68e185b39b69e340c0635a164ed093d3dc0b128f0b7f409542cf7e48a2b85ca4

Analysis

max time kernel
92s
max time network
152s
platform
android-13_x64
resource
android-33-x64-arm64-20260708-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
submitted
20/07/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AMX_FINAL.apk
Size 92.6MB
Sample260720-ypfmlsft8t
SHA256 68e185b39b69e340c0635a164ed093d3dc0b128f0b7f409542cf7e48a2b85ca4
MD5 b967a2a4305de9bb33fb7d3e32efa65f
SHA1 669c171c08af62de3465168a43075c1faa25ef75
SHA512 d0307e2c4bc4bf6b5c00aaa3c386fda4815ff1777a061a9fd55fab6180e0af3fd66c71fedc6f3d67dfbf128d49849a18e20811402a132df7d88b972e6ff2b8d9
SSDEEP 1572864:VGJDn03Av0OTZ5rK8024r2QO+fq4VOPpknJMLsFX:VqgqZpK32m2Qe4VOPKH
TLSH
T16528F16AF10D6C27CFC5B53C89420AA0A6147C62D795D2C73012735EACFB6E8873A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery evasion

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.alightcreative.motior
/system/xbin/su	com.alightcreative.motior

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.extensions.jar	4203	com.alightcreative.motior
/system_ext/framework/androidx.window.extensions.jar	4203	com.alightcreative.motior
/system_ext/framework/androidx.window.sidecar.jar	4203	com.alightcreative.motior
/system_ext/framework/androidx.window.sidecar.jar	4203	com.alightcreative.motior

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.alightcreative.motior

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.alightcreative.motior

Checks the presence of a debugger
defense_evasion

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.alightcreative.motior

com.alightcreative.motior
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Checks memory information
PID:4203

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.alightcreative.motior/databases/com.google.android.datatransport.events
Size 56KB
SHA256 fb85dffa390827292ef150489c5dc4b9626c00c840f4b153178f5b8261d568cf
MD5 6e27de542655b3e9bac4670bd0966565
SHA1 26f0da0a284f5ca92f4a0dd80f9255ad55806be9
SHA512 2c02d90056e63535585627bfc3d39b7cc55a0249aecfc5bcac66f66ba0ecf9036039b98b8de664d5e988df4a7825212bfed0c67fd1461985db5f6420db84c33c
SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPS4:RMEX0wIyNja4
TLSH
T1F443619D5B2C2221C57E283ED7E243635B7C93DF572392623A908CF98DC306974358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.alightcreative.motior/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 4feac7902235b918304b45ad4aada135d8ad9695c0e3ba3350b3452f0fdd78e8
MD5 8b40a9763ad81476d986e72aed97e968
SHA1 23ff7bb51689f7a0f6acc734678ec1b4eb288d02
SHA512 4987ee40970ad649ae1dce3eb8ac040696e53872ade96aad8262582a72eb36f7abaf6f6556b8c88ddbf0784973bf99b39876b5eccb642d5763a791fe1b43da96
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.alightcreative.motior/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 f58ad7428d57acc92af74a4dec58f407def67d39cbdf22808607f49104b422e0
MD5 fdb6570555f3032f8885d5b929abe14b
SHA1 dfeb0142e923c16dc11b5d7aa4d153479dc528ea
SHA512 f4878fb12a51577974982c492bf34bc270e570ca804344d9aa53f3ea24f42797edd212e6c02964c2186b8f25e296331e718b516be97aa65756e3add246c523b5
SSDEEP 6:7+/l9jETf4n1wTg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuK4u:7+tB6fPTqLiuWd7RmBEyPb4
TLSH
T12B02229C63802822CA19967790E4C3580D00A71C92A6CB870D5008A46C038CCA4B0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.alightcreative.motior/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 f65c80d9e84cc2fc5de80a8822393b9543af894475d4297bae7c931d8088cc7a
MD5 804bc18fa9277798dfeaabe9756ddc84
SHA1 1071e41bb75a519c03eae344c848b80568b60406
SHA512 463bb70f37f52ad7e8f6e1f9127024b0acb3f57ad2b185862fed6a779a5af76847ae2bc28e134b5726fbcfaafc5d3bfa94734027fec879ae253c962dea4a686d
SSDEEP 6:7+/l9PoPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuK5/d:7+thgqLJdKBRmBEyPbGd
TLSH
T1C50222C863800813C51B577B90D983601F10E7148323CB57295019642C026CCA894D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.crashlytics.settings.json

Path /data/data/com.alightcreative.motior/files/.com.google.firebase.crashlytics.files.v2:com.alightcreative.motior/com.crashlytics.settings.json
Size 774B
SHA256 02fd510b2e75c4d1d044d7ba23ae53e346fd87b3c2b52a9432648438702426a2
MD5 7cdef3623958f6bc7b33ba4f8f548efb
SHA1 422814b582c185e32f965ded69c0f33183b2ed90
SHA512 00d067fda2e0475fa0b95b211b60cc38e30e8c4e3de5851611c3ca10760d7d36e8ae308fe2c3d7ec8744cc70b21a074a78ff2053a966d04cec900e5840217464
TLSH
T1E1016D6CA48898F980EBF61AC63577F2163948731756AC68F57C832851E79C19217A23
MD5 SHA1 SHA512 TLSH

Submit Download

app.json

Path /data/data/com.alightcreative.motior/files/.com.google.firebase.crashlytics.files.v2:com.alightcreative.motior/open-sessions/6A5E7DDB02E80001106B20437A9ACF95/native/app.json
Size 236B
SHA256 bf95999c7d603125fa39d8a703b8d2ea089ff6c62b7ac4e60211097a1a5ddda5
MD5 3322a0510ea72c681a5c364eaff9cadf
SHA1 bc4c50107b7da3e32558f52f8bb82cee771fb462
SHA512 d5b3750d65932b7652219c6d9cebc2b7af9ef107f0c4682cb01b3b56722690dbff4a64302dac3a097514d727dafc592fcb59d8be32af81395e9637aa3899044e
TLSH
T1FDD0A7149620897773A6124F90B590E143FB00F2075974DCB90A4C3B4722AAC03472A7
MD5 SHA1 SHA512 TLSH

Submit Download

device.json

Path /data/data/com.alightcreative.motior/files/.com.google.firebase.crashlytics.files.v2:com.alightcreative.motior/open-sessions/6A5E7DDB02E80001106B20437A9ACF95/native/device.json
Size 194B
SHA256 4ff85c4413a37b4268b2a10e36292208415c96c9fb8dcc4a49d80411e8e95834
MD5 b35193696574cd9494b082a9c5f9ba69
SHA1 ed9881cc33d869105d6f1a3f6bf8c7c4a43b608c
SHA512 903e0b10b6385218199f502857b645d7144e70ea68259fa82df7ac398f0900a898de3b9e6767a97722d3be63832c2187e285102b506706781c4c19b9dd3d4516
TLSH
T136C012F5EC7E3AAE8BD1E1942C378E53FC7508341A4D6D2064F58D15240F8949399969
MD5 SHA1 SHA512 TLSH

Submit Download

os.json

Path /data/data/com.alightcreative.motior/files/.com.google.firebase.crashlytics.files.v2:com.alightcreative.motior/open-sessions/6A5E7DDB02E80001106B20437A9ACF95/native/os.json
Size 56B
SHA256 77b886b74dd48e22effd172c38ee914ced97247f4516c319f09cb8c9ebce4c7a
MD5 87e2b9d6edc06545b88235933e703881
SHA1 b29448a47c87bfe3a59286e3cf4e02eb72581a7e
SHA512 ccccd682e14a485c8c8d13ca0105d196d00fe02bed941d939154a199c14e741eac6522f378f509ed14a52efd38e479930ae223f6f317a35b0787d82e553db3a6
TLSH
T16E9002B69880A036105203545A555E51D37014726045F0245897041112A71B80231109
MD5 SHA1 SHA512 TLSH

Submit Download

session.json

Path /data/data/com.alightcreative.motior/files/.com.google.firebase.crashlytics.files.v2:com.alightcreative.motior/open-sessions/6A5E7DDB02E80001106B20437A9ACF95/native/session.json
Size 127B
SHA256 5e9b2c5e7993ecb1c0d46992005917e6ef244fd384eb632e4177c86e0fb8cc92
MD5 21b2ca92945fb0a9e843dabc1a6e3306
SHA1 dbfbf1e562c9befd67d1d1f67b385f05878bf6e2
SHA512 341580d1618cbc825035e025c50e00f72b68082b2804bb52e99959be6449de19f3d1893af28773f71a4ab86ba5f651a5f2d4d55ba107a4001df56dcc0510a711
TLSH
T1E9B02BE05A6436300B6375D2E115CB3107F1030C2B22CD2114F9025D13D4D00E389C00
MD5 SHA1 SHA512 TLSH

Submit Download

report

Path /data/data/com.alightcreative.motior/files/.com.google.firebase.crashlytics.files.v2:com.alightcreative.motior/open-sessions/6A5E7DDB02E80001106B20437A9ACF95/report
Size 773B
SHA256 5ffd82b15af9b9c64f01cd9682f52037bfdb6cc1d55addc7911aa8a2751d7ed7
MD5 2f6e6522080bab0fd5592f40c264c8fd
SHA1 27ce39c91e1bb7646437212750f76f9712170765
SHA512 60865e17d53c5b6596ec1b45cd4d8a928c85816f0454f043f341364298fc208842792afc49cccf34f59dedb2dacfd3d5d61f15411da71acabf5e94efd800b0c7
TLSH
T13A01BDA8DB752B3C6249678F9061AA46E3B502685711DC9C78C7803325CF87D53831BA
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation1010282627386372670tmp

Path /data/data/com.alightcreative.motior/files/PersistedInstallation1010282627386372670tmp
Size 90B
SHA256 b97d5c26ea895d4227986ed192b2fe7155a27c7e589a59665fe87919e6192526
MD5 bfd12408c2df4687fd07464be82fddf4
SHA1 d975c2358bc8d4305b93f1d8711bedd48f5bbc88
SHA512 eac94e621686bed537a2c42ec313b39955ee822dd1e9c5d27b9734f314c5a60b2929fc2cd1bcc46a757ff7d8bcc99759d252be7995deade66dd9864810dda356
TLSH
T1CFB012419B318141899AA3031C8CE1507E801881985ECE054F08D44140C11F0D7C3BD8
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation2192740986670431429tmp

Path /data/data/com.alightcreative.motior/files/PersistedInstallation2192740986670431429tmp
Size 114B
SHA256 cd4114b6c888a43f99a6eaf5cb5e3a2557393a6f3478533e05b0386847cdb78e
MD5 d0a7604e7e37d55f80d17edde67a8e6a
SHA1 a858af4fa3a25e28d01f2dbfb98de86611021afc
SHA512 9ed4afc3d4a7adf8c6d3d24df9afc3bdd576ac6ed7df7ceaec7cc0ee308bfd2a94b4874d3f9241618e687dd0b0cf4f66824edd543f467d6b5a0bb3a10bc40d71
TLSH
T1CFB012555B39C5458A5BA3031C4DE1703FD258C19C6E8E059F18D80660D42F1DFC3FE8
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.alightcreative.motior/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
TLSH
T183810250534000E1D05446B354E113080F06D19496428B03550100428C415440C60E88
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.alightcreative.motior/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 b69266ff30c250a741b9355f940a33eabaa739982f60cea259666a5316d9dcc3
MD5 ccb6052d338667e2db04f451766add7b
SHA1 612e070ed5a64c186d80ca1fdff838478a3347f5
SHA512 dfc6a6783caa899003139c798c64c7d388617a8df8f43d1e411c91f4271c0642e04b3d8568cbf1cb786c170642a5811095f34a5e2ad7f563a956195d6f02200b
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.alightcreative.motior/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.alightcreative.motior/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 426293307c315965f34e058ad2a59e5cfa113cbc384de5fd5d60a6f285d216d6
MD5 39d1f3b8a9969f57b712cf1deaf67db6
SHA1 7980bbb7691ca849496256656ec3805529f167e8
SHA512 0171898d3323f5b43ebedc465909d07e43dd9bd9103a7d97400f1f12b9d7543c9e9e2942c5552a7eb753cabf2305548b1ee92c3cbddaac2ae0286a0847cba3dd
SSDEEP 6:KOWagxsg9FZdKEAlOERX4PBX4ogLugMBX4suuK+/sdtkk0cokoTmgOw2:KOWn7zdKBRmBEyPbP/sdtzhgOw2
TLSH
T11C72C27662800E53C30843B290C483810E61E71B5353CB0B4213072D2C027DCA0D3D4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.alightcreative.motior/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 9b0ead8eab8d7cdf3d035aee5cdf8c9d8e98aa273252566af3ecbc9632fd7760
MD5 fe5624257c81f8e69a2c2c0cdb021a60
SHA1 9a220f0316e486dccce59459d4fefa912d86d16f
SHA512 ae68031806833fafad4e8ace7841dd4da9cde23e6c301e258268045d6b6bc6c4b82e22eef1749ae5c412f0792bf5c1b83fbac99f064d364ff49b7378a359df19
SSDEEP 96:D6+hdjnHtDRMpf8UzS6+BD8q0ExPI/zFlAq:DdjnHt9Mpf8UzS6+BD8q0E5I/zFqq
TLSH
T1D5B3116F0F192540C6A954F0A1D00FA1793E862F8793E3E665934279ADC2930DD2BCFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.extensions.jar

Path /system_ext/framework/androidx.window.extensions.jar
Size 123KB
SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
MD5 3056e1bdb7d4e19789d0319eff484bd0
SHA1 6791ae47aa9466fe0bca27ad6643f846853bbee4
SHA512 c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658
SSDEEP 3072:8Pmsa8v0v8FYNMhpjLXZ/pziNQdysk4p26PQ:Qmsa8vXhRLXXOQGJ
TLSH
T19DC31951FA4159A1DEAE933B959B1301AB30A648AB2383137654D0BCFCD73C39F87AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 25KB
SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
MD5 29469324e59dfcc052f24b5af4e7b2c4
SHA1 10c1e17ac6f598037bb51baa07945663645de4eb
SHA512 5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2
SSDEEP 768:bjydnTmp8WNAupUuvkg5NrtsESOMXIpc3dRwQA0:bjydCpF0uhtsxOQIqdSj0
TLSH
T1A5C2F716E7400C63E9FF9A3B6A5B13009F35E3A4AA43471B640585A4BDC63D3D9EE7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads