49c89396b37af1699727e4f24fe05e0aaf6407f2367ac70bcd8a3cc580218142

Analysis

max time kernel
31s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
23/07/2026, 08:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
votemesh.apk
Size 3.4MB
Sample260723-j8dvssthkf
SHA256 49c89396b37af1699727e4f24fe05e0aaf6407f2367ac70bcd8a3cc580218142
MD5 a5ff8960e0117ac05edf46990fe93724
SHA1 e8d9ffa2063722763f194c0644c691199f3b5201
SHA512 b2a8c6e109041e466bb47b8e20fdeb6dc18d3a34776f79db4cc318f22f0f8d23fee857f7c936b46c7a668b226ce38107f7f70f4cb8b560994ce62819728c9c10
SSDEEP 49152:is5mND2LTgb/aBPtmlfegfm4jVtYSxGjc9ybezojNPJjGg3U/Kr3lJNMPy:s2XM0sYMm4jEgn93zotFU/Kr3lJNMq
TLSH
T1F0F5D0C6FBE95E2FC4774072CDAA52B1126A4C26C6439F476948371C78B76E80F49BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion persistence

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	app.zls.votemesh

app.zls.votemesh
1⤵
- Makes use of the framework's foreground persistence service
PID:4899

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

enc-key.bin

Path /data/data/app.zls.votemesh/files/enc-key.bin
Size 237B
SHA256 c2d7eb67a6de4001ea475a5aab3555122934391fc88f7f0598d134de3ea7d6de
MD5 d62f1cb3d236aeaaef959cee0b3d1305
SHA1 12e3245ff02699b68c58cbb5c0cd5182e39c30dd
SHA512 e6df8fc0bbdc3ca433d75c3a075f8fe0cb02bfacb724dc2ab82b4f5d1ad5e5bd94fc11bd03716f74fb87f5d72c8df10af4121b9b8120a150c035c82db120dfcb
TLSH
T1EAD0A75414203F864635D52BDF08E50917445318DC9E4C111B91D6DC4F140661DB860F
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/app.zls.votemesh/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 5dbaef5e908741375cc0a18dc219db4e00c854406a89309a13183f96a3910748
MD5 a60a10383567d1d91ad384e6a59f7153
SHA1 af24343d878ca78f2ebeb7ddb82f1d701c52d6ec
SHA512 be68590939cc272ed6ac4db5fc9e0e8ce6fb8eac835c9b8f456a01331027d6f50b2703d16f0c67e6baf2f1b46d040be86a696110ca2370e9c314fdd2c8d19969
MD5 SHA1 SHA512

Submit Download

registrar-key.bin

Path /data/data/app.zls.votemesh/files/registrar-key.bin
Size 1KB
SHA256 c8ac1512b7af2490ba1c665af31e6381e452d666f3719e87a5db08de27aea7eb
MD5 fec15e0df33f672db84184ddfcb341f9
SHA1 bb5d3e148b1114b634f7d140246e405fc850566f
SHA512 224c58d8f05c46171d3017b67742a4d4e13de272e56cdd98443c0efb385ae46fdf222e87a415e90cd39f2809121cd0ccf62dc3a9972c5207dbfa175e6f8ffa8a
TLSH
T1283195BEBAAD3763AC88854257A1961D99E0F1C4C2C983D483395CBCE919FB73215878
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/app.zls.votemesh/primary.prof
Size 1KB
SHA256 ee095ee45f1bcbed58939c444934e9b0afaab9435456f965b0448e4914bb73af
MD5 6e6d534c728f6d603e59c5ed53b20758
SHA1 cc140074975b800221cf952e325532d864e41beb
SHA512 b6416d941c64188cb9fd5d618166187f2e556023c07d8cfef348c4dbb66f7bae2dcdbb4f72b8d2af69a657001326be090a5b74adbda9960940b0a55d4f77e9b3
TLSH
T1C8412A488866C5690E3CA3D12FD1B30EE449166F5CBC4AF0114C2F3A3395DFA44DCD2A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads