dffffd77810073ffff395b1179f247fe22b6f774850c875db69fe0f704016e3c

Analysis

user interaction
yes
max time kernel
146s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
24/07/2026, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.apk
Size 760KB
Sample260724-3jsgfawajd
SHA256 dffffd77810073ffff395b1179f247fe22b6f774850c875db69fe0f704016e3c
MD5 96fde2536f08487123d20732e688d8bd
SHA1 cff46847038a27eeeae60def162bf2a8d4c3c37a
SHA512 5e3b9cd116fb980ad38b1cbf4d40ad107ceac3666a367729cc9905e37bbd78ef9d5214ad51baf70bb5d172ae1e1e4db2bfbc313de6d47438eba511f672b9c3ac
SSDEEP 12288:IIiYa1a8LzeFH2gTg9EV5WmpYshXZPbGwidNpg+L:IIba1ameFbTg9EV5WmD9idNpb
TLSH
T15FF47B86FB4AF863C9F3C7364375C66A96060C544B43D7971A85727C49BBAC08B89FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker defense_evasion discovery persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Makes use of the framework's foreground persistence service
PID:4960

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config25-07-2026.log

Path /storage/emulated/0/refefr/config25-07-2026.log
Size 39B
SHA256 c3ff779baa7c2f8fd270c497edcd32c6fbf9330e0109ce7a6d9fa5232e07a9a5
MD5 4218583a930046fd6bfd1d7cbae85132
SHA1 82641af5e577cdf1339f5b652f93b13e77e69a24
SHA512 5908f5c5461f4c0f7a23d6d5fdc7f611b5cde6892e30dec5605e7a38f001d375d29c86eba083f22708fbcb2a44eb58bf68653e5de80d86675ba0364b226c08d5
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads