Analysis
- max time kernel
148s - max time network
152s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system - submitted
27/07/2026, 12:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
1785095449105.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1785095449105.apk
Resource
android-x64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
1785095449105.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target 1785095449105.apk
- Size 5.4MB
- Sample260727-psnb7asdne
- SHA256 ed6ab577c5a114df3caa16b08258c4dfe6f435b81f02accc4ee06d4432ca95cc
- MD5 5301acff30df9713408cd9c75541ada8
- SHA1 c63d79831e51b57e0877247543ea256c82143301
- SHA512 aa5c9745aae0e3b18c8ac336fa21221162ebee0bb4873decfcd85449b2cc6153249ca88f7f822916cb1b5d9232a2d2f5c4441698abed2112433b874987c0c979
- SSDEEP 98304:Op81biwPNOogLCrFXqZ7EyZ9zZH9ewU0BRtzyXY2S4Yz9WOjDbsDuxw7Hydb:Oxw5qZYyPdkIr4YkOjD5SCb
- TLSH T15346E04BFB48E96BC4F753B24279532261074C268B43D7C35955723C1CBB6C0AF9AAC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process Anonymous-DexFile@0xc99c8000-0xca2ff9d0 4380 com.cyez.orho - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cyez.orho - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.cyez.orho - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.cyez.orho - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.cyez.orho - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.cyez.orho
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.cyez.orho/.jiagu/libjiaguv1.so
- Size 222KB
- SHA256 dd76df09dcf01b53987509bcdd8788b53009df442971c501335da0db0d1af5f9
- MD5 690192a31144408bdc7bf8378378a66c
- SHA1 e96f50684916058215075e2bf5da47430e06d3bb
- SHA512 d65f45841d92fa9f724f591bb4ac1a3a64623fdcdcf5c59d067201b4661d8ea1a5bb8072d73d7760bb97838ae2cdf75df3d3a0b92461b7cc62cd4ad5eb4a388c
- SSDEEP 6144:MFsQl6Tqs9Wn9OUfT4toCDEhL01i/7NOK0D8ueGR9WumWF1uf21gh7P6K7PUUYuR:2Df7iasUYu/8iGE
- TLSH T18C241906F8408CB3D93A6179235FD7798A1B28158B37C8CADE687E546E23B709F5D6C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path Anonymous-DexFile@0xc99c8000-0xca2ff9d0
- Size 9.2MB
- SHA256 5141e8f17791aa864a7ad0ad8fb87b1132729672362f4cd5fa02075c2fd0e2d1
- MD5 15c2e481dd8cd5393b05a78f04a80d64
- SHA1 e00f92ed7a54cf5fa5ce8cc16861824704cce6da
- SHA512 27663511abbe456fbb06a7081f2f039049fd617cd2c12dd3018df380592f3da162030fe9645b213ddc28c75e3d8148837ff1973ad258eca76b68906ac6bd0ba0
- SSDEEP 49152:FgZYMXecpb6K1DiIfo+xNoZ0ajPK627EI+/mIOzR4oJ88p2dUKGi/z3VyyS5UpAo:FeXyIfo+iK62f6UM3VtcVwlxex/Ovlx3
- TLSH T1F5A6AF27FA119D33C16E633318FA5305E730634AAB8383471645D9BCBCA36D59AEA34D
- MD5 SHA1 SHA512 SSDEEP TLSH