Analysis

  • max time kernel
    110s
  • max time network
    154s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260325-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
  • submitted
    24/07/2026, 12:17

General

  • Target
    upx2.latest.apk
  • Size 5.8MB
  • Sample260724-pgcfjszcmb
  • SHA256 ee2ceec3503c131fe1dca9d56ff5687d5948c3d89fa1040ad89cb72bd8a534ef
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • org.upx.upx2
    1⤵
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4336

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        PersistedInstallation1211225744036079991tmp

        • Path /data/data/org.upx.upx2/files/PersistedInstallation1211225744036079991tmp
        • Size 561B
        • SHA256 f83a0f8c06cb0f126fe63bf0c267bc0d64973f744653a75a367de4c1599ff0bc
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation6927133090143198530tmp

        • Path /data/data/org.upx.upx2/files/PersistedInstallation6927133090143198530tmp
        • Size 90B
        • SHA256 c3d6922d6b98a1314be6b012f38982c14e9e78d862ae73c5c5c312702b0aabb3
        • MD5 SHA1 SHA512 TLSH

        profileInstalled

        • Path /data/data/org.upx.upx2/files/profileInstalled
        • Size 24B
        • SHA256 9b05c682ba6a76ba930115c07aed42716b7c1af6d23ef05e8cca75ce04788f25
        • MD5 SHA1 SHA512

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/org.upx.upx2/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 9383690e2793ae3ff2c5a4565fed0ec2e1ce21501abc4a4427b8e8496548ae0c
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/org.upx.upx2/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/org.upx.upx2/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 f1d8d5fe31b20189c86ca06a355e21252c62c47bf180f5a0bb05ce151488dbad
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/org.upx.upx2/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/org.upx.upx2/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 66d2a0798385f3c41a48d611bd81aaa6ac02e3494f436cec1921343d7c38f225
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/org.upx.upx2/no_backup/androidx.work.workdb-wal
        • Size 124KB
        • SHA256 813747be5dab60a3d3fa8f81beafe98dfffbd6f1cbb0d5ad76ae4915b20ae151
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/org.upx.upx2/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 3d07966686c00c6e500cd121e30534b3b4c0028d7f543f4c56b0106395ff2bd9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/org.upx.upx2/primary.prof
        • Size 2KB
        • SHA256 2a5df6dc68136e0c344bd15dc950a59f1e394c5f3db9698c70e7ea058094081b
        • MD5 SHA1 SHA512 TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/org.upx.upx2/primary.prof
        • Size 7KB
        • SHA256 f8274ac0ab8c93d81f26506870bd8ba63f734fd7499f6994df35fee83b6408ab
        • MD5 SHA1 SHA512 SSDEEP TLSH