General
- Target Service Update.apk
- Size 1.1MB
- Sample260708-dl8trsh14s
- SHA256 aaaa89488caf328bea8e56fa95cae69124a561ec97594b686c93cfdd24f13e96
- MD5 01e909a65bc736be3c5fa49ca16c4cf8
- SHA1 6af4ef79c4f733167f67d7d8e6dd77b174feb2fa
- SHA512 ca354c69acc83bad4389287089fc1829ff5c1fa0bb46ebaaf13770a06417d9fab0c23655c36e5780a970df01ed4ddebb348e449f34de3744c362206452887cc2
- SSDEEP 24576:kjmOO/9iY58t2CGr0ffGAotwuMgxBETxSC6EBUlh:kdOViAPvr0WAotwuVxBvC6c+
- TLSH T11A35331B2E380A1EF2D5587DA07BA54DDF3F4120A8694C8DD93CE2A85D5074A3CB85BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
5 signatures
Behavioral task
behavioral1
Sample
Service Update.apk
Resource
android-x64-20260325-en
7 signatures
60 seconds
Behavioral task
behavioral2
Sample
Service Update.apk
Resource
android-x64-arm64-20260325-en
8 signatures
60 seconds
Behavioral task
behavioral3
Sample
Service Update.apk
Resource
android-33-x64-arm64-20260325-en
1 signatures
60 seconds
Behavioral task
behavioral4
Sample
Service Update.apk
Resource
android-34-x64-arm64-20260325.1-en
0 signatures
60 seconds
Behavioral task
behavioral5
Sample
Service Update.apk
Resource
android-35-x64-arm64-20260325-en
0 signatures
60 seconds
Behavioral task
behavioral6
Sample
Service Update.apk
Resource
android-x86-arm-20260325-en
7 signatures
60 seconds
Malware Config
Targets
-
- Target Service Update.apk
- Size 1.1MB
- SHA256 aaaa89488caf328bea8e56fa95cae69124a561ec97594b686c93cfdd24f13e96
- MD5 01e909a65bc736be3c5fa49ca16c4cf8
- SHA1 6af4ef79c4f733167f67d7d8e6dd77b174feb2fa
- SHA512 ca354c69acc83bad4389287089fc1829ff5c1fa0bb46ebaaf13770a06417d9fab0c23655c36e5780a970df01ed4ddebb348e449f34de3744c362206452887cc2
- SSDEEP 24576:kjmOO/9iY58t2CGr0ffGAotwuMgxBETxSC6EBUlh:kdOViAPvr0WAotwuVxBvC6c+
- TLSH T11A35331B2E380A1EF2D5587DA07BA54DDF3F4120A8694C8DD93CE2A85D5074A3CB85BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Checks if the Android device is rooted.
-
Acquires the wake lock
-
Declares broadcast receivers with permission to handle system events
-
Declares services with permission to bind to the system
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests dangerous framework permissions