d6592f915bf119974f4f99bc0adbd687d3329ba1ff13179f827596b0bfee6b76

Analysis

user interaction
yes
max time kernel
97s
max time network
75s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
04/06/2026, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d6592f915bf119974f4f99bc0adbd687d3329ba1ff13179f827596b0bfee6b76.apk
Size 141KB
Sample260604-w8mh6act2v
SHA256 d6592f915bf119974f4f99bc0adbd687d3329ba1ff13179f827596b0bfee6b76
MD5 af59407f9534c537f885a9bbdba2964b
SHA1 69ab6607bb2df40d0b714e7550b6cce241f2941b
SHA512 8cc4af6746e1acfa1c58a045da7a5c806cb8ec2379544c4be0688f2d25ec69edc5ff3fac7a2a782cc5c6e002e1a341888c797ffb282fbe1a2afeb66b14804da4
SSDEEP 3072:uJhzoW3ww4R0QE2fmpXFSbIpm0aE8ygvYgHlqE:ox3wheQELpoblpPlqE
TLSH
T1FCE31266DA5AF3DBE4FB5A7181B8200BC3BD65C09E109B9C0718B520C9F3BDA57C5A4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

banker defense_evasion discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	dj.czm.ygq
/system/xbin/su	dj.czm.ygq

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/dj.czm.ygq/app_en/dj.czm.ygq.jar	5092	dj.czm.ygq

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	dj.czm.ygq

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	dj.czm.ygq

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	dj.czm.ygq

dj.czm.ygq
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5092

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dj.czm.ygq.jar

Path /data/data/dj.czm.ygq/app_en/dj.czm.ygq.jar
Size 92KB
SHA256 3a78dff9682ffa965b4e5da4a2c850c8d58d0e4d298b40ae8d3231fc7a8cae17
MD5 b959db2183585a4b6c801b3626f753b5
SHA1 836b0739308c5e909501831d82b39a5c8b22dab0
SHA512 6d0f4b6022a971d7647c0eda13ccbefb08efff2f6b6f43d70ac0d4dcf1e9e301a11d1ad6df248cf7d01b5acf8949a66741a1cb0b5d130695983e98dc9cef2e2d
SSDEEP 1536:bVODrJUr4CPAnbxKXdhk5qLWa39KlP7TOVEBv3SUZ7Kyfumg3jQoREIy1bTdmmLg:5OHa8CPAnbxi7kQ1QlP7LwyfgjQoREI1
TLSH
T166931207FE3CDCF28DB67AC0A8708C4E6C3E9B58A758D5264573F6153C091719A86CBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dj.czm.ygq.jar.cur.prof

Path /data/data/dj.czm.ygq/app_en/oat/dj.czm.ygq.jar.cur.prof
Size 301B
SHA256 675d4fe25944e4ca93f54ef4c7bff0f24edc74284169660c4c724250d4d66109
MD5 85c9b185f2baa314a6138f9bb0041b6d
SHA1 ef0618efb2db142ff5b544e48de04ebfe64b023d
SHA512 2a96f939c2901f26d64ac307b48042f619c4410ade69f4df34bfcbb9bdf13f14068e1df4cae28686aae53dd44ada8764ec97450b9ca4d3bc8994636b4dd16c55
TLSH
T150E07D90AAE4191816E98913806E0187F973C40C10D402D9B11161C96D924C9C910C41
MD5 SHA1 SHA512 TLSH

Submit Download

c377.db

Path /data/data/dj.czm.ygq/databases/c377.db
Size 36KB
SHA256 8fe6f213bd3e03673718fd12734c2fe9b136031a58aff2aeb18c87367275aa05
MD5 402c87a356d186f8d97f2acc9acea1e1
SHA1 905be85df826426f3fe33df46ac37206b79c728b
SHA512 e9375ce6a85e9059bb9b6ddbaba4cb5d5e296404cd72d62432a1602167794c0d49ce85d34cf8a3ca8825a74c0a3f9d0d773466c591ad879e17ede19aa9da5bff
SSDEEP 24:TLaUYd2AhNADlg1mDeDlg9GSgGQQpHUtN4:TWUaZhNADlgoiDlgoSZUo
TLSH
T19AF2C30F4304B477CD65C2B5088993A25B74631BD894D6BAF6E42884BD927C424A3F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c377.db-journal

Path /data/data/dj.czm.ygq/databases/c377.db-journal
Size 512B
SHA256 2569608a43bf5ab27f90d94259dc666db3d3a751a11cfd0500e25ad402224f5e
MD5 bedde124b301d1c58edf702f2a048388
SHA1 357f9025eb656e2b8538c0502da2ccac335b9430
SHA512 d7a6e91c49b897299071aead4136896cbc9f8e7e564607e87577a665de8de9c70c2747e2e67430ea941861efe5b184081042f82cef9d743adb253f6087e760c1
MD5 SHA1 SHA512

Submit Download

c377.db-journal

Path /data/data/dj.czm.ygq/databases/c377.db-journal
Size 8KB
SHA256 1339be488ade5ed8c56874849df942515ec1636ab01e656d868f91d358f7532a
MD5 93db44fececad9bb86eba4d1a853bc23
SHA1 b9e39c9c479ae6b782698f01147d1102ab1fb9eb
SHA512 fba481d47af9870c6d5800732ef2d1f4315a34dbda5ff0c9ab1642813120eb6a7366789bbfe53d69dec14323989b0b30e0310875cd557faee99d799c4a3535ca
SSDEEP 6:7+/l9fjOn1pfg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKGn:7+t9mfqLiuWdwRmBEyPbd
TLSH
T1D40222CB63802A22C81D1AB7D0E683500E00E7198161CB8715600898BC934CCA4B4D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c377.db-journal

Path /data/data/dj.czm.ygq/databases/c377.db-journal
Size 8KB
SHA256 192df2d6ba31afa5f8b77edb6f91a2b7c49b677902871c669a7306e8628bbe88
MD5 b8d96f9b62d8ff2d98dbcf4df4d95ccf
SHA1 cbdda4201ea653d7ac9dfe52014c8f32c8ad6066
SHA512 5c57a3d03516b38a92c35e2e4fbef4fe0554e9739d1aef5c6fee375abbe21cd0ee8d400d5beaf6524640ff5f028fa3c94301c61d0b9e9b5ae4863710234459e7
SSDEEP 6:7+/l9SzPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK62/1:7+tYrqLJdTRmBEyPbLm1
TLSH
T15702128967410913C51A67B790E983553E99A719C263CF5B16A00CA87C466CCA890D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c377.db-journal

Path /data/data/dj.czm.ygq/databases/c377.db-journal
Size 8KB
SHA256 14da45b5badc1b780be0df58e196ca01848017f6bc3ad2a4b89bcf897272346a
MD5 e2df979e1f575000d1190cdf81e2a76e
SHA1 e9b3c6934c02d510d5111f7593f3ad8904754de7
SHA512 3e25f1ef17615a7064557a6f856a40e3366f65ff0cc3d2311b864f4b208469396ac7c009824676cb7584cf5c060e2577c31d68964c1814eb7cd2ee8d7db37172
SSDEEP 12:7+tBMmRqLl1cORJsRYwPePIhINVxqejXFjCoaMyofSCHU4zJ0nm56yMdYZJlMeCj:7+tBM+qLhYd2AhNADlg1mDeDlg9GSi
TLSH
T17B029E1F4614A477DAA2C3B5088E4296AB342317D894D5B9FAF42488FD937D420A3F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c377.db-journal

Path /data/data/dj.czm.ygq/databases/c377.db-journal
Size 8KB
SHA256 1a6411a3cf5c150bf4c8f5766b82fd6af80757aba70b598de12a18bb5a7cd30d
MD5 d3cedfce4e888841343724bc8bda22d9
SHA1 f4eb065ad9b139e5bdc702d6c4c5c2587422bf9b
SHA512 5aca8ad0c605028fcc0b3121bf2cc5a4a9af85aad17e1a0ef1aee37b6b328c9ab07b085b8067fa984fb0c309d48bdaf34308bb1639f171fdced7382fa4b5151a
SSDEEP 24:7+tBOTHvqLvZYd2AhNADlg1mDeDlg9GS5:7MBsvqDZaZhNADlgoiDlgoS5
TLSH
T1D002AB0F4604A4B3DAA2D2F9048A8257AA342317D85495B9FAE82488FD937C420A3F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c377.db-journal

Path /data/data/dj.czm.ygq/databases/c377.db-journal
Size 8KB
SHA256 e6657caee25403649faee8868c2c9c5dc3995ef20b1c4a3cca663006194cb541
MD5 525ba032926db801d3dcf4a81c01ebd4
SHA1 1114d66965641b6bb80eec20e715dd79281a3863
SHA512 631ba6785c73337ceed7c07ffcea2848f42a531bc74985462c0b8d85b5a0b441bbb5ce33291fd9c524f685ddab37ebcd839224311312cabf750adc45af693149
SSDEEP 24:7+tuF1wViqLhYd2AhNADlg1mDeDlg9GSB:7Mqrq1aZhNADlgoiDlgoSB
TLSH
T19202AF0F4604B4B3DAA2C2B904CE4266AF343317D454D9B9FAF42884BD937C42093F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dj.czm.ygq.jar

Path /data/user/0/dj.czm.ygq/app_en/dj.czm.ygq.jar
Size 203KB
SHA256 595e5fbb61c86a7c5a557fb63e00222b66f9c57a59e11c8cc34cf2a892ebb3af
MD5 3bf458fffb6e82c5d0abaf3bf88b9d2a
SHA1 e5a5030a6b5f3998c1375c5dea7a455c6c359e2f
SHA512 1ae551a0c2e86f2fca2b83aacc1033417b358bfdfcdc047ed69103c5cff2fea50140c037b1134e4b2e1056ad1c34531c6d369726315d3d0c9205bd93b7a9a162
SSDEEP 3072:BE5R/1eA43S+Bwjue1UJs2QBIRyFNoY4abu0AKXp5DOir:sRfKS+IXmyQYM0AWH
TLSH
T10C148D32B6F09C25CCBD473865F393403F71B883690687635C8567BA6E97387AC496E8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads