C0961BEF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evernote_jobs.db

Path /data/user/0/com.opic.sla/databases/evernote_jobs.db
Size 16KB
SHA256 8f6a31d920604d568ec65311e8d07115af62cb4cd152aeee71b714c6211c2212
MD5 9b28db2eb113caa4d97d28500bdce933
SHA1 f8ba037c253b2df3a6ae1b554f38ab20ed219e66
SHA512 3a3a507192d5842555b6736c47b834c59fe8d4cf9a1983cd2155001c7cb0a03596437f78642151997399e974176e642a33f3cba8cfeccc7779c10961fc33d181
SSDEEP 12:TLWuL2CRulQ0KkYrZASBMAB1G0d/P6dMboAGy3vAz9rxvW3dOeRmBEyPbP/QG1vE:TLz2NVKRvTZc+UGSP/t1vE
TLSH
T1F3727646AB902912EFDC4E715554C3C02A39E28F66E0D2EB1179CEB49CC2C0961BEF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.opic.sla/databases/evernote_jobs.db-journal
Size 512B
SHA256 25c166efc9adcb1c0262bb9dd1123ada9e975c674dbb827054da803ebc98f0ef
MD5 8a01e8a762db7a4450adc0e89e019f4b
SHA1 4aafadb0c1b57835edf0984883f187016bd672a8
SHA512 eac26beafcf58fcb6977f755c6f1f3fee89b66dff74877c040986c5cbe344fe3ff5e0f43547214c779350d416814461e83ca720b31b953706326b8d9a501cdb1
MD5 SHA1 SHA512

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.opic.sla/databases/evernote_jobs.db-journal
Size 8KB
SHA256 a4191d5d55124bebeefb4a47a4b0aef03bc0f23a9dc2ec4544ce2b64c322ca36
MD5 2d04994325930ab8e73bd8d14d060b19
SHA1 3ce1468db5e714af0a5a253ac35d756bce4ef5da
SHA512 2353417aecb3902ef788238c2e9d23d7297142233ba8e4dae627eb8b432771c9c17704ee22e4a7168ebee924171a87f9b5f1ed07474672a38769e84cb13d135f
SSDEEP 6:7+/l9xh0Fn1ZDg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKGn:7+tp+DqLiuWdYRmBEyPbJn
TLSH
T1D902228863800812C82E277B94D483400E00EB3882E1CB1716A00C946C078CCB4A0E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.opic.sla/databases/evernote_jobs.db-journal
Size 8KB
SHA256 120b7058078f10b72fed06e39a39d47654fcd2708f7fb89d1ad251316c0b224d
MD5 7430ad3dee160d7a79677312487c04cb
SHA1 22d7bac9e8881329e732f47047237a3ec49d2241
SHA512 5004138dba5601c7d79b3c75db143a9b976200022779770931f13f57d1005b2daa1c4807534e6aefb16f884de9603c5465b9004d569574e10e984ff807d6e308
SSDEEP 6:7+/l9IuUHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK2/K//tn:7+t3UvqLJdeWRmBEyPbH/qtn
TLSH
T13B02C08863400803C02DB777A0CCC3601F21B72893B3CB0716D109553C07ECCE8A0D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.opic.sla/databases/evernote_jobs.db-journal
Size 8KB
SHA256 6e37516ea3e66266e4628a7b3d0816422bbbd0c9ec8bb93aa9bb343d2fa22332
MD5 fa4378bcd80021abb7b8aef42fcc9baa
SHA1 43c7d1f1237f5f48b998645ff1db785f4e881c71
SHA512 cdd767a6a90437ece7ca3d90a0e9296af4130a2ec7e3e85b71cdf2152b8d052ee0f29326de2cc719a0addf50945674b52290627ff99c5b66ecf6e49cb17f065c
SSDEEP 12:7+tpGBqLpLPRulQ0KkYrZASBMAB1G0d/P6dMboAGy3vAz9rxvW3dOeRmBEyPbv:7+tpGBqLFQVKRvTZc+UGSv
TLSH
T1E2027D469B802912EF8C4E725116C3C02A39D28F55D1C2E71178CDB55CC6C9961BEF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.opic.sla/databases/evernote_jobs.db-journal
Size 8KB
SHA256 8fa69401d2697c3cd5fbcaa0946e7e887901c2d37600a3c4c888887b4d038d5b
MD5 eb96ae782e45d1850b1369444f649a6e
SHA1 ce9d29daa61b370f8383af1d65fe0140e239878a
SHA512 c609c4b47a23463f4f5574c56e3b7c2fe6ffbe0d0bbdec48d691e61e7997bda0e3c69cb93001da5697dd5c13e4fac920d336115ab72e9e77c4b3d61a1740cfec
SSDEEP 12:7+tzt4GEvsqL8LIRulQ0KkYrZASBMAB1G0d/P6dMboAGy3vAz9rxvW3dOeRmBEyI:7+tztlEvsqLw7VKRvTZc+UGSk
TLSH
T15002974AAB812812EF8C4EB10165C3C02A39D68F66E0C2EB10798EB458C2C1861BEF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.opic.sla/databases/google_app_measurement_local.db
Size 16KB
SHA256 988125e8f65af66dea43cf7f8c0af728e23f53d8915f4ebef563a9e59d1ea396
MD5 99cbff6d0fe3d83689154dcb6f91d0ac
SHA1 e6dfd6f5e6d67c40ccf925cb0758c21f4179c805
SHA512 c10b2f3fde09cbe02bd1d99a3ced2534c0da84fbb1f6359d6ff22e05360596034f58fb28f52764c3e0523d5cb089e34d740321ebb4f57651299fb875747afa50
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/Wzl8:TLiEq9zmzrfRmBEyPbP/W
TLSH
T1C7722BCD9F102603C5B30B77B4CE93915C18A22D83379E472BE50470AD43449A0D2F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.opic.sla/databases/google_app_measurement_local.db
Size 16KB
SHA256 ea67a555e7b2f24d46a0aee23c48647f08e163797f87f7e4ece92d92a6f3dda0
MD5 2f4f91c04704ab8a02f5df6c47664294
SHA1 5cd8d147fce98c92a454dc946e8157cfe6046f3d
SHA512 94d5b8345db4994f46ebc3e32ef5ee4ef5c1886f220c6ac8d82a60c824c520f9305a0c9f7d443cfc08dc677db97f0da66f3fba04a70170d1c392cb3eaee571f8
SSDEEP 12:TLWuEmO9zmzrfRmBEyPbBvOwu8FAiOLauK/6AUvkWlIliE:TLROpmzr0GSNuOKary5tmX
TLSH
T1D0725CCCEB64D502E6730B3AA4CAD7D02D78722A4737EB533B8119286D022D59061F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download