ddfb9773ffe54763b1bb6be6edf4f8df38902dbd016028da4bef703d46bc48f2

Analysis

max time kernel
47s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
02/06/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1wccjc_xyz.apk
Size 8.6MB
Sample260602-ph9sfaes9j
SHA256 ddfb9773ffe54763b1bb6be6edf4f8df38902dbd016028da4bef703d46bc48f2
MD5 e5fbba9e9b49a93af2e09b30377cccad
SHA1 5c31a132764ea09acb5aa7156a72d8a8cb3758e2
SHA512 8eaab5fadf0ce9867fa45d5c3e10b36b6b0fb9fc233bc98d1f3390f0176913e02099155302b87fe14e9113ba89fef1ca0d529467a3e911b228d25130cbb9565d
SSDEEP 196608:XlFuT/OTQrUKzmHKg1ePCdNJyI3MWj2oZ0nRJja:VIT20tLg1UwNMIcWioZ0ny
TLSH
T17C961256F7589A2FCC3390324DAA533651474CC68E829B477909770C39BBAD84F9ABCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.appwinonewin.partnerapp
/data/local/xbin/su	com.appwinonewin.partnerapp
/data/local/bin/su	com.appwinonewin.partnerapp
/system/sd/xbin/su	com.appwinonewin.partnerapp
/system/bin/failsafe/su	com.appwinonewin.partnerapp
/data/local/su	com.appwinonewin.partnerapp
/sbin/su	com.appwinonewin.partnerapp
/system/bin/su	com.appwinonewin.partnerapp

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.appwinonewin.partnerapp

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.appwinonewin.partnerapp

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.appwinonewin.partnerapp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.appwinonewin.partnerapp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.appwinonewin.partnerapp

com.appwinonewin.partnerapp
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4645

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/data/com.appwinonewin.partnerapp/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

OneSignal.db

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db
Size 52KB
SHA256 c776d1acf90c60f95a89ee4db8222acedc8e0b097d5606297aa641a3403821ee
MD5 e50e029ec0226f794da6d3fc0535d4f6
SHA1 027173bb3c775e8ee027c1e22930d9b1607195c3
SHA512 4f12a39bd359554fccacb8ac31e2276c38fa69a2de927f43216c9012bd3aeee0e1a0f47a48d114c6e45309e069cdd5a6979d90d21f2e60f0087f42b8364672ca
SSDEEP 24:TLLSaOCrUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvFqrEqjUi7+xGTrOPjwV+x:TLOCrQcrA0oJtqracrObMoOS
TLSH
T168337ACF4B862191EFD765B3155392E48E3B610E8C9317A62BF760245E83B16D72386C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db-journal
Size 8KB
SHA256 5722aeae1588893d76d936101f1d5bf889dca173dc89edbce327924ecddaada8
MD5 c0a220a920d077ab0dc8bd7f220f788e
SHA1 e07bdcacf97cb5b3640fdd875de9ba554f0078cf
SHA512 304ab72c3c21e7cc1abaf60fa28bdb24eed47be2b2bb29f554a866f352d0d4a52090abf1fee66a61871cd80d9d93367d3ea04b0e783bf3be9fe16de2759bb098
SSDEEP 6:7+/l93Bn1Sg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKcY:7+tp6qLiuWdYRmBEyPbU
TLSH
T15302C08D63800913C83D267798E783481D00E7398171CB1B17B00C983C07CCCECB0E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db-journal
Size 8KB
SHA256 4fe07f176e8a7db3a2efc6025a584452d066866c89b67d408fd2d1472ba85dab
MD5 b896ad694da25ae2e6bcabb76ca8aa35
SHA1 eb577206fe23598d421c82547c2323312798b94a
SHA512 ca69ffaa49c8856b371d3e7aa71996682c13e0453fe8f889c7b1fad3a4e40f4fe7579bb7281fd2f47cd2227516b4a7b84ecec29972d72a5d1b3ea8c1e5c3abe6
SSDEEP 6:7+/l9ru8HPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKhly//D+:7+tfvqLJdeWRmBEyPbUSD+
TLSH
T1A302228967400933C12A2BB7A0EA83491E90A728E263CB0716910C592C066CCA890D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db-journal
Size 512B
SHA256 7c6cb01aa256d6e121a72bc4c89b93e474da47afdbca150bed56a4479f736aa4
MD5 62715769bfebfc30b97d570bed08034a
SHA1 0b355700a6aa75a2aff832c8955140218a89b005
SHA512 29d5cccb042188fb938f113f35e90c31cbdefe3d19e77fd60bd79b5b6fe7d83784f6d593be551c3e3d6a2ba455423f3a0a461705575933d52e7c1b846dbfc06e
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 48d1dc0c4e22ee0f1f7df3f41c2785928b0ba51f0b75176cee441018b5672589
MD5 a8f9077e553d4475048300bf664574f4
SHA1 bafdd86acf5fda546921152aa1ab3badca20cf45
SHA512 a5c280d039c4fd62bed61c45267d20b77c5f002171fca9cda8ecf44b630a3dfa41f8d099833b952bd577e9ee76b1281db0575db839d8ade3d372b38ec12adaa7
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 40afbc581a022ce2c08be0c93c1be36121f8aa40e8ecda7ab95b241aabad6c9b
MD5 27121b1dd0c0e8ed393419e527672cb0
SHA1 b9c6b01ecd767ea925364b8dd5930a8251b7704d
SHA512 232f5dae50a2b5fce7e2780aab01327e4d46d9f38f8f845be2f1b6ab8fa50564cdc736930e3afe1e60aa2ffaba6870d9f85510e63042dd89aae688de42efc87d
SSDEEP 6:KS047PU9FZde/kPlOERX4PBX4ogLugMBX4suuK+/tzW9tgmfz6JiOw2:Kg7WzdeWRmBEyPbP/89ybJiOw2
TLSH
T15B72C258B3C18652EC55263390C4C3002E909B296353DFDB9ED21D1E6C0E7A85EA1E18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 9460f00853e5f7f1636f3bc773774a1d5f9c1b7847683c3ba5e6ed8ccaa06c10
MD5 4666f686477a0fdbb004d18e43f2b0f4
SHA1 892c68912525d2e72cd887eeda702ce5bb4fb005
SHA512 1e0f122bf5dd0ec1f3dde32324ef6c1a6500c6d3b99a8f73c4e32d6dbf3ae8599d72ce4a95e67bb5a24a7a55fd2e6cbf1cd86ff1906104670d2435fdf22c3541
SSDEEP 48:JFY66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI9D:36+hdjnHtDRMpf8UzS6+BD8q0ExPMoKR
TLSH
T1B1B31F4E2F596500CC99B4F095900FA17D3E412D8393E7F569D2047AAECE9309E29CBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.InstanceId.properties

Path /data/data/com.appwinonewin.partnerapp/no_backup/com.google.InstanceId.properties
Size 2KB
SHA256 74880b170197b56beda6bea6fe7b33cfba98066e8cfa70e0fe850cb7df3fa143
MD5 b6807dc448119a47e9562835affd40ce
SHA1 8742bbd594361f8f5ee730526df6a4c03ccdf34e
SHA512 426ca658fa3edd958cfd2bd5534f303a1d20b3242d644b0e80a77bf5f435ed0028520d520945dd9eb19593d2e029960e07bd3cf3f97c83036993e9ba96e3029f
TLSH
T1F2413A80641B08A80A5DEF981CC70B45351829745FB755E80398BA8DDD08962EB4E55D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads