ddfb9773ffe54763b1bb6be6edf4f8df38902dbd016028da4bef703d46bc48f2

Analysis

max time kernel
47s
max time network
151s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
02/06/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1wccjc_xyz.apk
Size 8.6MB
Sample260602-phx4mses6p
SHA256 ddfb9773ffe54763b1bb6be6edf4f8df38902dbd016028da4bef703d46bc48f2
MD5 e5fbba9e9b49a93af2e09b30377cccad
SHA1 5c31a132764ea09acb5aa7156a72d8a8cb3758e2
SHA512 8eaab5fadf0ce9867fa45d5c3e10b36b6b0fb9fc233bc98d1f3390f0176913e02099155302b87fe14e9113ba89fef1ca0d529467a3e911b228d25130cbb9565d
SSDEEP 196608:XlFuT/OTQrUKzmHKg1ePCdNJyI3MWj2oZ0nRJja:VIT20tLg1UwNMIcWioZ0ny
TLSH
T17C961256F7589A2FCC3390324DAA533651474CC68E829B477909770C39BBAD84F9ABCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/data/local/su	com.appwinonewin.partnerapp
/sbin/su	com.appwinonewin.partnerapp
/system/bin/su	com.appwinonewin.partnerapp
/system/xbin/su	com.appwinonewin.partnerapp
/data/local/xbin/su	com.appwinonewin.partnerapp
/data/local/bin/su	com.appwinonewin.partnerapp
/system/sd/xbin/su	com.appwinonewin.partnerapp
/system/bin/failsafe/su	com.appwinonewin.partnerapp

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.appwinonewin.partnerapp

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.appwinonewin.partnerapp

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.appwinonewin.partnerapp

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.appwinonewin.partnerapp

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.appwinonewin.partnerapp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.appwinonewin.partnerapp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.appwinonewin.partnerapp

com.appwinonewin.partnerapp
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5009

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/data/com.appwinonewin.partnerapp/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

OneSignal.db

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db
Size 52KB
SHA256 f8ebc23104952761ccaf8dcf7ea9e5341bb0f3da744550a518f8dbc8b3404904
MD5 5715efdd2d828d4d57c1376120ba2806
SHA1 06f279c976087695aaaf885df323d996a2560cc1
SHA512 dbc9dcea4f947dc61663054585dcc175b79ce7d69aaa8335754d1fe6d02881dadd75d3846190178e677e80efd63a1e364a31d51620d51e8e6254b8864651bb30
SSDEEP 24:TLLSrCrUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvFqrEqjUi7+xGTrOPjwV+HR:T6CrQcrA0oJtqracrObMoOS
TLSH
T1D8337ACF4B862191EFC765B3155392E48E37610E8C9317A62BF760245E83B16D72386C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db-journal
Size 8KB
SHA256 7df77cc4ea14b81440133bd26e83dd120995122ad08320ada4314b034a12348c
MD5 c892878a9e545b7c05cf647fb9d916b4
SHA1 3b82cf570c302edfc3d20ac6d39e70eea19e7fd3
SHA512 d6508f5dd039c55a0121abfc984bc0dbd872a51debd473e5d817340b31a77977781bcb14e98df8bc42bbdba55e71c01c13f39311180fefeaa6cc58e2feba850a
SSDEEP 6:7+/l9hllSFn1xng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKW:7+t/8qLiuWdwRmBEyPb9
TLSH
T103022289A7811822C82E16B790D683640D00E72A8161CB0B15B008983C038CCA4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db-journal
Size 8KB
SHA256 93107f9a3581243c3a7de05b01c8fbff325e7d9918a9c3f70eb89ba593b8c7a5
MD5 33134ccc4f265bcb17250a1a784d7ddf
SHA1 8db3668cc4b766416a29a7b897922e122a09cdb0
SHA512 aacd70772d0fe51fbf14d3f28dbc444ad42a55ef736d28224e0421359bfe50a737c89db3dbf5aa60deff16ec5ed002508f7f6071298adda3bb17e5950659f467
SSDEEP 6:7+/l9ldHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK8///s:7+tJvqLJdTRmBEyPbzs
TLSH
T133022289A3400C13C51E17BB90CA83A42E10E716C233CB4B656208987C02BCCA890D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db-journal
Size 512B
SHA256 bc581c7ced49e739d699416e68cbdda011116449e5a4a9e194e13802b0b9415f
MD5 ab2382880ed85ec152da45fb7cbfedd8
SHA1 b00775abddde245b19f4f9781432e5919fce4c3d
SHA512 441240ec14a0507d2073471688344cdda4b0fa3d3d381efa5b973c737f0a966e300707be166aefc93863c92b7020a8d75e0c120641558f19eebb27173c0aade2
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 40e6e96636fb8e4643684b16d586695f16d8f71a3c96fce3827fc76025dca555
MD5 5aad118a256f3da59564932496451c4d
SHA1 3766f8e9e871a89fb62d6aba740ac861007c91da
SHA512 5d164dc38f432410c7afb9d202c9059b5824f348cfa74813f949a071ba0e646f1b516fb15a9279bbf12a0c144624c26eaec8f9f2cab64a36f9e925b918d93af3
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 99970ab69355cb671dd7db55611a85e34cb0f3ba0af099a2a210b43d1ed9e18e
MD5 1e37e2ebf55a365aac6cb7c83d92898d
SHA1 02d83294be9edd26fa31cd43b2779b4a8e1daa8b
SHA512 27b372d685ee5b429594c48868e120be34e8fb1d0806f9400ddec83e7e82d9b2faebfa5635fbf8664df0fbb81d3cae866f469415d50e0e39612637a8733a6ec6
SSDEEP 6:KY1F0y9FZdrlOERX4PBX4ogLugMBX4suuK+/gcGx1yFjlIvyFjOqGDTOw2:KYw8zdTRmBEyPbP/po1k2DTOw2
TLSH
T1C572C28073C00B16D1091B3EB0D9D3452D50A63BC312CBCB625824A8EC8278C5EA2E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 a709a5ccdbd21fd792791afab483355efd260ade38ceac510b9fbb88ee35f67c
MD5 bcf828df68e4de9509fbb43e7f8f6f39
SHA1 5a8c912e7e5dead56f83e2b282f73213ee5595f7
SHA512 e4be9c790fa0d1ee3bfa60344dd885d65c613b58851217c3e6e5cf7166ed8f34bc53b7d6230005168486cb3fa85b7c5f49e4e307b42031e712885af09987d458
SSDEEP 96:+6+hdjnHtDRMpf8UzS6+BD8q0ExPDztdw:+djnHt9Mpf8UzS6+BD8q0E5PTw
TLSH
T10AB3F08E1F592640C49998F4B5A00FA1793E413FC793E3E169914079EEC6924DF2ACFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.InstanceId.properties

Path /data/data/com.appwinonewin.partnerapp/no_backup/com.google.InstanceId.properties
Size 2KB
SHA256 66d16323036ff923f00ffda4a126f487828fcd227a99518e75962144e0f65af5
MD5 d27f1496a28ce616aa66dc0998e49b8b
SHA1 15f12f715ed859f11202acc1f205a6be189618fb
SHA512 b626d1a271e28528b8a03ead65f727a4939486df14ba9be1ba854cb730d59f58a646fd2dc7191b64d1cae947ad43bed2e19181bcff5ae481a4646d2cc634cab1
TLSH
T1DD41188C96A308E8F4C6FAD9DCC920EBC8FEB5744B2094687D06967F8604427B536D8D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads