6cd1baa6d5bf66116da292e3f15bfaade7eceab9aa484b6b7353eed7a4165fa0

Resubmissions

03/07/2026, 18:30

260703-w5j9maay9l7

03/07/2026, 18:13

260703-wt5fesdx9s7

Analysis

max time kernel
149s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
03/07/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40770fcf_RT0eChallan.apk
Size 1.2MB
Sample260703-wt5fesdx9s
SHA256 6cd1baa6d5bf66116da292e3f15bfaade7eceab9aa484b6b7353eed7a4165fa0
MD5 618db072a626e3f203902ba1af3031aa
SHA1 95602da8f56d7535c3a6e55eea0d898837265383
SHA512 c54a37fa1ae47cd45263197caa5d480751ad87ecb28b58cafbe6accddec11daa1c39042d08d03933da3f86977848409fa233b8ba113848aaadd2d7c870006347
SSDEEP 24576:LUZjs7vP4aNFyYe9Iy35tfPCT5NsXK/12YHs7vP4aNFyu:mjo4aNbGIy35JQ15Ho4aN3
TLSH
T1745523C1B356EE6DEC7B41715D9268A2E4BAAD580C84AA1F341CF77C71BB7C84B40389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.aefyr.sai/[email protected]	5030	com.aefyr.sai

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.aefyr.sai

Checks the presence of a debugger
defense_evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.aefyr.sai

com.aefyr.sai
1⤵
- Loads dropped Dex/Jar
- Checks the application is allowed to request package installs through the package installer
- Uses Crypto APIs (Might try to encrypt user data)
PID:5030

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

fetch_f7323698.tmp

Path /data/data/com.aefyr.sai/files/fetch_f7323698.tmp
Size 11.8MB
SHA256 b9d16edef55abd459ed2b9987a9d605b8a93fae6d807be45281186d36ec30f65
MD5 38279fb80abc0ef7e74d8a72ddad832d
SHA1 263f99ffac9fde6da6706b01ddecfd630c3dfe9e
SHA512 a8809a7f5603bf2e260c58ae7c1c63feae2342376f78d8dafdd6f94a7457907fa0a0ed11b1a2faeee9b7e98b67d7f72b9425a82dd5cd73b026e2594483714186
SSDEEP 196608:nMNG26UGLukAnmyo/Ht9IY/ah9ITZQA6h1Q6SzjwX9H3DlLQcxay7Y3/Tm9IRiTL:W6UGvAnmywYYiUidX9HNxYPTm9IRSSQR
TLSH
T144C6338D45095AF5604BDEEB4AB50420A71E33F445F70809C6BE8D3A877D817A293EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stream_debug.txt

Path /data/data/com.aefyr.sai/files/stream_debug.txt
Size 65B
SHA256 e3505c272ff758e39c01da328086729d55fb83e4aa624b65925761340193c318
MD5 966eb7c840a8564c0d835347bc7f6d59
SHA1 5bae9219b8281c02fccd223097b45e0fccf39bda
SHA512 465a01b1bcbc5137b45538f92fcf6d969bac9243692be82644d9dca313cb29b957e6b214eddb36cb67b9431354fd7d70fa7faa6aa4651803afe6e39983ad30bf
MD5 SHA1 SHA512

Submit Download

stream_debug.txt

Path /data/data/com.aefyr.sai/files/stream_debug.txt
Size 52B
SHA256 f7166e6c419f1ebc1a50f00dfb2db9dc5caeb1f223d49fbf4a7692b2fb9eef41
MD5 f666820b15cb6c52fca089e27370638d
SHA1 0dc0402042c9815ea4c5b01625a26dfa7e1c777b
SHA512 9cc18697ec8a470012f154d13289660675d51cb440e2e3806e31d761614ef72ccc5d4f173a65717a2b9118bc2e86d601ed272bead16711ef1051f701e4d345d0
TLSH
T1809002570804050F590971245675E76C285711E65E16143A4159614491401ED9290918
MD5 SHA1 SHA512 TLSH

Submit Download

stream_debug.txt

Path /data/data/com.aefyr.sai/files/stream_debug.txt
Size 65B
SHA256 1b32cdd1171c6e4c4bf4a83f8ea703967a09183156d2fb2fd27cd58ace220292
MD5 09f036a40cd300b7580ab5f84606f9eb
SHA1 f2f105732cbd1ede1aec922a2601db29da1d8017
SHA512 948134f1fda533d58c9ac95db8965f478ca1e8991ebab73230b27c21434ce7ff97dbfcb52479a0fb282d1c5d256d48552cb2f8bf23fea74f63ee3f93e71ddb78
MD5 SHA1 SHA512

Submit Download

stream_debug.txt

Path /data/data/com.aefyr.sai/files/stream_debug.txt
Size 60B
SHA256 67d358079a49db148855032a179a32b0560ded628d362bb537c63a20c5c8d729
MD5 23d882c51c226e6ce78ee4bb23d15c68
SHA1 93aea2a9f3d21b1fec324e377e643e052d1f30c1
SHA512 dba11921792bc7a9ab962b3277928535c3c009a23ad070945a43ea07583baf7923a4942c6d9008cd49e60ec7454e505b74151a824d9741e3a746f3d22b90c741
TLSH
T1DFA002375A40011FEE05457675B117202B581DD35621452C051D789890C28DF8662924
MD5 SHA1 SHA512 TLSH

Submit Download

stream_debug.txt

Path /data/data/com.aefyr.sai/files/stream_debug.txt
Size 50B
SHA256 98404fff4888b9de54d8e902168f435b1299f5382d0b481319a1e2c21d644254
MD5 04393f8a0f4b04e975c1f285b35f1694
SHA1 d1c86f2b507f91432e1c6ca5d07ef0f743e2ec0f
SHA512 50e2e17e0eadcc03b3537b01b6a346408b9e13a721d0277c4247d8e501973b19ba25dfade9b812470694a75c2283ded00175c623cb5bb5492b8a36c02e4a9be0
TLSH
T1EC900233191017074D021211FD6A936004406281250604780709A84590840DB4111D15
MD5 SHA1 SHA512 TLSH

Submit Download

stream_debug.txt

Path /data/data/com.aefyr.sai/files/stream_debug.txt
Size 197B
SHA256 a84e9013528b78197c22ee1e572d32ec1e3e2a2d3a7a7f192eb724d3eb990546
MD5 fb1c5be5e4899f3f3f27fcbc101c9f08
SHA1 bbeb91114bf2a0cff48db23b29232658edbe3770
SHA512 cabc0efe5fba4fae3a7dc38a3e15f1074745f6487bdfb0f4955f10f9a212edb4b8a990ea22e8a6528106b0e22b9f83994a0c1e1f9809222a45e20ec972fd2a4d
TLSH
T142D01223C94D60CB1E85E46263BEA3679EA49DE9C3215F392E2CE02C0409294C61B954
MD5 SHA1 SHA512 TLSH

Submit Download

data.dat

Path /data/data/com.aefyr.sai/files/vault_extract/data.dat
Size 12.8MB
SHA256 6979368b89c08acf57b75f594ce7d80cdef0033202eae97cd988b47dc4549928
MD5 fff4752eeaf438d07246d87d6c998ad9
SHA1 cd0fba39cc4bfa7d681b17f508569df00853bd2c
SHA512 dfb941fa4641a0b6a8779cf0e97ca2b467a93ffc0afa0bb0d7bbd19ec0843e403fe514446747189e415172104438fd877774a0e1957d6dfe209203ab245f557a
SSDEEP 196608:BFIASeU636XGM4BkAf2pWi28YJjJzfq9VBs3H9dZxP0Wfes/xl8xCGG5+tklsFyr:BFpUdGiN2rtEUHZtpesZOxGpsF8KzIj
TLSH
T10AD61287F798A92BC8F79332567A563251474C068B43D7C76948B37C28BB9D01F89BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path /data/data/com.aefyr.sai/oat/x86_64/[email protected]
Size 80B
SHA256 29f3e518d9cfd10bee3f0629a009befd7bdbb5e7c271f7d4428bbd26f7a6a453
MD5 4da66ece11ebbe997e8961519a8bf208
SHA1 72c5efd797992a1c8ffb8a79918d6bac4a18e181
SHA512 b71f3fd9c8ce2e1d3edfd1a74efb27c0c27dcaec7c4c3496cc2f9d043b75c1062fe34d5cfa0327112aae25f14abf2283625ebbb3b818e18d63e7bf9a55ba1db8
TLSH
T1F7A022ABA8083EC0C8C00E300B880AC30CC0A2C3200220F80CF0C0C2EC2B0203A08B0F
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path /data/user/0/com.aefyr.sai/[email protected]
Size 452KB
SHA256 e475f3bd83fa9ac100f6679e2ca8e8f8063f923d8254bae7eaf3ebadfbde4245
MD5 0b1e50298c4d45a37d922ac5c405073c
SHA1 b8d0ed8fb5b118f6bdf9a355e1d8a170a2d436a2
SHA512 780de9d7fac686a3980df32e2e7422163f0e33d7d8c89fabb50c7770da7dab63b495beca4f5afb3d4a6b16090b392669e8ba8987c12aa8bdf7c8ccfc845f2133
SSDEEP 12288:0L8pKOm7xLxEJDVdFn0nGmF94yiswdHEmSqP:hpkxEJDVdF0GmFJFM
TLSH
T1C9A43916BD43AE53C5EDB734158B2710BB349C96F7439F6B0516E932AC8328E1E920DB
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads