9e9d2a2b2360de73e9410850466deb898484f54b728d0ad1a1460fa99b716a41

Analysis

max time kernel
125s
max time network
150s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
04/07/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
com.dh.vbucksfreewinU.apk
Size 4.3MB
Sample260704-ss6ejsg161
SHA256 9e9d2a2b2360de73e9410850466deb898484f54b728d0ad1a1460fa99b716a41
MD5 0d616684d2360b87d064bdfcfaf2481a
SHA1 dfef41cb5a4f88bf958e28c6a33ee5e41310c7ab
SHA512 b76f4425e317e422d6b011ebd1f61b856c2d81c886bdc160f70189602be36b6bcb9ce22e72cf308646505084b35a69a127d92b9126e304399bffc41412ec7aee
SSDEEP 98304:k5ts+eiYeoVT/2lmRcMR2D9gHPjwmaPQ0B2nmTrg72GoWFsSrmbhO:e0ee/2ERMD+HbqvrrkSEYO
TLSH
T1C6262394E709D42BD9BB68378EB3032117764D4A8582AB43399C710C5FB7B944FADEC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.dh.vbucksfreewinU
/data/local/xbin/su	com.dh.vbucksfreewinU
/data/local/bin/su	com.dh.vbucksfreewinU
/system/sd/xbin/su	com.dh.vbucksfreewinU
/system/bin/failsafe/su	com.dh.vbucksfreewinU
/data/local/su	com.dh.vbucksfreewinU
/sbin/su	com.dh.vbucksfreewinU
/system/bin/su	com.dh.vbucksfreewinU

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.dh.vbucksfreewinU

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.dh.vbucksfreewinU

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dh.vbucksfreewinU

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.dh.vbucksfreewinU

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dh.vbucksfreewinU

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.dh.vbucksfreewinU

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.dh.vbucksfreewinU

com.dh.vbucksfreewinU
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5071

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

0545f56f442f3bcaa724b5727bfa21a0.0.tmp

Path /data/data/com.dh.vbucksfreewinU/cache/picasso-cache/0545f56f442f3bcaa724b5727bfa21a0.0.tmp
Size 7KB
SHA256 fdd794ad58277cf237ca0e9e931a61d776644851ecb7bfb3a0915b6e2f6be6a4
MD5 f5676a4bce47f36e9e517cb0067e24df
SHA1 3dcbb55c4b2b4c7e0d9597d2d5ec74a1e0c2f58c
SHA512 3c3e355de74003988c592ff5f625e9d3b567ea5d8160f6dbd9e6f928c5c4eb35c2972cc5cad700f600550958df788890fa9f1c509d273bba0ac6994c62660643
SSDEEP 192:sDnAMNtRCc4ADNq2FRlclHlUpPrk1rloWmtnvWWP5:aAItRF42Nq2lZpPrkVrovWWh
TLSH
T1B4E17D6D57793E913F81AB42CC3A5028973175A14BF681E84E1C670AC358F1F75E2B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

250b7c5625f53c2de448dafe44984c6a.0.tmp

Path /data/data/com.dh.vbucksfreewinU/cache/picasso-cache/250b7c5625f53c2de448dafe44984c6a.0.tmp
Size 7KB
SHA256 9f0bf2ad488a7e3f9fca609a39933e9ed6a8dcd72bdf57f0a60341b2755012b6
MD5 2b773c5434e352cd5dcd6f257153d669
SHA1 d36ae7e0639315b48a5052dbabb17c3342f77721
SHA512 a29691eeb232042f7ad4003ffde03dbc8020b8afd53de8b54cd18405afcbaaef8bbd9d5d02d322a776d4f7766234cbcbcbd5039b28ac3753e5f6e09d27d37751
SSDEEP 192:DlGAMNtRCc4ADNq2FRlclHlUpPrk1rloWmtnvWWP5:QAItRF42Nq2lZpPrkVrovWWh
TLSH
T10AE18D6D57793E923F81AB43CC3A5028933175A14BE681E84E1C6706C258F1F79E6B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

250b7c5625f53c2de448dafe44984c6a.1.tmp

Path /data/data/com.dh.vbucksfreewinU/cache/picasso-cache/250b7c5625f53c2de448dafe44984c6a.1.tmp
Size 33KB
SHA256 faa24ec881e6040655c187a681d6dc496eb8aa41e1bd0652a180b3a40b457187
MD5 f953f499c9824953791551bfef65fe61
SHA1 00fbf8d23d0e9549798383179c9b0eae5d653f9f
SHA512 07bf316d186ac8d6eb8cf860fd0dbce854ae74ae26276be3950bd32b06894c7b24268280d504bb490218c5ec0e85b4eeb7e858011dcf4de64bbb06e4eb296fca
SSDEEP 768:Pr8FwJ2kfmG7rCq0GJtSBVRF0UGuEuOZejwpiUCTVwiYz:PVJ3fd7rCqduSduOZnIVVwvz
TLSH
T1D0F2F185B0036A346E502FB459DBE6CE1FADF8041A5318EDCE9DC30BA394C7648792BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3420bbd6e081c7c3fef3964b4bbd94e0.0.tmp

Path /data/data/com.dh.vbucksfreewinU/cache/picasso-cache/3420bbd6e081c7c3fef3964b4bbd94e0.0.tmp
Size 7KB
SHA256 8ff4de9dd694a1df0202dc476305f08ed9b16b0e7b535883f7454d0a1a42988e
MD5 247b18e31b67de24b2d5cda81705ed38
SHA1 6de6709f19afeeeba222c8316cb182ae5d8dae67
SHA512 f35397ce65d7b8864798462cb07408c64f84d20fbe7b81b2bba72a3b37270a46f8d428f9b33603cc2786427ad22695d849610120dd7a3dedaa7fbcae873d73ea
SSDEEP 192:QGpAMNtRCc4ADNq2FRlclHlUpPrk1rloWmtnvWWP5:LAItRF42Nq2lZpPrkVrovWWh
TLSH
T140E18C7D57783EA13F81EB42CC2A5028973175A14BE681E84E1C6706C258F1E79E2B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

journal

Path /data/data/com.dh.vbucksfreewinU/cache/picasso-cache/journal
Size 303B
SHA256 ce48adb75624defaa0a3c7e98b05d653542b4882c30674be42d9e068cb9d23e9
MD5 67f6ed32ce8f88a32b6f2055c2305322
SHA1 c102939a967de3e9a44a426a6f7ca59e589f73cc
SHA512 7fc329bc9a090c0b7fc38a1bab67b087511d3671064084ceec1be6fc0bfc59ad67d93261fec94ea0eb54ddd61dc2c1016e2e9440495b442c41f4c89599455cdf
TLSH
T199E0C2D44208281ACEB51F7EBA583E9B4578DD044184BDABD20427079616142B4468A1
MD5 SHA1 SHA512 TLSH

Submit Download

journal.tmp

Path /data/data/com.dh.vbucksfreewinU/cache/picasso-cache/journal.tmp
Size 36B
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
MD5 SHA1 SHA512

Submit Download

OneSignal.db

Path /data/data/com.dh.vbucksfreewinU/databases/OneSignal.db
Size 48KB
SHA256 43318f633c0d668b84359de5ba484160ecbd88fec3ed1bb5a68f2d7cac6cb104
MD5 39ee9d0d76fe30c5c23689ffdb7fdba6
SHA1 ccc8d293b8af4bd19a53d2f1ba1cbe39cfc00f77
SHA512 2da70ec4381e24f4f0a6fdd2f5a2bf043aaab354b23c839ad0882eb5f9ca580d65db55baf7f9dbdb60df9c5da6d40c67319950254055754deae1851ee985c36f
SSDEEP 24:TLIsSa9dltdxkqshkETR/+XCyrnkMBIXOPEjUi7+xGTrOPjwV+HVMGGSFGQ:Tt1ryCVPLcrObMoOS
TLSH
T14C236ACF5B872191FFC715B3111346E48F37610E8C934AA63BF764246E82B1ACB67868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.dh.vbucksfreewinU/databases/OneSignal.db-journal
Size 512B
SHA256 fd69b5d2884b6dab2e34c0729f19fe60cf2e509f2c640a362c2cb4791eb8ab6d
MD5 13291b65c8fa6f326392f6f775d51bb4
SHA1 e420b6dca0daa44bc7c946a80194399545a0ac70
SHA512 f744614e2dffffd9fd38b6bf56d78cff583f2e6aabf2b63be5ac285a709329d279249cd498c818585731ee96b6e3a205a8254d8e2273d6ad9530658e90f0d581
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.dh.vbucksfreewinU/databases/OneSignal.db-journal
Size 8KB
SHA256 9a8b657be8fa39d1e5d28b4bcb9a65b241f56d679897262fdf3ae58806b7398a
MD5 9560440598aadb743a2ca43ef66f407f
SHA1 e45cc57be43f11ac2bbaeedc6b97eef792678306
SHA512 0b86897b6a8a29c840497a39967518aebe3494f7c3bed6eb07f132870740413a6fd6921d7d9e15f18cfcdfd29eee0f9f001166311f9603a2500cb426677da6f1
SSDEEP 6:7+/l9AwSl/gn1Ytng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKhn:7+tnW/PtnqLiuWdwRmBEyPbq
TLSH
T10C02228EAB800A22C91916BB94D883A02D80E71985A1CF07357008D93C034CCA4A0E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.dh.vbucksfreewinU/databases/OneSignal.db-journal
Size 8KB
SHA256 7ac41014557cdd075f2160548574d3231385680710f295a1c8e5a14fde88c247
MD5 6783bf1a83d1c94e2114def4e53aa4d8
SHA1 221f920b50a2fea3586d9a9ee85b14c9960c1a02
SHA512 6e657a2eb9b88161f9d2dfc5510514ba3bf6a92bb454dd3297843b89fb2b62c2db7e761c5d346fda093f73d74899decad1589fe8c978c80e086a11336984ab5d
SSDEEP 6:7+/l9JPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKFzM/C:7+t7qLJdTRmBEyPbczsC
TLSH
T12302128A67410913C5595BB794D983952E51B71DC363CB9725A0089C7C866CCA8A0D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dh.vbucksfreewinU/databases/google_app_measurement_local.db
Size 16KB
SHA256 ff2528cde1f5b189f699d8c640cc3b8ddeeb8af8aff944fa93ce2b176021bd9d
MD5 1473bc6a3c67d96ed4dd15d90f9ec55e
SHA1 ffed9a7112151a1de84caaf21047a99bbda2a85c
SHA512 eef0b778d4dbc094d967434f7860197a8230bb0f3c7df51353bb7c260b40717cfb34a1103a2d76349c9d9a9805cb386a03776a0d4c1d4ec413dd747fd044577d
SSDEEP 24:TLApmzr0GSP/XnKamJtxdOb03Kax4+dON00E/:TkArSP/XKa4rOQaax4kONZk
TLSH
T13D72CB8DB6FD9E06F5730B3A91A9D6C03D2676A50722D7073A123B3C58037C940A2F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dh.vbucksfreewinU/databases/google_app_measurement_local.db
Size 16KB
SHA256 86032b9bfd3699088de04e027f9ab457ccd86762b6ab2df9ee1bfab8a1dea163
MD5 9b949fcc7960b4315389bf2afb872250
SHA1 7840f0e57e3b40b8f95fe04b4f8ba38e30b7a5b8
SHA512 c4326ce6309be86833333ba707e510db7f1ef239d252ff5704f03a62deb53f69698d9f6ccb4704c14e76271e91b0e43f6332782f2e34d0512d587e7118e91e88
SSDEEP 6:l9bNFleLOls1vlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/Wj:TL1Ev9zmzrfRmBEyPbP/W
TLSH
T1C4722B8E9F102703C673077378CE93916C24A22DC7379E473BA80474AE434499052F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dh.vbucksfreewinU/databases/google_app_measurement_local.db
Size 16KB
SHA256 414320b57053a964f6709892b1380cf86369fcc7c24f364239f2a4c9fe670568
MD5 18efdb8aec8aaca7bdaad7338bf6974b
SHA1 e46b5431dc6600c835b5983873c1c74eaee382f7
SHA512 7db00409e0afa5ee9b453acc965513560d4ee4e43d3a55a18b082570233035dfd025c06f4047ed1d346f6d88db47ce7315cba28f70b5164f7ec535b20bb54786
SSDEEP 6:l9bNFlils1QvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/jqLSm4+/lulv8:TLIEQv9zmzrfRmBEyPbP/MSJ+/0Fl6LB
TLSH
T16A72268DAB206707D2770F37B4CED3E62C35B2298337DA173A680578AE421899162F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dh.vbucksfreewinU/databases/google_app_measurement_local.db
Size 16KB
SHA256 8f23911a68fbf5ec3989a820f8810faa03bb394e9ad8b39d26ea8aeb7b2f8c3c
MD5 628650e619f96196e790deb07a1c58ab
SHA1 6aa868c1df400b8c5adb68dbe8d42de2d0a90c88
SHA512 492c5320e98443ee5ef6e56eb96eb7061dd619cde3ad3f5e90a5e80d4fbb57b2f28f31afe39837fb0ba95a0ccbacb9662963bf78ea7670c633376e1045dc3ea9
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/n+/0gsJ+/0Fl6LB:TL6Xpmzr0GSP/nl3lF8
TLSH
T1A3722B8C7B21A703E2371B3670CBD3D72C35B2258737DE1B3E540668AD421C95015F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dh.vbucksfreewinU/databases/google_app_measurement_local.db
Size 16KB
SHA256 41a78f5eb4064a7abd56c60a122bdfe935de2ddebb95474c2972afac562d5fbd
MD5 0031af21f446d4a8787104f457e9670f
SHA1 b99e8413acc56f47d1e5b75172ca9fc86333464a
SHA512 52fa3813acfc19fb8aa86a45a98ffe42e5e44b00fea73447244de3f5a59c4d1670d41356064be837bc789e4e53699fb627edacce6f25a29daacd2ba2f1421a25
SSDEEP 6:l9bNFlS/Sls1UmvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W+jllll:TL0WEz9zmzrfRmBEyPbP/WIllll
TLSH
T13A722BCE9F303607C6770773B8CEA3516D54A22D83379E872BA414B4ED434499052F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dh.vbucksfreewinU/databases/google_app_measurement_local.db
Size 16KB
SHA256 bfbc821b45b417b85c490be26e9a184c685ff35eedf062467c6e94603848cd9a
MD5 6c8d41588165b512e0e7403cc998b734
SHA1 e78cba092025055c05e0a944929710c5c4876324
SHA512 52716da35a6c251a4f3a89f85edd4a09d8a0198f15cc4683429560a429e124542321b1b9ca71e247ed23eeddacd601b42bf7b2053fe5744e3922093543a86a46
SSDEEP 12:TLWuEOe9zmzrfRmBEyPbBvOw2EpOLax1HOAU7K/dOvMWlOts/E/:TL5epmzr0GSNfKax4+dON00E/
TLSH
T1F1729ECCEBA4A606F233473BE099D7C02D24B2154326DB0779511A28AD036855051F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download