d37fe58807ae38864f74c368d1ccc20c39d2654d6494d12af3afb04150cd2da4

Analysis

max time kernel
41s
max time network
151s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
20/07/2026, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinX.apk
Size 12.6MB
Sample260720-gylrjsbs2v
SHA256 d37fe58807ae38864f74c368d1ccc20c39d2654d6494d12af3afb04150cd2da4
MD5 1ab1b592c101ef62721674fd883b615b
SHA1 7e3e215d2f2a865cf027fc40643efcea3a035dad
SHA512 1273c51b8ce079e8b59fb6c5af577703fbff9aebc69caa666483b9ef422f46a2f4a0b6fda2cd8dfa154602a72c9cab6404a0a653d8a099b164f1e8e3f37de4ce
SSDEEP 196608:1dIZIaSYqC2olvXuu4mufvTl8ZgpNeVoYih5G08G0JG0uG0rG0zmxvxQNdzkXtRs:TeNSYqrjl8Zuo1+rzCxwzQns
TLSH
T191D61296FB54A96AC4F7833311FA5635514B4C268B43D78B5A08F27C28B79F00F86BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	esports.winx.qolor
/system/xbin/su	esports.winx.qolor
/data/local/xbin/su	esports.winx.qolor
/system/bin/su	esports.winx.qolor
/data/local/bin/su	esports.winx.qolor
/system/sd/xbin/su	esports.winx.qolor
/system/bin/failsafe/su	esports.winx.qolor
/data/local/su	esports.winx.qolor

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	esports.winx.qolor

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	esports.winx.qolor

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	esports.winx.qolor

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	esports.winx.qolor

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	esports.winx.qolor

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	esports.winx.qolor

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	esports.winx.qolor

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	esports.winx.qolor

esports.winx.qolor
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5109

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db

Path /data/data/esports.winx.qolor/databases/OneSignal.db
Size 52KB
SHA256 ab03de5564295f5ec34e2fccba9811cff818911b07798e9e456a58309deeb3a7
MD5 e1941e84ac2269c7b1b8bb7041b14001
SHA1 aed569ddb068a94e893702c297683c233d841f6f
SHA512 99124fc5347f6a7e19e0e30330c4e2f0f2d9074a0fc6a0ab7be25c5bd90d8dfdc66e8abeb1852be871dadb7a5945d7046d2e72ffb4f179c385ed7ffded33c2b7
SSDEEP 24:TLLSRZBUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvJqrEqjUix5+xGTrOPjwV+x:TeAcrA0oJxqrKcrObMoOS
TLSH
T11E338BCF4A862191EFC765B3155252E44E3B610E889317A63BF760245E83B16D72387C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/esports.winx.qolor/databases/OneSignal.db-journal
Size 8KB
SHA256 7739b9381292205d759efff885c5d14d891f387a0802150d865421ef6dbfeab3
MD5 f0fc54c42cda8e50319a8d6faea618ee
SHA1 10d28ab08b13e36b856915320e4d6fda15776701
SHA512 4cb79b848465c5d13becd9b132728043a735abc7634947637afa8d550a781a250c03cbde492d9256a41e178ea5a763dc7636e5243587b8a4c3370ca29756a806
SSDEEP 6:7+/l9Y5/mHn1kkWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKh:7+tpWqLiuWdwRmBEyPbm
TLSH
T1D80222A9E3800922CA1D16BBE0DA83400D00E7198161CBA716600898FC038CCA4A0E84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/esports.winx.qolor/databases/OneSignal.db-journal
Size 8KB
SHA256 98c4eba497395603b5e1afb546d8f6fad25abd0a06054700984a68322474dadd
MD5 77b4289952374b0c3049472936f333c9
SHA1 17f13b0a1a496b0989f89113ab72d0fe971e0412
SHA512 5e8ef57dba262a91ef4321110580133d08d04e25335b352ee81f79fd30f143197fcc416b9df72fce5232b471beb4546b669c125fb88347bc0aa1cf4d2a0de262
SSDEEP 6:7+/l9iOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKJly//ktn:7+tPqLJdTRmBEyPbxXkt
TLSH
T1C702C08D73410823C01D1BB794C983402E10EB36C333CB0756A10C9C3C036CDE8D1D60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/esports.winx.qolor/databases/OneSignal.db-journal
Size 512B
SHA256 f88fe9bed91fe158d594ac35e6ead55c1a642bb92049e16fcb450b205e2269d8
MD5 e55e89d9a16e279db2a9667a503b452a
SHA1 9438986f193f9861e4ff854f8fcab70d6fa8b8af
SHA512 bd94482d2d0bd4814dcaeb263e370c653b078f27aaa72da25f83ca10108007a0a7039f1892960a81140686a6307a4e177c2de456775fd9fcf434e5d9a051b07a
MD5 SHA1 SHA512

Submit Download

PersistedInstallation626546890645635123tmp

Path /data/data/esports.winx.qolor/files/PersistedInstallation626546890645635123tmp
Size 566B
SHA256 239fa3a91917d6fe70cbcc36f39437dc0bedddbbcbb1863e948b51dd6b8ffb57
MD5 a5e25b9e93c96ff3fbdf3f30a94673a0
SHA1 f170c900ace556d121b973f5fce03c13b6c3133b
SHA512 8853f1f496dc6025137becabcea2e85f183a906231b47bfcb000de64c0073e118ad4a022c35a0f10800034bd8aa43e8e3cd69c234aefeb6860496923d5de7ddd
TLSH
T12DF0969B47200506E01AA14A20CE7D808D2D34B914AA08ED7FC0CD8509E17CFB145A08
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation807609665298604673tmp

Path /data/data/esports.winx.qolor/files/PersistedInstallation807609665298604673tmp
Size 90B
SHA256 dc5c70eee1b20678d0ab75ed7c481cc554f11b284ec5fe172948113deaf8b37a
MD5 fa2b2bcf29feeab22e61ff88443e3894
SHA1 4314be19b32f95734836a4045dcbcab965cbe509
SHA512 3b9828f42cc468ebf8d54bdcbdda50e6ded640d918782b554742d74863dd88ce0ba09975fa90f9b1ec91e0baf7f21634a3846cf3589a2fc14800f63300934054
TLSH
T114B012884B306581C5C7F3025C8DA2001D94544108498E080B08E98000D11D69183AAC
MD5 SHA1 SHA512 TLSH

Submit Download

profileInstalled

Path /data/data/esports.winx.qolor/files/profileInstalled
Size 24B
SHA256 7f59b9be546c8cc6511cb639363a2f5d35ac487a3050d90644e2f4bef3b28ede
MD5 9dca3025afd2ef21eae59286f6bcdb9e
SHA1 3600fa255d50be770f72300297f3f83cd1f276bd
SHA512 5b8e86b976f6b0be1e546d523251a218c8e3da46bfc540d63965f59005b83108a6d65e6eff8758db6ccbee8ea87d5b8192d3d50b6315e3b0c6f85de8d49cace6
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/esports.winx.qolor/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/esports.winx.qolor/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 ca750ee8d2217ddf3f0290570abe78ffab60128238abe568d4b3830cb91b3d4a
MD5 fb82396ed906faf66db0ff27fee5ec52
SHA1 c56e7e8163d5202b4e3d8f67c395436e9c23ca5b
SHA512 690251226daeae19ca1c39bab2ab3a8e487d9281098802c30158bf7ce7b8e66ff91fef5e973a48419e5549e5b7d968a2892713b00fbe54aeeb7af9b6bcc359ef
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/esports.winx.qolor/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/esports.winx.qolor/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 23971f7b3944d7139c306a09ca37cb580481873575d9c0e9e1c502d51ae1f986
MD5 3b4762d59f74d0a49da72f3a2b21a133
SHA1 b4f2e7a217eb749ea659912cd6f8014698d754fd
SHA512 eae0b190be0892d42e33a547d099073f774237fd56829e4987f5ba24638b2b95ed9e307ccd6a55c309783f7ca1921701eefb67804284d6963409bd3c725ac624
SSDEEP 6:KwtrEoo9FZdrlOERX4PBX4ogLugMBX4suuK+/WOxBa+rBql4Ow2:KmrizdTRmBEyPbP/FM+r4WOw2
TLSH
T11472C2E9A3820992CB0872B35084D3651E60FB1D5613CB0716F104B57C46B8CB8A0E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/esports.winx.qolor/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 2111453e898bd3905ecf11a8818aa1eac2ef9bd60670c34751f44a6dce0598b9
MD5 49b8f2955e8a8bbcb058fb71d922c867
SHA1 ce8ab5becaf5cc179f966c646ae4b8422e6dda1b
SHA512 32b9a481d461d7927374880fff27e5f1de64cffe722e059ef0c089b7c151f301f6eb41348801137652539a3c4c9ac6f16d97546f4947f1d9bfe6b0137d31370b
SSDEEP 96:er3vrWTIDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:erDo4ndjnHt9S/f8JzSV+6D86T0ED
TLSH
T1D1B342DD0F5A2540C9AA74B0D5D00FF1793EDA2E8393E3D165A20075ADC6920FE25CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/esports.winx.qolor/no_backup/androidx.work.workdb-wal
Size 193KB
SHA256 28db0ef99c559a0f163af0d5529322989a05a8fbede27ddec7dd6f126ae40950
MD5 006c8af19f32b0d3929a7acd732ced48
SHA1 82b83e83ab8b0a05f2b117f93becf4e33eab281c
SHA512 aefac6d50b59ec81b30ad9bd439e61e7e322417aa45cd027bdbeab436f980e356ea73d1eafc2b2c6f9fa807bbffaf3fde99c8bec7eb752e19587441284edf7ff
SSDEEP 192:Yu1DtY0y0HjDSRI0Gu1DtYJ6aEu1DtYv+1DtYE:j1DtYr0y71DtYX1DtY21DtYE
TLSH
T12A145FEB716F9161FF0A323B992309B114B3A9E90F85D4D4DAFB425402C5215E32FB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads