Analysis

  • max time kernel
    16s
  • max time network
    27s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
  • submitted
    04/07/2026, 16:55

General

  • Target
    Downloader.apk
  • Size 37.4MB
  • Sample260704-vfcmtaas21
  • SHA256 16a77ad1ddbef5f8b10da2fce96c3dc40d5c65bb474ecff37cd983f7a0e65f3a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 8 IoCs
  • Loads dropped Dex/Jar 1 TTPs 21 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks memory information 2 TTPs 1 IoCs

Processes

  • io.github.besmartapps.n001
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Checks memory information
    PID:4405

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        FGiFHPIact

        • Path /data/data/io.github.besmartapps.n001/databases/FGiFHPIact
        • Size 354B
        • SHA256 132879834bed761ffaffe951ce4aac5e32e0437b87fae922bca10f88455e8ffa
        • MD5 SHA1 SHA512 TLSH

        Uzbext

        • Path /data/data/io.github.besmartapps.n001/databases/Uzbext
        • Size 1.3MB
        • SHA256 427cde339e30fc60cc4ba035d5658f6293903588dfe56d7723d886d8318ffdbb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        encFbaVdat

        • Path /data/data/io.github.besmartapps.n001/databases/encFbaVdat
        • Size 12KB
        • SHA256 a61c791a50d8fac7086098fcb263a50ea98609c66b6b2b7a40d2c0138ca06a19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iMxmdt

        • Path /data/data/io.github.besmartapps.n001/databases/iMxmdt
        • Size 8.8MB
        • SHA256 e36be0f3a4ffcef66110a9bf80135f70149751fb5bc54d5755fa2f88bd654a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xShnQ

        • Path /data/data/io.github.besmartapps.n001/databases/xShnQ
        • Size 16.9MB
        • SHA256 f295e1fc9e11a89ba2d375a7f9305290208f39b4d74d497b8a303f5351a2d543
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xShnQ

        • Path /data/data/io.github.besmartapps.n001/databases/xShnQ
        • Size 16.9MB
        • SHA256 fe03b3a4a291160aa490f1e87c82a9595ded2d38509fd847347942e5bbae1995
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xShnQ-journal

        • Path /data/data/io.github.besmartapps.n001/databases/xShnQ-journal
        • Size 4KB
        • SHA256 5086927a3746d3c55d69e59392c8eece98aa99142f4ad8568c2014c23da85ec0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xShnQ-journal

        • Path /data/data/io.github.besmartapps.n001/databases/xShnQ-journal
        • Size 8KB
        • SHA256 7eb11138b327bb3a4ede0a4619eddd30554bd86d5be11419c54fa88750355e22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/data/io.github.besmartapps.n001/oat/x86_64/[email protected]
        • Size 188B
        • SHA256 ef6b0075807059185c7a79ec4573d1af7297b94a994e4135717b4e7a5fd396a8
        • MD5 SHA1 SHA512 TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 1.4MB
        • SHA256 8a5ad5180fb6f5e357188b3c5e9c95436e70f9dccd4f07a03eb444c7646ffd37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 1.4MB
        • SHA256 ae38c1d4de3560441d90a85c5813ac9dbd4078fa27d43c0082e30b29ce20a4f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 1.6MB
        • SHA256 7ac163a27108c5c901993ab09ac08cd4d58cd1a1b945eee0cad83f1d36ee2f18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 2.0MB
        • SHA256 1207e76ae8e7f8c3a413730a50d3c3ab7f66413d23c79f0a9a212339bc99dde5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 998KB
        • SHA256 438a97d3c7dbd944b534b2d6680089efc71f4f813163fd307c7c80a999542e45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 1.6MB
        • SHA256 f74c1e261b59338f6ad84e692afa0bded37c161fb55b9a20dd3e0430772e213a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 8KB
        • SHA256 20b3fc59d3a9c0cabde16c180acf0bc6d1ff7cc0313ca55d5e5864a172bd7f66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 1.6MB
        • SHA256 b04534a2e87ca0dd0c311290cc4a5dab1958b887370efa06b50c6f2e6b21a6e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 3.6MB
        • SHA256 35c44016f50df0359fa50c4f398acf38e5054310b7ac702e7de741e963ab993d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 403KB
        • SHA256 d64398c44a8990c6185583d323e4ccdae765aef21f104c3ebc8eff79ce4d137b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 26KB
        • SHA256 8e924bd8f11b3e156abd8b2ad52bd830bd36d0186e27d4371b4fbd75f493f0df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 3.1MB
        • SHA256 b07caeb9b06ba0584687bf27f797b50b4fee200fca31325b06767aba27d517ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 3.3MB
        • SHA256 f4605af1b97381482768188e189c10bde98f8c9d4ef1d80ad4205e3bdb4e8b6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 180KB
        • SHA256 ef47172ebb8df8c9174663554691fc16df6e2469646f7079608e8d74a6c66100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 1.4MB
        • SHA256 68615a6efcef84164d4692876397587691fb4f2e94a9ceeda7ae415f81200444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 1.6MB
        • SHA256 d921656f83d8b90c3d63ce6a1db6f728fb907dd32c9a7d9d7ba0fc6a8e56c377
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/io.github.besmartapps.n001/[email protected]
        • Size 1.6MB
        • SHA256 5cbfdfd44fc8736ae7f7f402a936bc333ae634c6cc396b839c15ac89623e82ea
        • MD5 SHA1 SHA512 SSDEEP TLSH