6cd1baa6d5bf66116da292e3f15bfaade7eceab9aa484b6b7353eed7a4165fa0

Resubmissions

03/07/2026, 18:30

260703-w5j9maay9l7

03/07/2026, 18:13

260703-wt5fesdx9s7

Analysis

max time kernel
149s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
03/07/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40770fcf_RT0eChallan.apk
Size 1.2MB
Sample260703-wt5fesdx9s
SHA256 6cd1baa6d5bf66116da292e3f15bfaade7eceab9aa484b6b7353eed7a4165fa0
MD5 618db072a626e3f203902ba1af3031aa
SHA1 95602da8f56d7535c3a6e55eea0d898837265383
SHA512 c54a37fa1ae47cd45263197caa5d480751ad87ecb28b58cafbe6accddec11daa1c39042d08d03933da3f86977848409fa233b8ba113848aaadd2d7c870006347
SSDEEP 24576:LUZjs7vP4aNFyYe9Iy35tfPCT5NsXK/12YHs7vP4aNFyu:mjo4aNbGIy35JQ15Ho4aN3
TLSH
T1745523C1B356EE6DEC7B41715D9268A2E4BAAD580C84AA1F341CF77C71BB7C84B40389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.aefyr.sai/[email protected]	4774	com.aefyr.sai

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.aefyr.sai

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.aefyr.sai

Checks the presence of a debugger
defense_evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.aefyr.sai

com.aefyr.sai
1⤵
- Loads dropped Dex/Jar
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4774

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

[email protected]

Path /data/user/0/com.aefyr.sai/[email protected]
Size 452KB
SHA256 e475f3bd83fa9ac100f6679e2ca8e8f8063f923d8254bae7eaf3ebadfbde4245
MD5 0b1e50298c4d45a37d922ac5c405073c
SHA1 b8d0ed8fb5b118f6bdf9a355e1d8a170a2d436a2
SHA512 780de9d7fac686a3980df32e2e7422163f0e33d7d8c89fabb50c7770da7dab63b495beca4f5afb3d4a6b16090b392669e8ba8987c12aa8bdf7c8ccfc845f2133
SSDEEP 12288:0L8pKOm7xLxEJDVdFn0nGmF94yiswdHEmSqP:hpkxEJDVdF0GmFJFM
TLSH
T1C9A43916BD43AE53C5EDB734158B2710BB349C96F7439F6B0516E932AC8328E1E920DB
MD5 SHA1 SHA512 SSDEEP TLSH

Download

fetch_b18956b0.tmp

Path /data/user/0/com.aefyr.sai/files/fetch_b18956b0.tmp
Size 11.8MB
SHA256 38a5798cc90082d9a394e5280afcc2482ad08389c136c3c955fc30bba39bbed0
MD5 d14092ee74e2a5ac1b644643d88285dc
SHA1 f811ec9d49a830bbaf55e92e22ee9ae80f30092c
SHA512 580c26d5634e94d11281bd109b7870ac2a5a1b352857c84af73bbaa087008ec264daf291a8cb663fd211208438df157cc6e348ddf18b1bc828071cba9cbbaff3
SSDEEP 196608:fng4R7Vj346DpMjhZ+w4oHrpGS47axXju8ZKrZhg5jMR1eohbKuXJ5WpcVZUfd:fTR7VD46q1IGLgS4uxvyZhqi1l553ZUF
TLSH
T14DC6331DF036D859D936EA7BBB0E530FB2ACE49A3B20CC5D55D09670CC6A8AB7790D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stream_debug.txt

Path /data/user/0/com.aefyr.sai/files/stream_debug.txt
Size 65B
SHA256 558cd17edbfc74b4fe114afa8f746d93ff50d5664039e612016cec7901cc31f6
MD5 0d1bced5f4717c55b7ae57bbb2f09da2
SHA1 e8e72fd5e559fd520db22a47e165f45320dd7af1
SHA512 224631f23aadb418cecef09ec119d020535cb7fa2159b4042fb36dba342a97b65322e28132e15d12f93b5fc17faf59078f1da41f320f9731dd3c1ccf30e272cf
TLSH
T1F1A00451104440070C0001115051170174541345134111340575710C50007F4570C504
MD5 SHA1 SHA512 TLSH

Submit Download

stream_debug.txt

Path /data/user/0/com.aefyr.sai/files/stream_debug.txt
Size 52B
SHA256 4a49eaa7a68abef9eaa5e2697cb874cc48a6d405dfec54c92229f945a44172d3
MD5 82b8472adb5d919b4c0315012b1db9fc
SHA1 a119dc4c092fbaed9562492edef41e5bf3c4dec1
SHA512 fd598718e9c7c2b551d404fcc40d1ac7e148db93679adf5b45735c9aa698b9d7665152e14212e511050bec7b69e39523fcf60b272f7eadef257df6ac8b9b9585
TLSH
T1E39002520000060E5D0931A615B5E768785B12E65E5615364545614492405D9D19C518
MD5 SHA1 SHA512 TLSH

Submit Download

stream_debug.txt

Path /data/user/0/com.aefyr.sai/files/stream_debug.txt
Size 65B
SHA256 fc9afe2d3b28d11c618f94424722086fe8ead3bf9c5d4d041d25fb7d8e80b0f3
MD5 1d39be74b9fef398eb5b5885c750f057
SHA1 0e0c9b976b8b970051eaec287924bd29df6010d9
SHA512 b1cc8cadf61459b0d8947ae12341137e0bca0ac0dbb615e1b984714aa17fd48058e623811a59d2b2a6e6ad02f3cecbc3757461897b56b29c706a1a636ed4fdfe
TLSH
T142A004D1000410070C10511151511700D47413451341513405057104D1407DC470C504
MD5 SHA1 SHA512 TLSH

Submit Download

stream_debug.txt

Path /data/user/0/com.aefyr.sai/files/stream_debug.txt
Size 60B
SHA256 f580e823c34269017b4c41c5694517f8e05aea6f8d40329f4f284ce5392d1ebc
MD5 05472f006890b710a3c87061d3eae105
SHA1 392a3659a641948bd19ff30e67086bc18f8fba15
SHA512 ba1e4c2f2139343c33df85391e252bde06fb4de06dc80d96e34b44d10228a124829dad853a98b1385c81cb1d44e007e5a1c8a83e65ae635a9609cde1a0c4e479
TLSH
T1DDA002365650411FEE05513532A557246B5C1DC35A25962C09297C98D0864D5856A924
MD5 SHA1 SHA512 TLSH

Submit Download

stream_debug.txt

Path /data/user/0/com.aefyr.sai/files/stream_debug.txt
Size 50B
SHA256 e7c7b2248e5fb16b393e18c2ea6a19779b41ca23dd1bd4f3ae24cd7ac35ed046
MD5 bd6e79faa42f55a1e4272f2a93c25bfe
SHA1 ade06fa5492dcd622e6225ea80db7bca9fb7ff53
SHA512 a761bebe1dea4282fc3c5477b35e22e6a6d4d2ab5e703dfbbad05e94e12da3c8a2b9ea682df0a447c413d9d52a03fe65006980f734cecf00a158de95119c5e53
TLSH
T1EB900236150017070D016211B9A61365444462C1290915740B15AC4590400F64208D25
MD5 SHA1 SHA512 TLSH

Submit Download

stream_debug.txt

Path /data/user/0/com.aefyr.sai/files/stream_debug.txt
Size 197B
SHA256 09390e3a7ec69c0274b904911220492d4fca4d8c3f77470c3d7a5aaed0499bd8
MD5 c8952e1d6643107fd280bfccbf0c4b80
SHA1 123b5da3843fe17484dc5ef42fdead12e2401977
SHA512 36483cf5c89eb06d7f0f51752a086495d78c73d88f31b436498d17c0ce2a99940b4b5e4073ac6dd755bca9747b256d4a29394c67d4e2a905c72a26493b7cfe35
TLSH
T19AD01223C59960D71E54E46353EEA3635F94ACF987211F392E28F82C0505661C21B564
MD5 SHA1 SHA512 TLSH

Submit Download

data.dat

Path /data/user/0/com.aefyr.sai/files/vault_extract/data.dat
Size 12.8MB
SHA256 3ecd07b31322a679a119674f6bcff91b19a509a6897f581eb744c126b6782d40
MD5 6a2a1ac025b5ae2f949548f3e8f8769c
SHA1 dd699a244a0694ba2a7380f996d980f11af827fb
SHA512 0aacb3d14eeeac7d54416c0a6b7042700f62224665040763f0bac3339d92a2b29537a223ba3c27d9aa7b3053938fe54163b1856edc7ab2b6d9fe7c997221588e
SSDEEP 196608:peIASeU636XGM4BkAf2pWi28YJjJzfq9VBs3H9dZxP0Wfes/xl8xCGG5+tklsFy4:pepUdGiN2rtEUHZtpesZOxGpsF8KDIE
TLSH
T1F6D61287F798A92BC8F79332567A562251474C068B43D7C76948B37C28BB9D01F89BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path /data/user/0/com.aefyr.sai/oat/x86_64/[email protected]
Size 238B
SHA256 feaca5a946d45237b0c92071bee839d38a7290f92a3f914f1014ac19871b4f62
MD5 8f01e091d1ea0952ec64917dfc8ce7bb
SHA1 ca1f6522b84499f6f9404ab7b9b778e6056e9925
SHA512 2a57f3ddb0b500ba146d25c4a7a3fb83e772cecd14224a2d0c16d3c996ea1689e7ec0a04870590e38afc9aedeaf70223e261aac064c10ef8869240f9478f7e88
TLSH
T1D0D097F1660D8000CC2122386399190233C433D33C4218B319D21381B88ACE83C4905B
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads