3189fedbe043869dcf2d91888147d541f53ba38a69ecc5701e614439607d5eee

Analysis

max time kernel
846s
max time network
902s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
26/06/2026, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
base.apk
Size 7.6MB
Sample260626-3czbeaf13p
SHA256 3189fedbe043869dcf2d91888147d541f53ba38a69ecc5701e614439607d5eee
MD5 eb1e389086a83192eb7889bf632e55d7
SHA1 ffaccf5594a1f379acdd613c5b92a5f96896ebfc
SHA512 e89cad11041c9b08e02b0bc03b9960208a0d5084daa825e74a1c5fc03afa581764732b4ac68b4f6aa4307c1071649f9833aff17112be1b460b1e26f5b2070966
SSDEEP 196608:AAstbU/uEMOMRY9b53d9l/fIG0ehQy4Z2k9:AACUVMHQ5ZfI9eQ2k9
TLSH
T1EE860187F798A52FC87750B249BE523211474C168A839B83AD58321C6DBB6D43F5EFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.example.testrat
/system/bin/su	com.example.testrat
/sbin/su	com.example.testrat

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.example.testrat

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.example.testrat

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.example.testrat

com.example.testrat
1⤵
- Checks if the Android device is rooted.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
PID:4692

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads