b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437

Resubmissions

17/07/2026, 17:17

260717-vt7p4sgw5m8

17/07/2026, 16:28

260717-tynmcsbs8s8

17/07/2026, 16:11

260717-tnfh1aay9x8

17/07/2026, 16:06

260717-tkdv1aay4z10

Analysis

max time kernel
29s
max time network
20s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
17/07/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437.apk
Size 13.8MB
Sample260717-tkdv1aay4z
SHA256 b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437
MD5 362f5050dfe13e934a0a01ad74509a50
SHA1 6ca0b45f517833762e3c463697ae751d86145203
SHA512 36ddc813e638081cea616b31065200614b784accdbad418681c3a7a3dc66e445f5152948510d532bb130d1bb16307511fc351cc5917c6aeb6bde254faa43d608
SSDEEP 98304:oO7EaYgtXmdzILfPQO8+NCses3XxRs6sVKk+5iSRGXxt7NkE:PYqrLfPQaCsh3XxRXsU7rOt7Nb
TLSH
T1F5E69F1BBDC0DF32E5D61877040581FAE32A1865BBDA47C21706DE3E38562D6BF25B82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.jhhole_handb/app_dex/classes.dex	4359	com.jhhole_handb
/data/user/0/com.jhhole_handb/app_dex/classes.dex	4359	com.jhhole_handb
/data/user/0/com.jhhole_handb/app_dex/classes.dex	4385	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.jhhole_handb/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.jhhole_handb/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
Anonymous-DexFile@0xcc65e000-0xcc6ee7d4	4359	com.jhhole_handb

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.jhhole_handb

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.jhhole_handb

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.jhhole_handb

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.jhhole_handb

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.jhhole_handb

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.jhhole_handb

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.jhhole_handb

com.jhhole_handb
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4359
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.jhhole_handb/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.jhhole_handb/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4385

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

.global.com.jhhole_handb

Path /data/data/com.jhhole_handb/.global.com.jhhole_handb
Size 48B
SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
MD5 046a414913add6f5bb60072c7db819b6
SHA1 451ee4f6809260aec622d772fd329c7d0297a842
SHA512 4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
MD5 SHA1 SHA512

Submit Download

classes.dex

Path /data/data/com.jhhole_handb/app_dex/classes.dex
Size 1KB
SHA256 a5ca0fb3c34b4347c5adc66610a82e218d6f107655aec8d57593d98daa30de32
MD5 41e4b08e9fd21da3aff99282cfc7ee78
SHA1 074cfe2384cf3a974993840c728af914bb4f75ac
SHA512 4d2e5098b334ba326ae33c57d8681b91952616540fce73863a572880540b6a5e4c7665ead30babb86395e87d98fcfdd12b915e189a6e46d7034254639eeb157f
TLSH
T11131DE9BEF94CA03D58B933AA45A0B01F33DD0946742972B1395B8201DD23B06FDA689
MD5 SHA1 SHA512 TLSH

Submit Download

classes.dex

Path /data/data/com.jhhole_handb/cache/classes.dex
Size 1011B
SHA256 a8a827bd44d833174092a0368532e8fec69f6cf9e89291bb1536f3f105fc2d0d
MD5 83ea570e50021436772936124b77dcf8
SHA1 206ae8a632a0eb4cc9245eabf02c462155a7c273
SHA512 21dc1d43f19ab7d639bfd924e140b43db7b58199fc6f197d68c48f559c2382f1cec92ef175ccc52504a94d6ccd4bebf6e66a7bde481d34fcc0f060f47b53354a
TLSH
T1AB11A86AAC31C83D9B56861B1DCA536C67281062222F09E10562D6180827E62D09DEB8
MD5 SHA1 SHA512 TLSH

Submit Download

classes.zip

Path /data/data/com.jhhole_handb/cache/classes.zip
Size 1KB
SHA256 78088a871b3fcfc1676e5a364d787d1cb1e5fc98330cccd27a523b213b75b48c
MD5 94d20b3803a1237484f692174af7f408
SHA1 3df2e96864f27e9ffb339cc260480a7d06719975
SHA512 e4ff1cb71769e9ce690963d7a7636b38073581f6d63fafcfc2af4ab7c4b73284ed7176c0dd636c9d5b8ab23a8ac6f150e565ae19cfe45aeba1077a3cd1d8ad00
TLSH
T1BB21965EAC25CC3DDE22853B5CC6136D673812A2615E09D101B2D52C0827E5184C9D78
MD5 SHA1 SHA512 TLSH

Submit Download

Path /data/data/com.jhhole_handb/files/.t
Size 307KB
SHA256 6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
MD5 4e73947cabb5db3f92ca85004981b754
SHA1 6d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA512 be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
SSDEEP 6144:VnVaOYui6APlh0bOTgoCD0i09L/D64OGNTWEKnh7DMVFQqbsfgLsJhpq8X+JwFsU:TbdamOQd6c+ULLqhysDqUgWw50A+C
TLSH
T18A641A81676A5DB2F4A625F8A30E6738EC350E2057B2A5D78B45F3B074231E1DF792C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.dex

Path /data/user/0/com.jhhole_handb/app_dex/classes.dex
Size 1KB
SHA256 53de6523f8de91be7bd462b3b86eaa7164b42c06677cd3a3ed1c6cbdccff3893
MD5 81ad25bf6c84dc3547e9addde9e1f83e
SHA1 fd5a730a3fd24925b348d03074e303a80799a141
SHA512 5138eafe420d5bf14f509d0022faf80e63f2126bb60b3817aed0237ab7fb02cb75b71db85eab7da47b08d5c3d9357d2238b061e035988dda14b1123f774ce219
TLSH
T11331DE9BEF94CA03D58B933AA45A0B01F33DD0946742D72B5795B8210DD23A02FEB689
MD5 SHA1 SHA512 TLSH

Download

Anonymous-DexFile@0xcc65e000-0xcc6ee7d4

Path Anonymous-DexFile@0xcc65e000-0xcc6ee7d4
Size 577KB
SHA256 0674af584198b5fe0242988d137f688a30dc8e6900a4d4ea8859a27946472ab1
MD5 25ae50fdadb3ec1498adbaec3383b645
SHA1 b06cb75e3251a49b6a55921a4dda96e66039ade7
SHA512 421bb79ede3b46e481b310a9f3814bc7fa2467038c4a40927b64b6b21fc44b957ea061c0d0e089feb9390b8c0fc9543c675cbe89fc842d7e1356e8b072542ae0
SSDEEP 12288:wkX0wnoH3SJzXeHqPu83ks89PVdAFJV4gujDXhO5uO:nXYH3SJzOHJ83ks899dBJvXzO
TLSH
T140C44A1BE991CF6ACC7F533C95E787283336E8856743CB4B6009D4BAAC073D12BA5589
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads