6cd1baa6d5bf66116da292e3f15bfaade7eceab9aa484b6b7353eed7a4165fa0

Resubmissions

03/07/2026, 18:30

260703-w5j9maay9l7

03/07/2026, 18:13

260703-wt5fesdx9s7

Analysis

max time kernel
149s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
03/07/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40770fcf_RT0eChallan.apk
Size 1.2MB
Sample260703-wt5fesdx9s
SHA256 6cd1baa6d5bf66116da292e3f15bfaade7eceab9aa484b6b7353eed7a4165fa0
MD5 618db072a626e3f203902ba1af3031aa
SHA1 95602da8f56d7535c3a6e55eea0d898837265383
SHA512 c54a37fa1ae47cd45263197caa5d480751ad87ecb28b58cafbe6accddec11daa1c39042d08d03933da3f86977848409fa233b8ba113848aaadd2d7c870006347
SSDEEP 24576:LUZjs7vP4aNFyYe9Iy35tfPCT5NsXK/12YHs7vP4aNFyu:mjo4aNbGIy35JQ15Ho4aN3
TLSH
T1745523C1B356EE6DEC7B41715D9268A2E4BAAD580C84AA1F341CF77C71BB7C84B40389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
Anonymous-DexFile@0xc8a00000-0xc8a71140	4298	com.aefyr.sai

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.aefyr.sai

Checks the presence of a debugger
defense_evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.aefyr.sai

com.aefyr.sai
1⤵
- Loads dropped Dex/Jar
- Requests allowing to install additional applications from unknown sources.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4298

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

fetch_e33cd079.tmp

Path /data/data/com.aefyr.sai/files/fetch_e33cd079.tmp
Size 11.8MB
SHA256 7c4760b84ed7e4ba4ce752d9690a8db32398a98570fe9bebacbc593861882e06
MD5 3837b627a83903723c3ed117e7025559
SHA1 4fcb5b38ceee24d2b33ddc6070cbe0cc6803bc33
SHA512 e59cf569283b13d0aadd7afb4c4e3af0ef6e9ea801037fc696643597314e7f77254f874f53c6b8707d4a958b66bd443b664322a839a9155938691acc04ec39ce
SSDEEP 196608:D4XC0qBPgKnorr04iMuoEBCzxqzDBr7wbdjKrRQlwRWPyozxzmFZISKJVqlDtuyT:D4XABPzorQ1fBKgwxjKrRQlwA6oNSQr4
TLSH
T1A5C63322E989CF895A34229375AD8BAFF2CB3DC441409ED93E78F10A5B65D1483C6C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stream_debug.txt

Path /data/data/com.aefyr.sai/files/stream_debug.txt
Size 65B
SHA256 1a60f3a02fbce839dcb96d8b6c12ebdc3863c6b20c7d5bfbaf150c38e1aa9ab2
MD5 97d3185383e37f083e0c0cb1bbe1faef
SHA1 951402d92e7f3aa735451c461c9a811e45c10537
SHA512 5bee798f42fb6f36c0bb24fabdab7eb16a6273a908f88315ad228d59d5190a778eebd2d8205fde742c3583ce54930400d404fd84e666deea170f9100887df375
MD5 SHA1 SHA512

Submit Download

stream_debug.txt

Path /data/data/com.aefyr.sai/files/stream_debug.txt
Size 52B
SHA256 cb9efd9aba5d75eacafacc634c7ad00a2a980e2ef50637eb3198e78f0d828d41
MD5 85b7549fe4ce2aea1f0fc7c7480a3627
SHA1 a75de271bad589e2249ac331d8d25bb6586c72be
SHA512 e73931863d9136807fd8ff24b47a3f6e14cd450ef338a10110eb482172df588495a92a737a9dce645380ad11bedd83425fc3f76bab765ca4fc04221d5afb6e7f
TLSH
T1599002520500050EDD09316515B5FB68284B11EA5E1645364545614491809DA9198518
MD5 SHA1 SHA512 TLSH

Submit Download

stream_debug.txt

Path /data/data/com.aefyr.sai/files/stream_debug.txt
Size 65B
SHA256 3c1ba260d7e0436413b926c1c4a83748445732966e4f5ae0c6c052a8aaa484e3
MD5 3da5faa2b7138f3a322ba1ab94e3a8b9
SHA1 d06033a187f176e4ef4fcab17c061deaecaaf11a
SHA512 fa55529ca42522d5fcb425fcd379d57c5fb278f3c10714fa3d1897c06ee2429fd275ca0b13ac6a01dbc94fac17c93b2e4d61734aff8c13b76d463245bb1d1572
MD5 SHA1 SHA512

Submit Download

stream_debug.txt

Path /data/data/com.aefyr.sai/files/stream_debug.txt
Size 60B
SHA256 e3daa653d6edfda922470e9c04bfabb61a4b95d5d4eda953e75376c287c3ae67
MD5 fb0bab37dd9c5b3a32908cf488f62f15
SHA1 29c8cb2ac298034242096fa394639299ddb55b8a
SHA512 febef1d6e4c9422b7ecca2c84938a31ebf821eb809893cc1f7937698170c28f0e979eaf89a133c4038a5b07c7b5f858806cd3f995c208c3baf328401e468e72c
TLSH
T160A002365640015FEE05417631A117202B5C1DC35622452C091BB89890C28D5996E924
MD5 SHA1 SHA512 TLSH

Submit Download

stream_debug.txt

Path /data/data/com.aefyr.sai/files/stream_debug.txt
Size 50B
SHA256 eadd5cc1d2416417a102d5071f7fe1aaecff5febd237fc5a426afd4aac678c69
MD5 1a61d13d8735d545261c2fe055c27381
SHA1 a6d815b8eb280390c04432b0710595e9a8df33a3
SHA512 ddb0d6b67346fca700f4ea5d8cb66b920b5eeabf27211f83fe979da6f9755df22da5d2ebb0ca8eb581cc3c554baffe2f851a1baa96d16edce541c920e15b5c16
TLSH
T11D900237150017470D115211B967136014446281250604740B07E84590800DA4608D15
MD5 SHA1 SHA512 TLSH

Submit Download

stream_debug.txt

Path /data/data/com.aefyr.sai/files/stream_debug.txt
Size 197B
SHA256 46ad744315a3b67e32d068b49355ba6758c2879adccbc10fd43fb67d9a04e2f3
MD5 224edd01e3838b86abbd801e0926bcb0
SHA1 7045ecd8747d05c6e3f775ef81c1c5c2954c62b0
SHA512 a6a96ade2e3c187965286aa5a967076c3d815c708e5df528331528839e9efe097185b4f5416464d391d58054a47ca15e40d79dc396de88087966062fa3fd4a47
TLSH
T18AD01223C54970CB5E94E46753EEA3635F94ACF993261F3D2D28F42C1909660C71B5A4
MD5 SHA1 SHA512 TLSH

Submit Download

data.dat

Path /data/data/com.aefyr.sai/files/vault_extract/data.dat
Size 12.8MB
SHA256 2a9b26ee8599fdc9330ed7e5cad5b4583d37efdc402b3e72b88cf927410f6ff0
MD5 71305667bc9a8f01f7ba4be73b8a9990
SHA1 89bc2758463d4bc8e0bf7d54d83e01f3f219a027
SHA512 ca320f80381224731c114f36a1237365d8a491cf84fdfaa24765a18423924ba358e6d8dedc18ad83fc0e10f27965119bcceecdff85006ea1146342e380e6bbf6
SSDEEP 196608:qQIASeU636XGM4BkAf2pWi28YJjJzfq9VBs3H9dZxP0Wfes/xl8xCGG5+tklsFyu:qQpUdGiN2rtEUHZtpesZOxGpsF8KxIk
TLSH
T101D61287F798A92BC8F79332567A563251474C068B43D7C76948B37C28BB9D01F89BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Anonymous-DexFile@0xc8a00000-0xc8a71140

Path Anonymous-DexFile@0xc8a00000-0xc8a71140
Size 452KB
SHA256 e475f3bd83fa9ac100f6679e2ca8e8f8063f923d8254bae7eaf3ebadfbde4245
MD5 0b1e50298c4d45a37d922ac5c405073c
SHA1 b8d0ed8fb5b118f6bdf9a355e1d8a170a2d436a2
SHA512 780de9d7fac686a3980df32e2e7422163f0e33d7d8c89fabb50c7770da7dab63b495beca4f5afb3d4a6b16090b392669e8ba8987c12aa8bdf7c8ccfc845f2133
SSDEEP 12288:0L8pKOm7xLxEJDVdFn0nGmF94yiswdHEmSqP:hpkxEJDVdF0GmFJFM
TLSH
T1C9A43916BD43AE53C5EDB734158B2710BB349C96F7439F6B0516E932AC8328E1E920DB
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads