5f0e553d2747ec93c58b885e305b78d0d25d9ee2d033998c4915364d1957b793

Resubmissions

08/07/2026, 17:22

260708-vxwr1sew2110

08/07/2026, 17:19

260708-vvwdgadt4p10

08/07/2026, 17:18

260708-vvjpnsdt4j10

Analysis

user interaction
yes
max time kernel
101s
max time network
103s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
08/07/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.apk
Size 760KB
Sample260708-vxwr1sew21
SHA256 5f0e553d2747ec93c58b885e305b78d0d25d9ee2d033998c4915364d1957b793
MD5 a286f0f0065ebe3775e929d857a8f490
SHA1 93a71bb0e38f792f40478453b5472c470bf34707
SHA512 e7d8a496ba34f654551a164a0a6144895c0e0e2d85882f9b4e88a797feb8780fa00e82f399600a80b8c51466af0e83891f25f33f29b7f880aa81f1400e4b9c5f
SSDEEP 12288:B7VW8ya1a8LdeLXH7nYQi5WmpYshXZPbGwidNpgMzR:B7ea1a6eLLnYQi5WmD9idNpP1
TLSH
T1B7F45C86FB59B867CAF3C7364675C66BD6064C544B43DB431A85723C09BBAC08B4AFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

banker defense_evasion discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5029	cmf0.c3b5bm90zq.patch

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5029
- su
  2⤵
  PID:5064
- su
  2⤵
  PID:5157
- su
  2⤵
  PID:5290

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config08-07-2026.log

Path /storage/emulated/0/com.Jpx3.playserviceshelp/config08-07-2026.log
Size 1KB
SHA256 808b5551e21851fc0dc17c4778a72f58231153b59ee1b25b95cfad4cf713027d
MD5 9ddeb476ac34aae38bf154899aefccb6
SHA1 94e8707a996a31042efe1636ba523004b3455ab0
SHA512 83c882fc1ae2874fae14b4f4fda3580bc67224309da33c96907a734436d17b046f79f3f3a3085ef268827c341ebd870c65dbbf260b48d26615d1cefd488742b6
TLSH
T17F21FB1C01B60BD8310985CD4AB54F4C0C1F56C3B5173DCC42D49517759D5EA1B759B5
MD5 SHA1 SHA512 TLSH

Submit Download

config08-07-2026.log

Path /storage/emulated/0/com.Jpx3.playserviceshelp/config08-07-2026.log
Size 1KB
SHA256 38f925eac8dd338a209a55d626560827594030ba7463353701367b6c68893d8a
MD5 7ad0b950268197f9c2aba756fcaf715e
SHA1 f11026e7ac3660c8a6dd76aa0501c4e54f52eabf
SHA512 de94737ece99c377fbd1474991cb14e7c5a465ad12c3101db34991d841977d32ce62b043fc1011896519e8593dcaf3b8496e9f92ff5077eda353268fce54c68c
TLSH
T1C821FB2C05760AD8711981DD46A14F8C4C1B56C375133CC841849517755E5E61B75AB5
MD5 SHA1 SHA512 TLSH

Submit Download

config08-07-2026.log

Path /storage/emulated/0/com.Jpx3.playserviceshelp/config08-07-2026.log
Size 1KB
SHA256 3cdeb324d3ee80a9a4d09934e77c0466699dc2874ddc9b95f7b260d6cd533c6a
MD5 4970d16e619d7bc030f0749be33f3b27
SHA1 4099052dacf09b343264f3d916224eca172fd7a4
SHA512 4404ac41c1ee667b4806a06ba7359be4ca3d67419dc87504341d2b42b55229bcd88b6c9905683f4f66c7c84a6029028dac4a2f7645226300f33c587368d635fc
TLSH
T12321FB1C02760AD8310981CD46A14F4C0C1F5AC379133DCC4184A617655E5EA1B359B6
MD5 SHA1 SHA512 TLSH

Submit Download

config08-07-2026.log

Path /storage/emulated/0/com.Jpx3.playserviceshelp/config08-07-2026.log
Size 1KB
SHA256 b28d807ed0fc44dba7d223f8ef53be4bc83306158bdffd34d55e44e0f944d35d
MD5 71f9e7087926f504c6af0ef7956c322b
SHA1 3bd79d824abf4186bdbdb1a20d6710df34175168
SHA512 80ab73152b36c1d7a8faccd986ce7c933448700177c526ebb44421311d2abd4688caa07b6586964206f5294739c28edba1ee59590cc727feb44702505d0c2432
TLSH
T161210862223F1D0396990C13E972BD569F62C962D0284CF65732EE010B3048048A0E4F
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads