Analysis
- max time kernel
110s - max time network
154s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system - submitted
24/07/2026, 12:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
upx2.latest.apk
Resource
android-x86-arm-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
upx2.latest.apk
Resource
android-x64-20260325-en
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
upx2.latest.apk
Resource
android-x64-arm64-20260325-en
6 signatures
150 seconds
General
- Target upx2.latest.apk
- Size 5.8MB
- Sample260724-pgcfjszcmb
- SHA256 ee2ceec3503c131fe1dca9d56ff5687d5948c3d89fa1040ad89cb72bd8a534ef
- MD5 887451e4d2d328ea5ff9aa0a729d5701
- SHA1 dbc34c4fa6a21bab55bb7dab2c4f9abf28b4df3e
- SHA512 47c0e6422013badb6ce7f38da50bd5dfe909d055af5abc2ecaad39fb297ea345a310441f308804878d89de81020f3a2f49fbe88de69414d66237e1588f4fb455
- SSDEEP 98304:/DpKZFZXiBv59P9GAs/MY1Bp0BSb9nCxVYgNKAlamPgLlM/KrExLm:/DwAfGAyMYSvxmgAIamPgLWLm
- TLSH T1FD56F1D6F7E89D2FC8774072C9AA52F1525B4D128A839F476944371C387B6E80F89BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock org.upx.upx2 - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo org.upx.upx2 - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone org.upx.upx2 - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver org.upx.upx2 - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal org.upx.upx2 - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo org.upx.upx2 - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo org.upx.upx2
Processes
-
org.upx.upx21⤵
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4336
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/org.upx.upx2/files/PersistedInstallation1211225744036079991tmp
- Size 561B
- SHA256 f83a0f8c06cb0f126fe63bf0c267bc0d64973f744653a75a367de4c1599ff0bc
- MD5 b1bffd857c5a097c66e791b4e783019c
- SHA1 9563086b4f2796144ec706366c0da642992ad92c
- SHA512 3ac4bec86bf9e6a9dc9242f4835575e14785bbbe098d3a22295038f266d7e68d615508bf1eb766c65955dba968260b8dc13902b5b881329ea9fa5232765e9e9d
- TLSH T1BDF0268317600DE5D9506A8210C53F960E0404A72E1D019DBF88A4A6F867E5DE24BF4D
- MD5 SHA1 SHA512 TLSH
- Path /data/data/org.upx.upx2/files/PersistedInstallation6927133090143198530tmp
- Size 90B
- SHA256 c3d6922d6b98a1314be6b012f38982c14e9e78d862ae73c5c5c312702b0aabb3
- MD5 9e3c154e8a079cbbb5c4d60e050176a7
- SHA1 6e8d1540d1b5a58123246e06aee462d15c0477d5
- SHA512 e64eeb996250663f4307826de1ed25140a1909488e9291abefacc5f6cf72fc984cfa54fe0b4e6d9329ad7ede883c760e2dfc52bd74f6b860cba9c4509d4adbf0
- TLSH T126B012119FB1427184E9B2061CCCA1512FA17880280E8B044A0C984050922D191139A4
- MD5 SHA1 SHA512 TLSH
- Path /data/data/org.upx.upx2/files/profileInstalled
- Size 24B
- SHA256 9b05c682ba6a76ba930115c07aed42716b7c1af6d23ef05e8cca75ce04788f25
- MD5 4481b0f734f8e6236410f368b0637298
- SHA1 839f869b7022295200cb8dcde1e0f36f81ce6018
- SHA512 71e88136ce11ceda80050b337e2d388f7fba791e3cd372a15f771cb58986b150843c443741df616f5879f309ddb0959b34d0b38b2d180d2b2f67493dd40b4b32
- MD5 SHA1 SHA512
- Path /data/data/org.upx.upx2/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 9383690e2793ae3ff2c5a4565fed0ec2e1ce21501abc4a4427b8e8496548ae0c
- MD5 aa93a2d0bdebed65ee5c0f07c8f43e1c
- SHA1 1d3c67be1226ab5ef2fb313c55b9e9f0ed23a021
- SHA512 6700a7fc9914212e50cc07bd332df1f0b3c4270f78f1a98aaa594724dcd6a6b695289d3a466dcfead86a7059a117ac9b61f29da81c4accf67eaea0e499576e2c
- MD5 SHA1 SHA512
- Path /data/data/org.upx.upx2/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- TLSH T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
- MD5 SHA1 SHA512 TLSH
- Path /data/data/org.upx.upx2/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 f1d8d5fe31b20189c86ca06a355e21252c62c47bf180f5a0bb05ce151488dbad
- MD5 9f7dc9ca1df097d45fd7f61246878241
- SHA1 e57b3654fbafa620b89a48a0cfac049e40dc8834
- SHA512 9a5c49ea084fa4439703bdc4f07fc3210cc7153b46ce9b2104c5c7920192924cff0f07c99faad55fd708e2a5ffe2b20e1facafab8f48e260c8a3d285959d6188
- MD5 SHA1 SHA512
- Path /data/data/org.upx.upx2/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/org.upx.upx2/no_backup/androidx.work.workdb-wal
- Size 116KB
- SHA256 66d2a0798385f3c41a48d611bd81aaa6ac02e3494f436cec1921343d7c38f225
- MD5 2a4a1fe82879f675f7c939c6acc76eb4
- SHA1 869d675e1d332e87bf899de9b724feb5139612ec
- SHA512 88fd48dc2dd95519cc220110f15a75e92359e46381611cd78b1e01e8de3e4fc0f137af4ceeba1347d4eb29c1f40cb1e2580923a98bad725e8c88faa35d3c4bfb
- SSDEEP 96:2nGL3e6+etidjnZRWzzb8/KeKcK+zS+ddKz+ZD86u0ExV:2ny3DtidjnfWzzb83zS+de+ZD86u0ED
- TLSH T13DC3459E0F592710C0A964B0D5D00BA57E3E423E9793E3D335920079EED2961DE2ACFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/org.upx.upx2/no_backup/androidx.work.workdb-wal
- Size 124KB
- SHA256 813747be5dab60a3d3fa8f81beafe98dfffbd6f1cbb0d5ad76ae4915b20ae151
- MD5 09a6fdb8e7406d60823415ac14156141
- SHA1 f3bcec5513363cfcbbde69285d59730095ed8a71
- SHA512 df92e7f8ef01c8dd388612a2e9b86fe10fa8fcea95a652e9c9fbb01af886f59d60e09336b2795673756ef0b058bcb397b5339d24958dc4d3ce1b0a019d8c64c3
- SSDEEP 3:xHXcdj2/kHwzXtRKVjWDV/m24vtd0XllgoqKXtRKVjWn:Cj2/kQ72VWmLf0p2Vq
- TLSH T164C392F317685972D1311779E82FD6DC5B47DE6449CEACB3651A0A643B002C453A5000
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/org.upx.upx2/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 3d07966686c00c6e500cd121e30534b3b4c0028d7f543f4c56b0106395ff2bd9
- MD5 562312f5888d6e886e4e083732bf4dc2
- SHA1 a2d6af4250b9056daf7aed7d04db6e76c2a57b7d
- SHA512 b73758a58662206a778d880b49c93b8d3bfa7214a8e74ea29f76c80633744bcc8ed47445dc92e18c82829c504a47082d83c10d9bb9d4508fb2c775e17a87d2d7
- SSDEEP 6:KsYl9FZdrlOERX4PBX4ogLugMBX4suuK+/9YD1aRDWOw2:KNzdTRmBEyPbP/64RDWOw2
- TLSH T1F172C26693800BB2E10953B254C8C34D1FA0A7394B52CB4F76121959EE027CCA652D08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/misc/profiles/cur/0/org.upx.upx2/primary.prof
- Size 2KB
- SHA256 2a5df6dc68136e0c344bd15dc950a59f1e394c5f3db9698c70e7ea058094081b
- MD5 e3c9007e65ce47b06feb8137d03b825e
- SHA1 3d66464379f95c74f11b1719006a687b7624fe60
- SHA512 da92ff4d39f075efc294259a515844a554a786de52d1f91d7bb2e54fc94d4b152ab15c4346dab7bdaf9b579b6966340cb4cccf9800551affc26a3b8cf32a1614
- TLSH T164514A130AB33DD9D5BB90FB23BE7A5C21315C8428ACBD0BC4855A346925F2D52E0363
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/org.upx.upx2/primary.prof
- Size 7KB
- SHA256 f8274ac0ab8c93d81f26506870bd8ba63f734fd7499f6994df35fee83b6408ab
- MD5 29417db1525018dab779adb97a698c06
- SHA1 a0eaba2d888c89d5bd57e27b5c4ba5f65485d454
- SHA512 16917857f797bc7c8fdedf2d49f0a434213ba8e807ff2556e4370c46f5d734198090b143b28c6e1068d318fdba9cea35ba21eb0cab3fe1da4b85be0abc80dda1
- SSDEEP 96:yUsR5cSkkJFHjr27jhzkRJOfyRwqOSbHmcDmyoj4VpA7CAdCiJzlamCm3EqJLZ:y3R5ctoFkCSqUcDRojGavZamCmUqJl
- TLSH T19AE1B04BB78C638E7262A86895E737E34C454C8C0A3E7664D1F09F8622E91047103C6E
- MD5 SHA1 SHA512 SSDEEP TLSH