b3cbc9858cf4e0b04ec98b176265fd4a17cdee65625a2595d449fa7c7a8eefd4

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
122s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
23/06/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a806ddbfc3340f17cf966c47ad0fb0ee.apk
Size 317.6MB
Sample260623-xd334afw3t
SHA256 b3cbc9858cf4e0b04ec98b176265fd4a17cdee65625a2595d449fa7c7a8eefd4
MD5 a806ddbfc3340f17cf966c47ad0fb0ee
SHA1 80b5bb998571c5d1af9c0dbaad7ead85961ef95f
SHA512 3ffcaa4ee1b6b97bbb9ff42018d8ba489886e4061024045a42f9210863cede8c7abe224ed4b406a39b58bf5856c055db82fb23a486045cbd10516bfc34b54afd
SSDEEP 6291456:fEQwy0DgJ0dVaJdH3u6bJxCipgW4mIPKEEkYoaQckXDrb:MQ70DXVa7H3vNxWXXPKEOoVckHb
TLSH
T171F8336AE319E61FD8B7197316A05235161B0C4683836F8B554D3F1CBAB36E40F2E7CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.vmos.virtual
/system/bin/su	com.vmos.virtual
/system/sd/xbin/su	com.vmos.virtual
/system/bin/failsafe/su	com.vmos.virtual
/sbin/su	com.vmos.virtual
/data/local/xbin/su	com.vmos.virtual
/data/local/bin/su	com.vmos.virtual
/data/local/su	com.vmos.virtual

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.vmos.virtual

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery defense_evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.vmos.virtual

Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.vmos.virtual:server
Framework service call	android.app.IActivityManager.setServiceForeground	com.vmos.virtual:vms01

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.vmos.virtual

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.vmos.virtual

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.vmos.virtual

com.vmos.virtual
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks memory information
PID:4839

com.vmos.virtual:server
1⤵
- Makes use of the framework's foreground persistence service
PID:4879

com.vmos.virtual:vms01
1⤵
- Makes use of the framework's foreground persistence service
PID:5026
- /system/bin/ndk_translation_program_runner_binfmt_misc_arm64 /data/app/~~vpFIowAQTSVdQrMvOuLH2w==/com.vmos.virtual--hgr9qcId6z9X4ufLjNK-w==/lib/arm64/lib7z.so /data/app/~~vpFIowAQTSVdQrMvOuLH2w==/com.vmos.virtual--hgr9qcId6z9X4ufLjNK-w==/lib/arm64/lib7z.so l /data/user/0/com.vmos.virtual/files/rootfs.7z
  2⤵
  PID:5062
- /system/bin/ndk_translation_program_runner_binfmt_misc_arm64 /data/app/~~vpFIowAQTSVdQrMvOuLH2w==/com.vmos.virtual--hgr9qcId6z9X4ufLjNK-w==/lib/arm64/lib7z.so /data/app/~~vpFIowAQTSVdQrMvOuLH2w==/com.vmos.virtual--hgr9qcId6z9X4ufLjNK-w==/lib/arm64/lib7z.so x /data/user/0/com.vmos.virtual/files/rootfs.7z -o/data/user/0/com.vmos.virtual/osimg/r/ot01 -r -aoa -bsp1
  2⤵
  PID:5084

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1004

Path /data/data/com.vmos.virtual/app_crashrecord/1004
Size 235B
SHA256 3a56f6543fd039ceb75c129bbba11bcd841edf9ce599cf5b802f2799c562f2d7
MD5 91dd00496feb6b99d01ba375e9d0cd54
SHA1 e83cf6f0082b9f3edf1b3be31304f383b4ea62ca
SHA512 82ac163d51f4320eb3c5f4ba2616eda0f1f0c855c63f65ea2b8efe83b8fa08e5c36905cd52fc4acccbf94fa9a43c08e3273f60b2c7bcdd477132705b329b7a64
TLSH
T18AD0A709A1E1591DCBE859FC6601FF5A18106CA145CDC4848BC142A1D1151969E6A89D
MD5 SHA1 SHA512 TLSH

Submit Download

1004

Path /data/data/com.vmos.virtual/app_crashrecord/1004
Size 242B
SHA256 f672c98c1f5a52f3e0cee67e1ef66e470ec9eeb9a1444b0ab3ed3acb85fc450e
MD5 bece9f1f4dc25485df99bea128f8dc37
SHA1 82c016cb9d5403cd6e85ec1861651415c50478c9
SHA512 681cebd03b40e5f97ba59044e8b4801a5b6482723bd969569ea9ecf8e6d8718f1efa9907e369d6465a55aaa75d8b0ae58f6448a2b2947a8d9b994ffa7b757cd3
TLSH
T114D09708B2A06D0ECFE858EC2000F75A24106CE045CEC444C7800032C0190E68D7A88C
MD5 SHA1 SHA512 TLSH

Submit Download

1004

Path /data/data/com.vmos.virtual/app_crashrecord/1004
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
TLSH
T109A00475D5417C71D351113C5415440C50505570C107D57CD7415470310D0D0477FD7C
MD5 SHA1 SHA512 TLSH

Submit Download

journal.tmp

Path /data/data/com.vmos.virtual/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

bugly_db_

Path /data/data/com.vmos.virtual/databases/bugly_db_
Size 60KB
SHA256 26ee6b7665dd2fb32bb6f8f6fe810760eeceeb4d5ff4c7b0b55978c833ac992a
MD5 ac7f6c80e753ea43920a531a5d202622
SHA1 26117aa56f894ef9edaada5751cf6444beaf25a1
SHA512 1aaf6aba51d9df46d4d653fe1ae2eacb187b9cff6ca0c08f7a2e9294a96a608fca504a25b81c4062bcd06ec01ff741078a83dd4ba26b8f7e012d011718254d35
SSDEEP 48:TCf5EpAuAriStwwuMN5meposSmdgZyFjm5E+hQoYeiBV2HjvKRE+vK:E5EpFAzwmuZyw5E+GoYe0eKR/K
TLSH
T1F953308A7BB81225E1F2853698E046629A79FCCBEDC4FF8A54D1301C0DA18406AF5D2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bugly_db_-journal

Path /data/data/com.vmos.virtual/databases/bugly_db_-journal
Size 8KB
SHA256 8238de76ddcfc8356d398893c6e35be4976bda8d6f27760d2170e74cc696aac2
MD5 a59473b122eceeb7fe6fe6e2994e22a0
SHA1 30c768535af8e31173ce63a2ec347fdd2c345492
SHA512 dad5144ed3b3fdff497b95f97dbd52eda096eba98a3b62f0e179c538c46a2d03bd374d80cc9a1111cc86a8a9f99681188c44acb8b9b7425e91ffbb07466e70f6
SSDEEP 48:7MCdgZyFjm5E+hQoYeiBV2HjvKRE+vK9qCf5EpAuAriStwwuMN5meposSh:7LuZyw5E+GoYe0eKR/K9t5EpFAzwh
TLSH
T17502328ABBF81326E1F3853658E146569979BCC7EDC4FEC954D2311C0D6184062F5E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bugly_db_-journal

Path /data/data/com.vmos.virtual/databases/bugly_db_-journal
Size 8KB
SHA256 147061d3e7bb0f6498d3891cf082d257972751cc7b2d153bc80ef628d4dd94e0
MD5 18c838f3c108599a199c1d64780b065d
SHA1 273be6330420832fbc3629b0f3184b8f46c5284c
SHA512 c5793ed2d1f748297c2e896f6e46c40cf8577fc246d616a789868dbbda3f930bf73ed434e2de7ffd82a11cf7847ba4601ecb20445fa9431030db26782bff4bf8
SSDEEP 24:7+t/ZHqL+gq5EpQhyQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSy:7M1qCf5EpAuAriStwwuMN5meposSy
TLSH
T14502AAC73E252A26C1E54077C8819DA54A78D74FA2D5FCCE6DF1002D9F45D40A2BACAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bugly_db_-journal

Path /data/data/com.vmos.virtual/databases/bugly_db_-journal
Size 8KB
SHA256 0f58809c13d2f826573a08629d23736ea63ddfba6319a8a32c9a3461ee1b5cc1
MD5 67dadd917fbd1149194a170fef29eb40
SHA1 6083f242a978e5e765406af1b08b3663849fcc5d
SHA512 6ab01eb24e02956e14b09df2728dec9290e104e8492cf64a81bad1cc45eb459e36bc4656e162be3bf65fd689cb8268b081ab95afbf396efffa4b080493c521e7
SSDEEP 6:7+/l9rPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK8R/4:7+tZqLJdeWRmBEyPbP4
TLSH
T10A02C08863C10853C02E177BA0C9C3405F1CE768F333CB87269128983C0F6CCE890D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bugly_db_-journal

Path /data/data/com.vmos.virtual/databases/bugly_db_-journal
Size 24KB
SHA256 23cfa0c10482dd78ac5396a888c836dc6c6c8b4074399711d9bd44846c37ddfe
MD5 c630f8c052d424eaf840a94cb9ea5afe
SHA1 5c78100d8f5aa8e5870ca09bc2817fb321c4d889
SHA512 07125ff14ea700134d03505263ff64a7941b80e56611181a6ae9e8ac5435d567d2e9426c802e1cf316a5ab812184c642e02435048f86568d1e0e6c54a17092cc
SSDEEP 24:7+tAsjutQgRqLCn3lB5xTZgDVHfgQjNB1ll3EofnGSy:7MXIqunT6oU07Sy
TLSH
T140B22395FB489F28C2B83579887515728EBAA21D4AA3844754EC2400AD51A41313C9B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bugly_db_-journal

Path /data/data/com.vmos.virtual/databases/bugly_db_-journal
Size 16KB
SHA256 5dab2e00f7d3be142943cf6a8a62f051abe7f7f87ad31c4b44cc527478620a9b
MD5 ac6592a832473ef0fe895ff80cebacea
SHA1 a29a23316e35eca83d3a043a0c2cf3dbc1664a7d
SHA512 ca8d41dc24432492873315163fea971fc4e60ff047f3599d79a24b358e61e06d12f090133f5373804a9b09559b075de8d156221ae8c5f8c8a61a85de05589043
SSDEEP 48:Tyf5EpAuAriStwwuMN5meposSP/KvugHjvKZdgZyFjm5E+hQoYeiBVCE+vKA:U5EpFAzwPGuaKZuZyw5E+GoYe0g/KA
TLSH
T19272318A7BF81326E1F3853658E146529979BC87EED4FEC954D2301C0D61840A6F5E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bugly_db_-journal

Path /data/data/com.vmos.virtual/databases/bugly_db_-journal
Size 8KB
SHA256 d67b77115ede1210f42ab5479b286263fd9d3eeccad7ef8f65f3d36e788d6bd0
MD5 0d5297fc53ce3ed0176ad8feeed5b48c
SHA1 30b09c1eed6b32fde2734fd5c51fc4a68b1a28c8
SHA512 7f5c8e0e18fdaea8d2092c0edcc9eedac7267c32095a2c96564630768f8915db3573d203f05269f77af0c7f20a79238916719d160eff67f6adf70623f77daf87
SSDEEP 48:7McE+vKhqXSf5EpAuAriStwwuMN5meposSM:7H/KhN5EpFAzwM
TLSH
T1C80224CB3F241611C1F14136D88149654A78EE4BA9D5FCCA69F1202D5F5284052F6CBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmos.db

Path /data/data/com.vmos.virtual/databases/vmos.db
Size 32KB
SHA256 03efa59d73ab81b7b5643719990f5845902f9311dbc97762682806327b5a1c0f
MD5 068a8a3d3abf13e3431299d245ef5970
SHA1 67e379d7273c01fc702a2ff5baa6441fda7c492c
SHA512 8dd8c42dcb5a28f266eb26242c1bb81f259f77440397b516b61a16b7393ba2f33c394efb102069f9ca24cf116abee347e312a4b4a7fa004aa039ed3c85cc013b
SSDEEP 96:RZoopuHMJRqB8V6SdKVASdAU/9JIIllbbX:XyHMJRqB8V6SdKVA8AU/7IIllbD
TLSH
T1F2E29B96B6B4F634E25937BE64257F9B0EB9493A218DC4CE36EC17105931183A52C8E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmos.db-journal

Path /data/data/com.vmos.virtual/databases/vmos.db-journal
Size 8KB
SHA256 a316d2e147f4164b7790981c0eb1959efba921d31ec10d4c7ee618309d10d3d7
MD5 4b68b469a2592f1a50460e061874a53d
SHA1 b367f4cf1ae7dffa71bc39ee42b99c2298d424f4
SHA512 a800ad02fb9a6777f795a14f3c33de5075a693ff1a08b2c17386310274db887b36762eb2f55d17d923eba44b98bc245e4b000b00dca0d02d075e967306309cdd
SSDEEP 24:7+tBZgqLzi3lB5xTZgDVHfgQjNB1ll3EofnGSB:7MBZgq3iT6oU07SB
TLSH
T17702239AB78CAB19C1BC3A7D847519738EF9951D5677448714E83800AE91502763C573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmos.db-journal

Path /data/data/com.vmos.virtual/databases/vmos.db-journal
Size 8KB
SHA256 a4fa425c177b5732ea7d7ede5e72bd7ac3b23750edd2356972718d0294c2728c
MD5 d48c5e40b16e337a1073ee73e0ad605f
SHA1 a52ddfa2acc508c8b6e38a4d942bb3cd64d75436
SHA512 703bcefc8172827e6c4ecd8044356fe8063fbd9df9c1f69aa09bf653387aaafb28cb99e05b71f41f419c7fd87ad447401ab50254b7dd5c9f51b2fb3cfc0e4a98
SSDEEP 24:7+thfAZrWqLw2w3lB5xTZgDVHfgQjNB1ll3EofnGSD:7M5AZiq02wT6oU07SD
TLSH
T16C022396F788EB19C2B83A7DC87919628FF9A51C5633448754E83804AD91102727C5B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bugly_last_us_up_tm

Path /data/data/com.vmos.virtual/files/bugly_last_us_up_tm
Size 8KB
SHA256 da4887b73b22a94d1f6366116ab31fc7b36db481e65f9d4948e1cfd611c23348
MD5 25f9930354a6eacc3a022bd579652f7b
SHA1 3ebc2ba3e58b7896c0f36e6b4ddeb6dcc92f6104
SHA512 2df3a77a5addf1b15d3de670943b32b146334a99811ea0abf4b1bd3b6c583474b97c8303020a124b1bc76946b401656b7222ea0d020d309a53f50a0fe9c6b42e
SSDEEP 6:7+/l96dn1y2pg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKeF:7+tIJpqLiuWdYRmBEyPbj
TLSH
T1CD0222AA6B800D22C9292677A0D583940D21A7288965CB9F1AA108942C878CCE4A2D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.preferences_pb.tmp

Path /data/data/com.vmos.virtual/files/datastore/settings.preferences_pb.tmp
Size 35B
SHA256 2055875973e159d55afb8c1da3a7cd5e247ea25e8725ccdd15db88b4c702109f
MD5 c1df48ef24e72ed54143070ed557fefc
SHA1 de34550c7906e79a1805d2279309e256e26d7919
SHA512 ade9ecead01cf6a42d7fb2eca89c42d75c92e6558f57698aa9e865f4fff5adb7e6c072aa4f99ea5da63729f5705ac6bba4e3f685bd2f379d54d7039aad9c2db5
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.vmos.virtual/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 9eab940bb2183ff77595ddf25916e180b2ead785f9f0df3833f7a519acace2b8
MD5 255523a340942af19b70e926775bea53
SHA1 56b8589ab102a7d1aceafdfccfe5963ed8dcb3c5
SHA512 fb21ca9fffddaf657a91e5e3a256ac25f403414c29626a098721f6a1e12951820d25a8505861f8886ea6816274b6dc4b700a59c810e39b1fa7f0b13b611661f3
MD5 SHA1 SHA512

Submit Download

rootfs.7z

Path /data/data/com.vmos.virtual/files/rootfs.7z
Size 297.5MB
SHA256 0b14756a38af4c37765917094abe96e7ed668b9d1497bb94a75dd27a1b679c24
MD5 ede7068bee5a1fdfced8607c88e68d41
SHA1 99475f174ab4db8ca9018bf784b1b4b540f1bc8b
SHA512 c755bf3ce1e93b91aadb1b63f6e4b55eb0d831217ccb9ed726b21381cb2c7d045f62a4e17eda871924f651d20e5bc676a24af33e986e41a5b137837a2c5024a0
SSDEEP 6291456:DwIIHqDC9nMhtlhccxnF4eXsuaQWTcUQSisMq+UFb3t:DDIHJnMXlhPNF6dzTcU8sF+U5t
TLSH
T180E8332DC11E3387E8C78E876390906E192911DC83A63F5B455BB9A85BB7A74073F327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.vmos.virtual/primary.prof
Size 2KB
SHA256 f9abda3ecfb1ef0b927c4c465f12cca345437a80846fc8df299c751520f46e11
MD5 2d3b04cf727bea1f36082298dc32284a
SHA1 9fc321a7a54c9cd72562c06edce3555896358fd8
SHA512 4cad858f0f3a54161cefdddd552023630b7bc71119981c05fe504856ebd22b961b67b8fee270fbf2bba79b1d05b2bbb728f033c94da40432f6b749a63039aeef
TLSH
T1EB513C676D701E70074F4B1A293062CB8527F692A14A8B0D54F94E7CE62F4948FAF8A9
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.vmos.virtual/primary.prof
Size 19KB
SHA256 064433dc76e0422f0933cc4e61c1f4556a5bbd26deb0b53adf0e411c67e957cc
MD5 796521af0ea439d5ecc03c4426e79afd
SHA1 71b7b851e51019bb08d25a7347e5f717db00efdf
SHA512 70cbab36f00e6c64e4bc94fd2c6fd6527b8b70a7b8f74261e20f247dc330f1653b6e0e0353d1ad389fc043aaafe6340d3c87f8360a4d79f52ba244b1bf70515a
SSDEEP 384:X9shgCJAoH1DqZuL4T3bkyVi2HSerIwSA3nV8//u+Jn:NCHZqAL4fHSerVSW6//uS
TLSH
T14492E1E8B65FF065C70556EC2636C824E7A24873F569CD042A951E478E1B3CFF3245B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads