d2b4b5656390754d00f921fa581c51a19680de32ab17b9333de2333590b1663b

Analysis

max time kernel
63s
max time network
153s
platform
android-13_x64
resource
android-33-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
submitted
05/07/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
muah-ai-2-0.apk
Size 6.6MB
Sample260705-wamfhaev9w
SHA256 d2b4b5656390754d00f921fa581c51a19680de32ab17b9333de2333590b1663b
MD5 9d7bae3368389bc06d8e05bb33725fa2
SHA1 0bb133c1bd424319a9d79e6256702b589399187a
SHA512 81a35067cadc72749c3a5758402f7a83b24d93c752e1b59aaf3ff534a1e91edec4f2ce283366e0e2fd008cf4fe022de06ab143a08e157b851a02cc7cf153b6b0
SSDEEP 98304:NupgCGwohGgNaIWo/r25qpGAGvgqwQJRQWemo5Kr8DKZoXpiWmaeg6b2ZrGr7:UGwoKIWEppGAogUJGm9rWKZX9avq7
TLSH
T185660196F758A92FCC7390324D6A2232555B4CD68E83E7477904370C68BBAD44F9ABCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery evasion execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	webviewgold.muahaiproject
/system/bin/su	webviewgold.muahaiproject
/data/local/xbin/su	webviewgold.muahaiproject
/system/sd/xbin/su	webviewgold.muahaiproject
/data/local/su	webviewgold.muahaiproject
/system/app/Superuser.apk	webviewgold.muahaiproject
/system/xbin/su	webviewgold.muahaiproject
/data/local/bin/su	webviewgold.muahaiproject
/system/bin/failsafe/su	webviewgold.muahaiproject

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/webviewgold.muahaiproject/files/audience_network.dex	4243	webviewgold.muahaiproject

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	webviewgold.muahaiproject

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	webviewgold.muahaiproject

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	webviewgold.muahaiproject

webviewgold.muahaiproject
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4243

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db

Path /data/data/webviewgold.muahaiproject/databases/OneSignal.db
Size 52KB
SHA256 8413c63e50eefd69ccafc07a38585e7c4827fa7c978b3e21d06104cd5ea5f97a
MD5 c524dee8e5034f1e190b36d65b4b0969
SHA1 3559430ef8ae60e46091c23098e92f4e06c4a96b
SHA512 19938804f8540f9fc7f4f057fa1b2fee8591d8272019aef523f3ff8efd362951b9c2d78e9d282059e2191d219e2b5d983b9b07fd641b745f45d7f1f1271cbb57
SSDEEP 24:TLLS2CrUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvFqrEqjUi7+xGTrOPjwV+HR:TjCrQcrA0oJtqracrObMoOS
TLSH
T126337ADF4B862191EFC765B3155392E48E37610E8C9317A62BF760245E83B16D723C6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/webviewgold.muahaiproject/databases/OneSignal.db-journal
Size 8KB
SHA256 6b5b2f8009c5ee09d0fc030768be28064963ae5a244033dfe0e62e79e1133d40
MD5 d71fdd1cf4d2c284777785e4693f18db
SHA1 4cf8e03dd63291d6b1dcb47e1963cf05d39bcb61
SHA512 f592099cbf0f03f1d7a9039f56b44bba71e926fde4d705d3409e848e57fcfd3038865ff80af4bb93634b15ea3dcc256e27b57c9aef044e78b6c3fada243caa3c
SSDEEP 6:7+/l9vrn1wfg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuK0w:7+tNqfqLiuWd7RmBEyPbS
TLSH
T1AA02C0BC63800813C81D5677D0F483400D00E7188272CB17199109943C077CCE8E8D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/webviewgold.muahaiproject/databases/OneSignal.db-journal
Size 8KB
SHA256 9ebdffaf329d68ba3b740868ebb4075ef809e14076bc7ed86b084c39f95626f9
MD5 fe3f17835bd65a94b220dab4732cfb46
SHA1 37ca7753abf79cd687095e3cfe2c24bfeb32523b
SHA512 10a59b24022d308c8b1922f56d3bb770154885271c040c09165ab93af9f6e71eb8d4417295bd7dcfad28392c160ec97046225da8861a718edc34744df02c0bcc
SSDEEP 6:7+/l9KLzPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKQ0//II:7+tA3qLJdKBRmBEyPbiII
TLSH
T102021299AF420913C61A57B7D0D983541F11A729C373CF57555018546C4A7CCB9B0D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/webviewgold.muahaiproject/databases/OneSignal.db-journal
Size 512B
SHA256 38895c194aafd338d1b597d28b5a24fa1d625ec2b2c0034353c1cbd55be7b7c5
MD5 98c8c806b0fca08b4a279ec380283e75
SHA1 26837abf3e3749c40b8ecdc084d973df688f00c3
SHA512 b9beeeaf34e2d0d32485a5dd9b34c9c5ab1d65639bdd687c3abef373ccec07e66a8d4487d05c730d43fdf3e043d9dd91142cdacecd1ce56316afcfbaa5123acc
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events

Path /data/data/webviewgold.muahaiproject/databases/com.google.android.datatransport.events
Size 56KB
SHA256 78ebc8309cde9de2096a5d436cd57d1cf456bf7464a2fe0cbd00e08defd67e24
MD5 c020e25d48b0763daee9dd543b8b5124
SHA1 1a3bb1d6b13cf3bc0ab7c7bdd08678a866cc13a3
SHA512 1eccc3163dd918f486e8737ede6f3c46508f404cf52a2a16fe650a5b6e875da4576bd60c915473f95e5f5fe52582e8af85ac53f0f8351f905caa66818c4862f5
SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSTo:RMEX0wIyNjaTo
TLSH
T1E943639D1E3C2221C57E283ED3E143635B7C93DF5723926239908CFA8DC206974354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/webviewgold.muahaiproject/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 86b82f6bc330261593ff33643e22e28228d0e385666d9ce161350a9d77e6936f
MD5 1b0ee22e28cc7bd065368c0624f42476
SHA1 e89c223a0f1950fc5b428e3a6516b5c9add5c7e6
SHA512 f866b1ea455cb87be5d8ee1933f21bccf3e59dfe87f661af1d0ba33ca66b98a6c1edbc0ad5ea38a4b057bb5c162a5b1bf849ed98116a1df8691dc4df8703dcee
SSDEEP 6:7+/l9DFn1ig9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKz:7+tkqLiuWd7RmBEyPbM
TLSH
T1DA02229863801823C8199E7790E6C3400E00A71C8262CB07299008942D07ACCF4A0D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/webviewgold.muahaiproject/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 2da2519071d0fc51d5a9ed255d5195b0c0f6452941da229f57fc5fc7806114a5
MD5 0fce4909152fdb0cb8f9b13101cd2b17
SHA1 34dc5dd2c0c2c282aa3c4608087a41311a4dc6dc
SHA512 fd4d52d20765c82ffa76f2e346da008b153e635d4747bc70d349ff88deea15d9e9e4458f12624e7d30c7358b7d4a611b9175680e94d5d63600e47988de10fbac
SSDEEP 6:7+/l960Pg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuK2//4:7+twcqLJdKBRmBEyPbHX4
TLSH
T1FE02228873440903C019E77790E883601E94BB168323CB0B0B900A643C826CCA8A1D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/webviewgold.muahaiproject/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 5cc4139d9fb5438d3934d988f0cbf5968116437f521b20156f43bb621546f076
MD5 ca53539d5b6461f7f86fb8787a091dbb
SHA1 9f66842e48ab9df1fae88aad83492edea9ce7d4b
SHA512 145c5c7b856ded8c528de044d5f93837dd9998cbe1ba4c1a57d6cb7788c003a87fe8764e5fcd154f8c16364e031da6375593226c1d73820c80d5eb4b8ffc3ac2
MD5 SHA1 SHA512

Submit Download

PersistedInstallation1390451223877116191tmp

Path /data/data/webviewgold.muahaiproject/files/PersistedInstallation1390451223877116191tmp
Size 569B
SHA256 a760b94f881574ae8220e9d5d02ca947c8c1526b40e8c0ea6719ccf1dcccaa3f
MD5 2e8fa4f566fd58f63a3b6e44437a3d7f
SHA1 00aa49f310b8365b84d9a2310ab4db451eae561f
SHA512 d689ce6d278035a6346393de86861492ac4c6e79a8f348de0190fae54566aeb5fee40513e0c7766111b44d3a410c37f13beeb1ed06a95640b554a91c368a1b71
TLSH
T1E6F0414202A1092DE04EAB8A1489F8048C4D1CA802860AB9AA88C4F262A07BE7386A44
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation3280715719526706997tmp

Path /data/data/webviewgold.muahaiproject/files/PersistedInstallation3280715719526706997tmp
Size 90B
SHA256 c75f7cb6e93dc42f222183c6d8b33b987e8be635a546580c6ea568eedfc072dd
MD5 55b2697a68efa6de421956784b192a38
SHA1 08bacdea1808fbc12d830b8294427fd0626c51e8
SHA512 a7f016793861902d319f75d71ab5d49bec1ee7dce8eb194b91cdbb3ff2f1a3f097547a5beee7a8f4bc750e5f70c932907b9cde22f98beb9fa751c8af1136df26
TLSH
T1B4B0124656308142C499B2032C4CE2802F811481040A8B6C4B08E05182832D0F2039BC
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation6594806999190847458tmp

Path /data/data/webviewgold.muahaiproject/files/PersistedInstallation6594806999190847458tmp
Size 569B
SHA256 a6f813697fcb360b07d2e973ef678fb8154c9b53e3f48ecc9a8ff08ebba0a898
MD5 1abedce20bf09f08490573050b19b238
SHA1 6a1f1333fe350f105849ca340a092345ed3dc9b8
SHA512 3cb82cd00d921bda2b31099d88fb7b366bd74b0d18a7629ca7838a5b696be327f511bbade5dd80f35c9e38d88387a532c62a585e7b1f2ff4c65e9662a349b852
TLSH
T175F0414037608915CDA2B9C71C5ADE99AC1088F1248946FE29CD8AF4824A715F0870A0
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation7324715568625773132tmp

Path /data/data/webviewgold.muahaiproject/files/PersistedInstallation7324715568625773132tmp
Size 90B
SHA256 1370cbb084b51bb1740794e920771f40cf6030f996fc2b08f3fbdbd5eac16f52
MD5 2e08c23ef6fe4aebb455b97326a1f193
SHA1 9ae3c848c0f8d074c160ae34183ffb388f3c81e6
SHA512 05517ba343e55c11caea0889f898d86208d42a74b64e8d0f6edde22b574f10825c89a1f47499dc99e25b2defd989e7ffd2cbb556b725fc0f4f39a1a1a96ab465
TLSH
T151B012454AB383D5849DF3022C4CD1007D40188004498F194E08D08040812F48243DF8
MD5 SHA1 SHA512 TLSH

Submit Download

audience_network.dex

Path /data/data/webviewgold.muahaiproject/files/audience_network.dex
Size 3.1MB
SHA256 3aedaba6f25a7fd04b16f68bb7ca12f71c5a464346556cbce78ebdb490df0362
MD5 d8a79a805f183fb920f9d9675d1179f6
SHA1 14aee4b270afd3e28540a06dd735137f61cdacba
SHA512 9aabd947827fd6bc9bd6ecbf7a9a30996ff5d4df6739f2f12d6a9ba13cd71a19b08eebe4f9e6226b73790bf62edce6e4ab15c875a6a68d83fdb0ab836fad13ae
SSDEEP 49152:k0UjOKYWt7TvAX+CR0piZnjwldINTQgwQ2VAHET:5KSB0ynj98gwbVL
TLSH
T10BE57C19EE512B12DE9C8ABEADEF03027B3A6D44D65357132254E270EC9B0E21FC67D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audience_network.vdex

Path /data/data/webviewgold.muahaiproject/files/oat/x86_64/audience_network.vdex
Size 58KB
SHA256 9e09a8e0e3545751334c1cfcfcf048bcad5589a8a0b119f5cda28a21a9de476e
MD5 64cf83727e2a51e5094781d5e9eab9b3
SHA1 f1b9634f9292505c2078dcce6f76575e53d2eb46
SHA512 b2630b90069851a1616fb8cd15556da820d8625bcc76d4ad0fd4206e2df8efc1dfe82edb4175406236fbf20d8524d86e6ae06850acea38d9cfaf3739e994572a
SSDEEP 1536:g556fOGmTtskGvF11v755cr8cHa0oTapwnMe:gy2GhkGvF11TPcr8YabTmcM
TLSH
T1AF435B2FAD6A25AEF53058BA852668DDAE82E057F8B2149CCD71199FCC3F3C01CE14D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/webviewgold.muahaiproject/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
TLSH
T183810250534000E1D05446B354E113080F06D19496428B03550100428C415440C60E88
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/webviewgold.muahaiproject/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 75c16f996c3569db054ac56e6ab0e46a3ededeb44169fc045c03c8bbabd0d482
MD5 7b107331be35bf518e27dde21f841904
SHA1 d9fc295af4438872953ad8903109b82e9d6175c8
SHA512 76e3a3400f57ac9c6f31e6a7ed396951aac537bca9679ca49f8f27f5daa48852cfd96ba5db3c036e7630e1389750e684527f35c3aa430f6276b041712c325c24
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/webviewgold.muahaiproject/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/webviewgold.muahaiproject/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 8fd5bfadddbf856add5858c5e78477136f457c72736bfc01fe1165f70ecb345d
MD5 affcbf1170da34858c2b1f73a5e3cf88
SHA1 c93f490723530480f0cef09f2d78d342a3f004ca
SHA512 c3ca468da44da01337292ae59e6bee4936a568768d38d2ad5684986218385b901d1fef9f85b0c83ec613effc6e72e144a2f3238ae0b8abf20b263fb4fcc61423
SSDEEP 6:KuqwDwgz9FZdKEAlOERX4PBX4ogLugMBX4suuK+/0tsM/qeDiOw2:KuASzdKBRmBEyPbP/0GMidOw2
TLSH
T1AE72C254F7800B12C6280F7AA0C593402D28B31D6F53C70B8E50242B3C0178DA3A5E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/webviewgold.muahaiproject/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 3735f0f6696c692c6f4d961f94ae4e06b49376bcac5b8b73c6296962be48e786
MD5 11885e204d4cc87f449ff4f2b6e0d34c
SHA1 853327ee9873c92da07ceea869c9e0a709194b26
SHA512 b19d4a1061e649eb2f18b8a043ff58ed350450425858fd416ab314d20db2bf702120054836b30c2762d7490c3c54f6ce62b50db3ce8e7a576c4578e53e8d4131
SSDEEP 96:CxyPWiDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:CxyPnndjnHt9S/f8JzSV+6D86T0ED
TLSH
T19EB3318D1F192500C4B958B0A6D00FF1793E522EE793F3D269915076BDC2922DF25CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/webviewgold.muahaiproject/no_backup/androidx.work.workdb-wal
Size 177KB
SHA256 88e9fe710209f3eb8ccb708d31b14c542d608c4f9734dff0252c68385301832c
MD5 17fde2e6e4f644a13157dabffd769797
SHA1 16fa791bad83628e61f70c92442db7b1703eb4cf
SHA512 95257314249b7424aa861eda9b7fa7d50abcc493901e60c84d28e3fe3715ff1d6fcdc88eb7b7bafe3facfd78004f5d72c491e764c3423339757b9af1c4525125
SSDEEP 48:+NDg1DtYaAlIFD5em2D5atzPlSAoNDg1DtYnDsUunQ:wM1DtYIFIzKVWM1DtYDn
TLSH
T15504ABC67776E146D63F473452CBA1A043BC2B5EC9DD2F4D97DAAE822EA30035F28250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads