5f0e553d2747ec93c58b885e305b78d0d25d9ee2d033998c4915364d1957b793

Resubmissions

08/07/2026, 17:22

260708-vxwr1sew2110

08/07/2026, 17:19

260708-vvwdgadt4p10

08/07/2026, 17:18

260708-vvjpnsdt4j10

Analysis

user interaction
yes
max time kernel
171s
max time network
167s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
08/07/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.apk
Size 760KB
Sample260708-vxwr1sew21
SHA256 5f0e553d2747ec93c58b885e305b78d0d25d9ee2d033998c4915364d1957b793
MD5 a286f0f0065ebe3775e929d857a8f490
SHA1 93a71bb0e38f792f40478453b5472c470bf34707
SHA512 e7d8a496ba34f654551a164a0a6144895c0e0e2d85882f9b4e88a797feb8780fa00e82f399600a80b8c51466af0e83891f25f33f29b7f880aa81f1400e4b9c5f
SSDEEP 12288:B7VW8ya1a8LdeLXH7nYQi5WmpYshXZPbGwidNpgMzR:B7ea1a6eLLnYQi5WmD9idNpP1
TLSH
T1B7F45C86FB59B867CAF3C7364675C66BD6064C544B43DB431A85723C09BBAC08B4AFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

banker defense_evasion discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4725	cmf0.c3b5bm90zq.patch

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	cmf0.c3b5bm90zq.patch

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
PID:4725

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

config08-07-2026.log

Path /storage/emulated/0/com.Jpx3.playserviceshelp/config08-07-2026.log
Size 39B
SHA256 dc315c7faf1df7a2116fc9c9ce659492d28a865afbedf5a50d506c1dc9f2ff01
MD5 4af6921def29c533100754dd93510513
SHA1 ff4f10439024ff270103a0666f2bcc655cd059e5
SHA512 7df0bde1f08aad7022f92d241adaae7700f91ab2f90a14cae6e0b1611416fb46237b814ab679bf739776ca559217c0fa8a2beec95394b999d8356045b46cdd14
MD5 SHA1 SHA512

Submit Download

config08-07-2026.log

Path /storage/emulated/0/com.Jpx3.playserviceshelp/config08-07-2026.log
Size 1KB
SHA256 b2c69f094e12ce227209e3a64144df53b22a84638e14b4eb8b9efddcb14cfd71
MD5 0d6229d353b65b70d69531eb000ab95b
SHA1 4171ef166355516cd02c2f168260e02ae7dd0286
SHA512 bcef14ffcce09410b0d64e4585e6e82b01d236b437c75d387bbfba72f6cd84d9438dd01b2f52ffd562dae2190906f96f9dd9788eb505a82c6a6bf27a11bd8a70
TLSH
T10221FB2C01B60BD8720D81CE8BF54F4C4C1F66C376173DCC82D49617659D5EA1B759B5
MD5 SHA1 SHA512 TLSH

Submit Download

config08-07-2026.log

Path /storage/emulated/0/com.Jpx3.playserviceshelp/config08-07-2026.log
Size 1KB
SHA256 334bd498cacc80338476fcf502b824f1f6e66aa3f2d45f84a683d65bd839b757
MD5 0c4197fd1501dd7e5b397ded3ec9995e
SHA1 81df88ff8f1d502be27a80260c1b9d040d7860ac
SHA512 b6c0a140064b9079653d3c8f5f5a88d6faec154cc47f7130102c99d114217c715bfe55d60b97c0ba430bcbd2ea738b7ca809c6337fda725c0acf582bee65943b
TLSH
T11021FB1C01B60BD8310D85CD4BF58F4C4C1F56C3B5173DCC82D49517659D5EA1B759B5
MD5 SHA1 SHA512 TLSH

Submit Download

config08-07-2026.log

Path /storage/emulated/0/com.Jpx3.playserviceshelp/config08-07-2026.log
Size 1KB
SHA256 5c72e96b3475b3f2fb1324a686b25f1c344efdf9cabbfe38ff5c3115f1af13a3
MD5 6134e0ae4985d580ec71b2093e2ba395
SHA1 ffd96801fc2fb7e6fe81d9a2d506789e08454daa
SHA512 24e5ab76f4c5a9fc9bc01b33803b27dfc04f42f66a1150d6a3f4637740d507fd7f97c5efd6b07d53a5854a3b258568063329ee1ff18b845b95748962fc44eaa1
TLSH
T11D21082801B60AD8320E81CE8AF14F4C4C1F5AC3B9173DCC8694A617799E5EB1B759B5
MD5 SHA1 SHA512 TLSH

Submit Download

config08-07-2026.log

Path /storage/emulated/0/com.Jpx3.playserviceshelp/config08-07-2026.log
Size 1KB
SHA256 2e76d05ef962ef3ab7b06864f814281bee2da09fceff62984bb5f612237ac745
MD5 6b6d71b1497b564be12e20a8cb82f89f
SHA1 f5aa1e1891d9ae8a07fcdfce9bd86c0ebfe3267b
SHA512 683d3970b663972ff1c8437b4269e1c58982f72084db2b05bdb08dbdebf857df69d81ca68ad3961a681ca854a49e85ac33dbf994f2a801779ec8aee55444c423
TLSH
T15821E62C01B20BD8310A80DA87E08F5C4C1F56C374137DC846889A177A9D5AB1B759B2
MD5 SHA1 SHA512 TLSH

Submit Download

config08-07-2026.log

Path /storage/emulated/0/com.Jpx3.playserviceshelp/config08-07-2026.log
Size 1KB
SHA256 4a0f196404b7dd09523b9cc3380634bdad092a743c04f6953bf590394279da60
MD5 399fe1c23c7ec6a41e28a3788f0665fc
SHA1 496e7c7087c63508d2849c8a435b1760f7a70fff
SHA512 1e8ec482dc90fe43a73e4b7bbe26d631bccc92f151fa78f14047cc86fa31c23153aaa68ad658736bd57f3f16f29297c950f65d3c4eab07e417351c7b45926d9f
TLSH
T19B310921A5387D7CC08B97801A2A0F80FEA0B5D1034620BEF3C7CA6A301B3E3190C060
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads