d22d9a9147b8c5b78a60e0775993ad103b6674d2f8468b5b58fae1b23b1561a3

Resubmissions

15/07/2026, 03:52

260715-ee7tkadz2s

15/07/2026, 03:49

260715-ede26ady9s6

Analysis

max time kernel
6s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
15/07/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ducky.apk
Size 2.0MB
Sample260715-ede26ady9s
SHA256 d22d9a9147b8c5b78a60e0775993ad103b6674d2f8468b5b58fae1b23b1561a3
MD5 7de814bf9fe3c15f7594559baaed17ae
SHA1 ff5108a433148db17542f258904ee58694e4752e
SHA512 7f10adccadaa702023da49cbf819c26b1ea2de3b9b003f542feb6abd71e094cb49a9fa110685080585aa40b5a1d341917b309a8a5f6816eb0595a09729741253
SSDEEP 49152:Vpj2qDqCW+i8gHw03CdaP4gITAFoTwrkp8LC2p:VpurH7CWFoTwrkSeW
TLSH
T17CA57C87F718693FC87711F2496E523266574C078A839B83AD48361C29BB5D83F9DBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion persistence

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	io.nexus.drifter

io.nexus.drifter
1⤵
- Makes use of the framework's foreground persistence service
PID:5090

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libcyn.so

Path /data/data/io.nexus.drifter/files/libcyn.so
Size 71KB
SHA256 577a330a1a0b95f01463160419e118ca690b025b24c8ddb71084b65eaaf6f773
MD5 0cd1d46581dfb2ca0bdc657e3a06fe44
SHA1 bbee07cc83bf75ab53ae97597b8eafbdb6bfda66
SHA512 42b3b508f41089741b4a2bb50000565a196106851715ba610069cb0d91e34ade2c4562e8c07915d0cf7c435f2dd4c7a8386840431b24c7fe44f2320b0e229a9a
SSDEEP 1536:iSnm1FIisAWAKI0FJ4YFJwryUh0llr9i1XP0iLk05:qki7WomJ4YFJwrKSXPHLl
TLSH
T1A0632A4AFD81AB01E5D522BAFE5E5149335307ACE3EA7112BE105B2D67CBD1B0F3A412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/io.nexus.drifter/files/profileInstalled
Size 24B
SHA256 6dbc7768b2e2fb4e4f5ad558370640ca7229ce2f25efce3e7679ab80b9a66c79
MD5 7d82e5258c1ca3e4541b29ba63c9320f
SHA1 fc790adee35e4bdddbb374dfa8b8febff2e3f4c7
SHA512 9c0fbedc121974cee06cc73522f5e5085be922217607b60348e56a4cb03eb8620669aed6579ec548cb1eb73f576f33dfb78b51454f1a735ce50d6fb359875130
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/io.nexus.drifter/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 8aa8c5c64f6e1726c1f1d6eb818421952d05a0b542c339020d1d63491aa01c43
MD5 0f1c51473c1f405e2982a0920876e15e
SHA1 492db28c0d8c7a827663325b4792c58080a05383
SHA512 171cebb0b3067991614ce8e6e9eaa4aef1d194a6b7a0520af1418033dc7012837639449aad7f4219977df52b5c3e688ee3025f6da853274d2cf023137a989b70
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/io.nexus.drifter/primary.prof
Size 1KB
SHA256 bb3a857b45e123204f9129721300ec9467f77fd1e7ff5f667ea0a96283d1dbed
MD5 d07ef0334be50d1882f07194ad5d3850
SHA1 850da8f9ef677c114bc0dfcdca61243bdf0c3add
SHA512 992160ef547355e9c0599a4e6138872f9934a09f2af7e96eb99d9a64a72c7573af05e47e2f463244cf91b3c409c5537badb7bba4e8e2bc079c49c4dca5d5b73a
TLSH
T1AF21C64FCA9875F0EC4EE00184245A124664D7D2DD20A3DC35AC1ECB2532F6F82A1933
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads