c2af1fe36cd063a7942c5fe8a53bc5ecd2b31cf86ca649de27e99601396fd399

Resubmissions

15/07/2026, 04:08

260715-eqnvtsbs8p7

15/07/2026, 03:52

260715-ee8qvsdz2t6

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
android-13_x64
resource
android-33-x64-arm64-20260708-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
submitted
15/07/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c2af1fe36cd063a7942c5fe8a53bc5ecd2b31cf86ca649de27e99601396fd399.apk
Size 33.5MB
Sample260715-eqnvtsbs8p
SHA256 c2af1fe36cd063a7942c5fe8a53bc5ecd2b31cf86ca649de27e99601396fd399
MD5 c46b51b375ead1e46f2ceea640e34a15
SHA1 d7d05e0a7d4cccd98fd13fb5b22ca4b4c288662b
SHA512 1d507a402257f6a6852d8134bd975a74f3982c67e30f5630083c39e91629f3ed5f7726170720997809ae3898c812f1935e3f870e024b4b60a409b8eb5cf4ca6c
SSDEEP 786432:cNJGbWWDy34eRkTic3A9gFKJTKL5ciyk/MfA84j:JKN4ekTa+CKVciAY84j
TLSH
T1EC7733E1F3A6996FE8729132095243E817056D41C60AA7CFF094331D78B36E84E79BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion evasion impact

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 1 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

defense_evasion

System Checks

T1633.001

ioc	Process
/dev/qemu_pipe	com.android.jlsa.arionf

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.extensions.jar	4188	com.android.jlsa.arionf
/system_ext/framework/androidx.window.extensions.jar	4188	com.android.jlsa.arionf
/system_ext/framework/androidx.window.sidecar.jar	4188	com.android.jlsa.arionf
/system_ext/framework/androidx.window.sidecar.jar	4188	com.android.jlsa.arionf

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.android.jlsa.arionf

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.jlsa.arionf

com.android.jlsa.arionf
1⤵
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4188

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/com.android.jlsa.arionf/files/profileInstalled
Size 24B
SHA256 56eabe08000606ec6b36bd734436b1cfa71cf3f9f3a9bd4a5b481fdb0bc94963
MD5 0b8991c8b458b4e883d291a556b4358f
SHA1 7adee57b172d2151818dab1936f8f2ef5006a14b
SHA512 64826ff052a3863c4085bd9830ce442739851625e87d78433b939f1f4186cc9793c3b3e36eae6ce68f1c7bb29f3692ebc8d8b8f511e59a9711c173514390570a
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.android.jlsa.arionf/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 3a08fbd2eba608258a71304c61205a00f0616b2ac207aae6af05902be3d8a771
MD5 0406153c3fc373af164690024b3f6fb6
SHA1 134412818740c3a62af27e4aa8ed0d1fd2869865
SHA512 e00f39db40ac9f6bd079833c09329d6b0b5eed8aae1b548bda39052903fec80f84326370de575e28b348c661732f7b79d8890a2466afac8f60174b3b01b951ec
MD5 SHA1 SHA512

Submit Download

FlutterSharedPreferences.xml

Path /data/data/com.android.jlsa.arionf/shared_prefs/FlutterSharedPreferences.xml
Size 875B
SHA256 344671c44fc33e73c389233446e0d70c589d12b4982ca2e8380b32b6d69c73bb
MD5 c4ee59ebe941d11bbf41dbe0607b751c
SHA1 4c0cc2f4ff0f14eb5e4fd53cf4c05484f5d7504c
SHA512 3f65bb81ebfa9669477da0d78d6e2487d850de0effcaed94922af8a581875764cfbb20e81ebf6b888c2c34acdc14fdc179cdcf9fe6dcd22f958647e4663684e8
TLSH
T1401123D426E8CDCE3C8A4A3BA899711D19CD353EE91738ECF2CE76504758040166F826
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.android.jlsa.arionf/primary.prof
Size 1KB
SHA256 bf3a3ad958e9beaf74916ab98a5c55dfad5b41a39a5f6dcb68cc276ea57a6808
MD5 a804d815024134fc8aff827b1ea4f6eb
SHA1 27410f997bd6758e557935c7bec3bf698424d6ee
SHA512 c69ba76e136494778ed31646e0a07e49a6c1672f9ea6fca237164481a56175c071beca1f9584eac5a13f2fd141522037d86380894867d21a014b409f25a8376a
TLSH
T10F31D742D7B17FD4C6EF313F0CF5608017E9D12C879AE09D55268638588DDA1285B353
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.android.jlsa.arionf/primary.prof
Size 4KB
SHA256 95457b3d29e4ad3fe33ebe1564c4f875cd833cace2775ffc0ec5db5a9bb40442
MD5 c142519ebed376b0a31867a35ef2d7a9
SHA1 826e860bbe8f468ce56f0f94650c5bb428c5e1ed
SHA512 2c8f8b1fc6d4d23feec3d30f5af00340c9476251974f936457493d416c2e82627e7e7c836ad5c2354bcb5f38da08e6c91972640a74e9bb72c8bbd68b49698402
SSDEEP 96:/yGHu4ACYzNBS2iKGxuoTbfoeNtConbk8WjO5iKYN:/yGHqzpiTTbAeN9nGq5iKYN
TLSH
T1ADA18D1356CA1409D6B87FAB1A277BC355E94942D017C62F0903BAF81324CF36D971C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.extensions.jar

Path /system_ext/framework/androidx.window.extensions.jar
Size 123KB
SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
MD5 3056e1bdb7d4e19789d0319eff484bd0
SHA1 6791ae47aa9466fe0bca27ad6643f846853bbee4
SHA512 c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658
SSDEEP 3072:8Pmsa8v0v8FYNMhpjLXZ/pziNQdysk4p26PQ:Qmsa8vXhRLXXOQGJ
TLSH
T19DC31951FA4159A1DEAE933B959B1301AB30A648AB2383137654D0BCFCD73C39F87AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 25KB
SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
MD5 29469324e59dfcc052f24b5af4e7b2c4
SHA1 10c1e17ac6f598037bb51baa07945663645de4eb
SHA512 5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2
SSDEEP 768:bjydnTmp8WNAupUuvkg5NrtsESOMXIpc3dRwQA0:bjydCpF0uhtsxOQIqdSj0
TLSH
T1A5C2F716E7400C63E9FF9A3B6A5B13009F35E3A4AA43471B640585A4BDC63D3D9EE7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

socket:[55890]

Path socket:[55890]
Size 46B
SHA256 57213b922a326a3b53f5cf0c2929833680e9416cf9caba95b419a026627194cf
MD5 e22f4b0cc2a4d327757f530e83f6ea93
SHA1 d0e7a7b121c04617402e304c66e3a2dcfec815b6
SHA512 d9d5a80cd411849017cf57178ee92b306c54a744b7fb5e6e1ca6eb3e026e277e86197dee90d264ec3b3adb050af994708a441a3d9a66720de7f4ddafedd972f3
MD5 SHA1 SHA512

Submit Download

socket:[55898]

Path socket:[55898]
Size 57B
SHA256 ae1327179e66283606eec0cb3d3684f9180b0ddec950ca8caec8c416f5358304
MD5 7f1eec2d10781a261d7893589c5000eb
SHA1 35fd5f10ad92a978c1e769d9284833452aeb349a
SHA512 79709da9198c1cbccafad3719f080c33cce6798edb3644e017aeb2a2a4f8f002bced5af6605d4ba60a1ae80888e8b2b0f952df8a37008ee5ccc68b2f12d3404e
TLSH
T1EF900238461C87D669CB585D5F3733B58184D015006A40BA81594F0551A2688B205756
MD5 SHA1 SHA512 TLSH

Submit Download

socket:[55899]

Path socket:[55899]
Size 58B
SHA256 4c83d72a478f61b8d8daa3c178117dc27de2c48a25d1918e54f35e968e4b5070
MD5 6045e7cfec258dda48ee74904f64b8d8
SHA1 be844da900b2d90897d99b1c7963217556aad3fc
SHA512 7262c7358ac513a7f8f690a47345310050b8d94e0e90bb6aad146f9ad56e920fcdc71377fe002c260626d1920ad53c91774304de3af47e6fc7aaca9e693cb410
TLSH
T1C6A00255076CC0CF085D71D42D573D62B2CD8551043B9952109DCF7C6A6378C9702827
MD5 SHA1 SHA512 TLSH

Submit Download

socket:[57563]

Path socket:[57563]
Size 43B
SHA256 0ce2d4656d26e674699ebd36d7b47ac517de5541d2ce7b7277eded35a5e73459
MD5 d2875c6dcbb4f68485679583a4886be2
SHA1 07febc86505bf5c7c6a43997d14dd778dddf412b
SHA512 a118be5b6f2838644c7b41aa9a21511495716c766529b39fd25589423ef72f94b06626856d7b5a2ef0ff40a8621a0d7cdb96f5a463d942da06bb79c0d06cc735
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads