ddfb9773ffe54763b1bb6be6edf4f8df38902dbd016028da4bef703d46bc48f2

Analysis

max time kernel
47s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
02/06/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1wccjc_xyz.apk
Size 8.6MB
Sample260602-phx4mses6p
SHA256 ddfb9773ffe54763b1bb6be6edf4f8df38902dbd016028da4bef703d46bc48f2
MD5 e5fbba9e9b49a93af2e09b30377cccad
SHA1 5c31a132764ea09acb5aa7156a72d8a8cb3758e2
SHA512 8eaab5fadf0ce9867fa45d5c3e10b36b6b0fb9fc233bc98d1f3390f0176913e02099155302b87fe14e9113ba89fef1ca0d529467a3e911b228d25130cbb9565d
SSDEEP 196608:XlFuT/OTQrUKzmHKg1ePCdNJyI3MWj2oZ0nRJja:VIT20tLg1UwNMIcWioZ0ny
TLSH
T17C961256F7589A2FCC3390324DAA533651474CC68E829B477909770C39BBAD84F9ABCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/bin/failsafe/su	com.appwinonewin.partnerapp
/data/local/su	com.appwinonewin.partnerapp
/sbin/su	com.appwinonewin.partnerapp
/system/bin/su	com.appwinonewin.partnerapp
/system/xbin/su	com.appwinonewin.partnerapp
/data/local/xbin/su	com.appwinonewin.partnerapp
/data/local/bin/su	com.appwinonewin.partnerapp
/system/sd/xbin/su	com.appwinonewin.partnerapp

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.appwinonewin.partnerapp

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.appwinonewin.partnerapp

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.appwinonewin.partnerapp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.appwinonewin.partnerapp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.appwinonewin.partnerapp

com.appwinonewin.partnerapp
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4610

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/data/com.appwinonewin.partnerapp/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

OneSignal.db

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db
Size 52KB
SHA256 c776d1acf90c60f95a89ee4db8222acedc8e0b097d5606297aa641a3403821ee
MD5 e50e029ec0226f794da6d3fc0535d4f6
SHA1 027173bb3c775e8ee027c1e22930d9b1607195c3
SHA512 4f12a39bd359554fccacb8ac31e2276c38fa69a2de927f43216c9012bd3aeee0e1a0f47a48d114c6e45309e069cdd5a6979d90d21f2e60f0087f42b8364672ca
SSDEEP 24:TLLSaOCrUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvFqrEqjUi7+xGTrOPjwV+x:TLOCrQcrA0oJtqracrObMoOS
TLSH
T168337ACF4B862191EFD765B3155392E48E3B610E8C9317A62BF760245E83B16D72386C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db-journal
Size 8KB
SHA256 6a8ac98460a23f5742f48cbd2253b6df522215402d23b5e60411e94f30d5947e
MD5 1f0c7d959a88e765e74eae61794253b1
SHA1 3d396595760379be5639084faea6de810e501558
SHA512 572aca603f16794df7faf1c74195d4c98af5f45c4b0630caf52edca70696800bf3a40dac11fb82728f73de04b6a39c788750009fa06fde8ca7f033609660b045
SSDEEP 6:7+/l9xn1+fg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKX:7+t8fqLiuWdYRmBEyPbw
TLSH
T1F0022288A3800862CA2D167794E983440E10A7298961CB173ED108B82D074CCACA0D18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db-journal
Size 8KB
SHA256 5bf9492aee6a0b7f052904d48c0e6065b967c69b285df4b3cd8514d2dd784c73
MD5 1c33bb421b5e541c38fd955f3e1bc534
SHA1 7c5989388032722fbb8704c6071f9bff56f6fbd2
SHA512 66a51345a7d0ecc2f0faaaad56ed3a997b80e8e4f903e1cece79d0df27bca1e24436f5ac12b00e898dd1516066895f3f10489198897091efd5657b665e528b19
SSDEEP 6:7+/l9nPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKg/M:7+t5qLJdeWRmBEyPbPM
TLSH
T1AD02128977810913C92D5777A0DA93541E54AF299273CB5B169108546C46ADCA8A0D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.appwinonewin.partnerapp/databases/OneSignal.db-journal
Size 512B
SHA256 91c539b2c89afd282df94a522d4eeb0c6f1606fea10297e0d20babe381a734e8
MD5 fc62cf467f0b99f9b535345ed480b7b0
SHA1 ae9d90bbee974412e42220eb67a6bf2d63e2c2db
SHA512 30e73f3e59b5e29958cb1af1ad5841b42e3409004e626b8bd4940e60db0f8c2dfab0c6148761dc1b95f9d0d4e5398082bded687cf0d9c22c7d437fd5fd7d525c
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 460a732c00d0315ddff0d88516bf8c794863743b30159766d15afc436dbb8d4b
MD5 dd0fd44c569afe9e659c2c431ae20e8d
SHA1 19bd8a4fd51e940e69f7996d8d355f27eb7c00ff
SHA512 beb30264f4c95d646894f2efa1cb1ffc861b7fc6593f89815840e0165cb033950f3846a422fa8f4f1f728895a7eff127c11e818bfb8f3149bcbee29d7f62089e
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 8eb66ec436a228d6855b4916b828e241b3e1ccbbfb59be97673c82968897d0fc
MD5 763edcd1ee4303a122fb0687d2cb2f1f
SHA1 0f0780ba37bb353ed299d4e9b8f1fe11906028e1
SHA512 64981ea96d7a59f32edf497e28e40465cf8051de13187159fd0639f625df811ca62c961cce97cb90b670abdd5ae6041bb38478884e7637bd867dc1965fbc8be9
SSDEEP 6:K8SPFcS02zv9FZde/kPlOERX4PBX4ogLugMBX4suuK+/DXJaPNdqkWOw2:K8kBzdeWRmBEyPbP/mMkWOw2
TLSH
T11B72C276D7820952C91E5732A4C9C3801DA0531DB25BCB0BA79308337C03BC8AC50F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.appwinonewin.partnerapp/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 14ec68812bfad4a01ac472e101dce65a8b21a4edb8644e66c64e1e5a43eacdd5
MD5 ceb29b9c63dfbaf01bc062d58c1af48b
SHA1 d1612f329affb6824dfff32ad4e47edb4bd45c8d
SHA512 d7cb323753fffa16449ea4c9c14b6e6a23963749aa14a73ff946cde97a60415bf0eb1e159ae77a92af2f7867d7d153e255bbf5550790b27f4ac1070105c7f072
SSDEEP 96:46+hdjnHtDRMpf8UzS6+BD8q0ExP7lUdhUjc:cdjnHt9Mpf8UzS6+BD8q0E57c
TLSH
T168B3215E0F1A2540C89A54F0A5D00FB1793E422EE797E3E169920076AEC3E30DD29DFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.InstanceId.properties

Path /data/data/com.appwinonewin.partnerapp/no_backup/com.google.InstanceId.properties
Size 2KB
SHA256 d2e79a2fd431915831562964fbdefbc5e4449e6a5b37a539bb2475cefc7949ac
MD5 b994fef39b9b47673a71dc2d578beba8
SHA1 37c94ff29d935ceb4626257e8f6ab14a4783b83d
SHA512 57812b92b36bbb70336177f3a585fce5366ad34afd1382fbba3bc417c77dc9c53b7ebe4af750c85e14546409de65dc6d26a11d8748f22329d00e8ee8c1260ffb
TLSH
T14C414C2E0996CCA390693C388C5FAF38244E1510133AD47F85ED0C41F858CD5EBED725
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads