mirax | a3ade4b9e03e459a5955d68c52f8dbf893ce0c2bfb56c1c8b7415ecfb7ec9246

Analysis

max time kernel
149s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
02/07/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
temp_1781774687144.apk
Size 10.1MB
Sample260702-2k6vsafy9w
SHA256 a3ade4b9e03e459a5955d68c52f8dbf893ce0c2bfb56c1c8b7415ecfb7ec9246
MD5 2be0da0c4135514667aa947eec3a04d8
SHA1 fc48f53b4ada8c3d31cc647562d7a54e28ea626e
SHA512 7a0cc89015357d0d5784e42bec9b0a0797fc85b9e96d8af54a50c115761bead560ceea865329beb2789fd5251ddda1fea6f24f9465157b2bcf911738799bad48
SSDEEP 196608:n3SIGw4+np11yqnmxzbrV1IGOpU+Htk5TLLJbZWO:nj7/11mxZ1I2J7WO
TLSH
T194B61206FB49E96BC0F767764D764122424B4C268B53D3936F58723C18BBAE04F4AED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery evasion execution mirax impact infostealer persistence rat stealth trojan

Malware Config

Signatures

Family: Mirax
Mirax is an Android Android RAT first seen in 2026.
rat trojan infostealer mirax

Android Mirax payload 1 IoCs

resource	yara_rule
behavioral2/memory/5016-1.dex	family_mirax

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5016	org.gudavim.plusyoy2c
5016	org.gudavim.plusyoy2c

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/org.gudavim.plusyoy2c/app_zone/MDx.ico	5016	org.gudavim.plusyoy2c
/data/user/0/org.gudavim.plusyoy2c/app_zone/MDx.ico!classes2.dex	5016	org.gudavim.plusyoy2c

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	org.gudavim.plusyoy2c
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	org.gudavim.plusyoy2c
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	org.gudavim.plusyoy2c

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	org.gudavim.plusyoy2c

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	org.gudavim.plusyoy2c

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	org.gudavim.plusyoy2c

Reads the content of outgoing SMS messages. 1 TTPs 2 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/sent	org.gudavim.plusyoy2c
URI accessed for read	content://sms/draft	org.gudavim.plusyoy2c

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	org.gudavim.plusyoy2c

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	org.gudavim.plusyoy2c

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	org.gudavim.plusyoy2c

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	org.gudavim.plusyoy2c
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	org.gudavim.plusyoy2c
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	org.gudavim.plusyoy2c

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	org.gudavim.plusyoy2c

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	org.gudavim.plusyoy2c

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	org.gudavim.plusyoy2c

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	org.gudavim.plusyoy2c

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	org.gudavim.plusyoy2c

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	org.gudavim.plusyoy2c

org.gudavim.plusyoy2c
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Reads the content of SMS inbox messages.
- Reads the content of outgoing SMS messages.
- Reads the content of the SMS messages.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5016

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Protected User Data

T1636

SMS Messages

T1636.004

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

MDx.ico

Path /data/data/org.gudavim.plusyoy2c/app_zone/MDx.ico
Size 5.1MB
SHA256 88858d3be69b47d754a71c2f81591b06ad2504ac38b8580c551f5c1a58bf7b6b
MD5 dd11724e5271095d78ce76801789029f
SHA1 32f48b0b986022fa8ca6b7d4ed854d911ccb9cc0
SHA512 2e50a0a6f963c82c875e217db35a66668f55ed9f0bf5a1e8281172f46de891423f98c935fa8fe1dda1348b96e690e1a309f89b231f25962c19481dfb1ef3fd77
SSDEEP 98304:uyW5/e2wFdg11kdu0ZrectInAsyPVX0UWZvYSRzLZDlSmwdfPPbnwFiqDqEXE2n:uF5qy1kFrFJ1PmUWZgs/ZSdfPDre
TLSH
T1C036334ECCE5C986F36D964FD0968870CF827A839D276B229C68CD4D18CE12FB44B579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MDx.ico

Path /data/data/org.gudavim.plusyoy2c/app_zone/MDx.ico
Size 5.1MB
SHA256 b84ce4e118e74139910a2ad2e0832fee720f9d596d622e43f062d5141ad2004f
MD5 6b8f40f643b2340aeb5cd5e66164fa24
SHA1 f424b9d9b9f5e403a7da9cd45742875914f5c042
SHA512 c322359738014dce39a89185e98ea523a3013aae234d5984f65a0638b62fc662413e9e6434f524382fccfce1d0a5ab4e6c52d52a6c166c5dee2671bb71c29845
SSDEEP 98304:6ytnarmmDO30GUr/4Vm0/jxFg7n39rC26z9DnPPZN3pIxRtREI+eh:6AaLDL4Vm0/jxExC26zFnXTpIrII1
TLSH
T1E23633FE72B74C4FADFDC92A0B10A85526F418C9D4E394744E4548AD0D2A97FEB36A0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8baaa2e1c88f7c4d5b5bb7b6ea22b8e.0.tmp

Path /data/data/org.gudavim.plusyoy2c/cache/doh_cache/e8baaa2e1c88f7c4d5b5bb7b6ea22b8e.0.tmp
Size 4KB
SHA256 3022b3f8737e53ccaed45466dad5df839126dbd5c08035521c8903362b7316dc
MD5 994d728f44429027f2b1c0e7557bf430
SHA1 c89b1ef7cef9b197ed27a7032212cbbd89151679
SHA512 7fde4ca91cfa75aaa6ab4a848be787a745d2107f5a53607848ba848e94a241e9bcbc8ed01497886d85bbcaf4bc51440d3f1b66eb10f2468f0b4ec8ec6dc3bcdd
SSDEEP 48:GfAN5gqCxPpF2+zPB0+OqFDEHNO30tPZqWQPrZ+g55i07g3vNyE/VFBdEp:dnghxh8AJQkz0txYPrziCyndFw
TLSH
T1FE912ABAAF50244924E3E434C65D2BA65C4C3A97CB8594BF39883D22C4CD332E972888
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8baaa2e1c88f7c4d5b5bb7b6ea22b8e.1.tmp

Path /data/data/org.gudavim.plusyoy2c/cache/doh_cache/e8baaa2e1c88f7c4d5b5bb7b6ea22b8e.1.tmp
Size 192B
SHA256 e41deac5cf1ee61e52145a038d9cd6c4af2758cc6dc0954449a0ab359c0d384a
MD5 1f648e7ca966319f51cf2a2c235d1583
SHA1 dd84c82d885e9cd7ce733e2f50b5109514583851
SHA512 ae45a53f65df86365269a462b647c32fd27f1ad9a3fb0b63ed50f4556e0e8eca4097f9b38513ae285f7da3dd83c5ebf6a950bcaf3ed39161ea66cf244ce8efa9
TLSH
T199C0125D668006F8D5131410C1C314C79B7537B2B29E6CF4D2042F60D2AB366605150F
MD5 SHA1 SHA512 TLSH

Submit Download

journal

Path /data/data/org.gudavim.plusyoy2c/cache/doh_cache/journal
Size 123B
SHA256 81ebac6e4f94cb2626e7dd297300f3ae048ba72e9165567ab8ba0d3550db0bf2
MD5 1a43d65be38a0f697c6efd8b0b51039f
SHA1 54ad0d10bcb490dc42fe160aeb2083c99e8edcdb
SHA512 d41295fe09b49fe1e750d0c3fb0f7e3918e639f4fb2446ae4ec01ba13ac17e8fa73855b94141015a28ddedcf8927027d6e4b632134565211ffed50ba370456c5
TLSH
T154B002C09FC05551D43531F03140745B7415A1171C499BC3C6C850AFD75514298313FD
MD5 SHA1 SHA512 TLSH

Submit Download

journal.tmp

Path /data/data/org.gudavim.plusyoy2c/cache/doh_cache/journal.tmp
Size 36B
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
MD5 SHA1 SHA512

Submit Download

profileInstalled

Path /data/data/org.gudavim.plusyoy2c/files/profileInstalled
Size 24B
SHA256 0c10894c91196529121b34bb79bf6e9e44551bb40201ae3213c6b41e3febcfed
MD5 50532301b2ecf95ce680525e5bfb9073
SHA1 0490f5043c4582cd44cc02e4dbaec9442d4c18a4
SHA512 e112fdf07f20481b2a3aca7db0f66df2b3851077fcd6ee3e7bd6e2e9dba0c3e644a26d2724d4a101c0c7e630147a70101899d26d2f5dfc60d4e7fa12af39eadf
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/org.gudavim.plusyoy2c/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/org.gudavim.plusyoy2c/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 bda6ef7dceeee3c048581661eb5cb1841eaf696d349f2b624cc89443bd14d0a3
MD5 ec00357dec06b7453a8fd913b7a7f503
SHA1 6086117cda468d7e853402ae3cf4724712a84dc7
SHA512 c2fb56ae06c0423e54fd945bce984f816a7979e8806923fcbecb2bac9f7ec95f07bc676bc2c71d5dc621e5744a18c2b578c68f62ed8a79bdbb386dd2f563fa51
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/org.gudavim.plusyoy2c/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/org.gudavim.plusyoy2c/no_backup/androidx.work.workdb-wal
Size 213KB
SHA256 0bbad47d551d7f15d37f745e49c56d24f9d940f9e601869960b1fbfdf658085d
MD5 7d41ccdb00c7a8e8b529771f79b15a57
SHA1 0a42f7246171d3a4142d2e405bd45eda8afbeb2d
SHA512 3469fe60abca0b63fb2ae4da1967fe7b10e15fa2c81fbe317c06245c299bb8c6f9c20c24c50abf65e0dae9991528489d8e1cdfafd60430ef066f7d88323c96bb
SSDEEP 192:6HQtYr9OFybAmxAQtYrg4QtYruQtYrgQtYrc:6wtYrvXtYrstYrxtYr3tYrc
TLSH
T12A2489AA225CC355C9494F3BFC7ECEE9D1821F22498114D934EF7724F06B25972A974C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/org.gudavim.plusyoy2c/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 f6b1ccf2cf7e6cfc630d2de7d2331acfe8860e811ad6d9ec479c36b46d8a76d5
MD5 34f6ede3d2d9a4e946995b6d94effa1d
SHA1 fb88f53c0937bb194d03ffd68a3c8f618cc475a8
SHA512 41095cc15b23cedc94809a3dfc485c50f55d4b98115145fb0c5b9619a7948593eb27632c5aefcfd31f3ce019f3964add82c35fe70c98317d312516764286b57b
SSDEEP 12:K01bI5KRtzdTRmBEyPbP/K9386tjHCRugOw2:KAbdtzyGSP//ua2
TLSH
T16472C28C53906B53C18A4B33449DC3611D62671BC762C78BBAD508522D232C8BA70F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/org.gudavim.plusyoy2c/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 417b67e2f93c7aac7a01a750aa708e25393aacd495bad43522bbccd432d0f4d1
MD5 591b7991875bc8259328759214b44625
SHA1 8bbb4947992c240ca86fd5e61efb2823489a9a62
SHA512 8fc47bb25bb31f9a11ec088fe8072c063d84a48b7d8085063c61ec72bca9a63dbb66d202750a717e64db6c878e882cf756f43ce1f778ca72cd5846b9025bbadb
SSDEEP 96:hXnLJG6+etidjnZRWzzb8/KeKcK+zSNddKz+ZD86u0ExV:hXLJ7tidjnfWzzb83zSNde+ZD86u0ED
TLSH
T1F5C3FD8D0F697600C0A958B295D40BB1793F422FD393E3D279E100B5ADD2921EE39DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MDx.ico

Path /data/user/0/org.gudavim.plusyoy2c/app_zone/MDx.ico
Size 9.0MB
SHA256 9919c20c038509b92a586062def679df70641e799b08c26ad4439ffd73b6c45e
MD5 d4a90eaedc493143bc94e1a9c85fd3ff
SHA1 9fd4861e6a466692b1cd6c4993b7c023f30fd8ee
SHA512 80495b7d089cd3438b03eb58f1450b3e94cae6dd26165469b8418d2fde6573a267a18fe63632eccb2130a80ab4eb765f13b3d6f63a5cbaaf4d059bdbbbc900d4
SSDEEP 98304:OpE80SaDjnACK62FNIR3TdwefmtXkABDaOv2RRBJh:6t4XnA2dxf7OMRh
TLSH
T1E5968D53AB222E31E5AF93372DFB4301BB32569577130B9B1045C4FCBC926C15F9AA98
MD5 SHA1 SHA512 SSDEEP TLSH

Download

MDx.ico!classes2.dex

Path /data/user/0/org.gudavim.plusyoy2c/app_zone/MDx.ico!classes2.dex
Size 4.4MB
SHA256 9e723e962dfd8325abad37a0aaf971e0650f1072d55c8fc27ac45ba59bf8501e
MD5 786803963a6d8328c5740ef050288382
SHA1 f95c42f77130de9282942ffb14ed46d97e847d25
SHA512 db03c5e32b0ae33690a52833129db5cace9c66d88e59b84327e5e533fd3eab6365fdd5afc73d26bb780374f02bf6da052a7b883d4ecdeb6f9875353ae9c03840
SSDEEP 49152:xDrL8ICjL+AmwfBoCumAFJ/ZSTeeaZxQXt9yBqhFB72D:Fv8ICJuzJ/guZq7FC
TLSH
T14D267B37F20A2D31C59E07755EBA530D733262C7778787527628A52CBEC33D1AA682B4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads