ddfb9773ffe54763b1bb6be6edf4f8df38902dbd016028da4bef703d46bc48f2

Analysis

max time kernel
47s
max time network
151s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
02/06/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1wccjc_xyz.apk
Size 8.6MB
Sample260602-ph9sfaes9j
SHA256 ddfb9773ffe54763b1bb6be6edf4f8df38902dbd016028da4bef703d46bc48f2
MD5 e5fbba9e9b49a93af2e09b30377cccad
SHA1 5c31a132764ea09acb5aa7156a72d8a8cb3758e2
SHA512 8eaab5fadf0ce9867fa45d5c3e10b36b6b0fb9fc233bc98d1f3390f0176913e02099155302b87fe14e9113ba89fef1ca0d529467a3e911b228d25130cbb9565d
SSDEEP 196608:XlFuT/OTQrUKzmHKg1ePCdNJyI3MWj2oZ0nRJja:VIT20tLg1UwNMIcWioZ0ny
TLSH
T17C961256F7589A2FCC3390324DAA533651474CC68E829B477909770C39BBAD84F9ABCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/data/local/su	com.appwinonewin.partnerapp
/sbin/su	com.appwinonewin.partnerapp
/system/bin/su	com.appwinonewin.partnerapp
/system/xbin/su	com.appwinonewin.partnerapp
/data/local/xbin/su	com.appwinonewin.partnerapp
/data/local/bin/su	com.appwinonewin.partnerapp
/system/sd/xbin/su	com.appwinonewin.partnerapp
/system/bin/failsafe/su	com.appwinonewin.partnerapp

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.appwinonewin.partnerapp

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.appwinonewin.partnerapp

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.appwinonewin.partnerapp

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.appwinonewin.partnerapp

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.appwinonewin.partnerapp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.appwinonewin.partnerapp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.appwinonewin.partnerapp

com.appwinonewin.partnerapp
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5098

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/data/com.appwinonewin.partnerapp/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

OneSignal.db

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db
Size 52KB
SHA256 f8ebc23104952761ccaf8dcf7ea9e5341bb0f3da744550a518f8dbc8b3404904
MD5 5715efdd2d828d4d57c1376120ba2806
SHA1 06f279c976087695aaaf885df323d996a2560cc1
SHA512 dbc9dcea4f947dc61663054585dcc175b79ce7d69aaa8335754d1fe6d02881dadd75d3846190178e677e80efd63a1e364a31d51620d51e8e6254b8864651bb30
SSDEEP 24:TLLSrCrUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvFqrEqjUi7+xGTrOPjwV+HR:T6CrQcrA0oJtqracrObMoOS
TLSH
T1D8337ACF4B862191EFC765B3155392E48E37610E8C9317A62BF760245E83B16D72386C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db-journal
Size 8KB
SHA256 1e6ce73884d6246cf62c1553bafbc8733c00da71d11dd3c5c9b7f1925a5f9ac5
MD5 56f2407fa23671e4f8d984570ddaf28c
SHA1 6774726fc0386157283d798c37f74428568e43ff
SHA512 f939d377bda693c312feb64958ed752bb3c43ad68097b72cf71fe581ba883aaba392727873cfc0793fd3085266df3626a0cab3dcd947f7987c66431eda36e746
SSDEEP 6:7+/l9Lion1Sg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKv:7+tpifqLiuWdwRmBEyPbk
TLSH
T1F102228D63830B22C829AAF790DA83A00E10E7198166CB1B2A6008DC3C0B4CCA8F0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db-journal
Size 8KB
SHA256 482b10d1ab2106042697c7b6b491b26d6fb2dd8243770b9641dc3e1502316a44
MD5 1bc0ec65bd0097762561b029361068b2
SHA1 1c8d38130c32a1c5865b2c9ae16f87efe9cb7391
SHA512 9e2dc0f028cc5dfd61b832d90f00a9ff1aff42a843eb003cbd60b75c8fcb9c2bb0476cad78899baa4603ca7fe74c8b8b8bb6e3c938fc5b6d1274dd61f26f1c0b
SSDEEP 6:7+/l9XPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKg//c:7+tFqLJdTRmBEyPbjc
TLSH
T12A02228967800813C01A17B790CD83402E10A7298263CB0715A008983C0A6CCB890F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db-journal
Size 512B
SHA256 57a67c03d75c80438e92bc98e6c1c5f0267c090b04cf454a417a636edc736e78
MD5 1312c1edd6f4c56411e00a52fcb22ee6
SHA1 dc8ebe15cf6e9e60fd729594983f63c82c256f24
SHA512 ef0d82367d587194682ab0fb039ac5d66a2360988f9dc9e9e1cea416b7ac5df5fd95c13fa6a2a96f80df620927fe44d3bcabbf6e4c1022535f281456d2a76f31
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 52176eb278633fb0040e6778572376e25f53aaf560e47af1ef0f5b06739a8277
MD5 223097114bd92cf2b164b9ad35472efc
SHA1 bb52b5c15cebe7090f67bb5d4d95eadc3349b57a
SHA512 da3a55d67b7d618d837c10e01d83537ad4aa3028881e2c87f06a5ff55ff9707b5a6ae35352424e7e25b7cfa2dd4c70be890d107ace8b591cfce96604574cfd16
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 a05b5293fe5465a6ae52d37052d5dabdd0b90cbee018e7801874d8a55155b7f2
MD5 bfbf68438b3273a1ad62d06adf54a56a
SHA1 3f36ca0e717d437f89d2f602e522dfdac3920724
SHA512 0226022567a9c51d7d82ce0e7a611660e517b675da4b1c3afbe795fba2c44fab89342fc92370807748015d3bdb663e666ce886893e0340dc5c14c9a0754df61e
SSDEEP 6:KI9VLfeo9FZdrlOERX4PBX4ogLugMBX4suuK+/OBLViOw2:KI9VLfbzdTRmBEyPbP/wiOw2
TLSH
T1E972C2B5B3411962F12B43BAE0D9C3431E6256295762CB0B2DE028147C62B9CB090D0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 ed4bd401f9d161d9b96f8435514b592e7dbf642d083ebcf817a6ae25b74d317e
MD5 ead496f782eafb4a510cfd682e1b1b6a
SHA1 81bcb6cc136638b7c2e2d8fbf35407fd9b1152df
SHA512 0982d7862a7f95ce78caf04d9b33b1d3eeda286e16ab770348ab62ceec96d0d7b3eb4ba99277490aede35ecf988e9110b0a755ee81bfe14a1677b257294f1231
SSDEEP 48:TK9Y66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI4:c6+hdjnHtDRMpf8UzS6+BD8q0ExPGKn
TLSH
T138B3305E1F092540C4AA64F4E1900FA2793F412E8793E3E66DD11076AEDAD20DE29CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.InstanceId.properties

Path /data/data/com.appwinonewin.partnerapp/no_backup/com.google.InstanceId.properties
Size 2KB
SHA256 1cebbef455bcd9282b04a5ce08376cde2b9fe9051b2bd21c27213c4be45cab89
MD5 793f75cb632ed9f7efacfc9a046bd64e
SHA1 ddf8fb343426c2426f5ccfa5597d2fe9d0b41453
SHA512 34c2ac08f91846cb6e246fce2766087c752111d3a6c553ad3c03bb3968f390c1e04dcef45351cba97b2878279b8e6cea12c929b35c7d47320cf1004c7ad1faf3
TLSH
T1BC41E99AAD739AF3E25ED40AD74B8A48F4E56E38534204FEB3A7700462B610966183D1
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads