Overview

overview

7

Static

static

6

Gl_Chrm.apk

android-11-x64

7

1_b7e404b6ec.apk

android-11-x64

7

Resubmissions

28/07/2026, 17:50

260728-wevbxaaf687

28/07/2026, 17:10

260728-vpsqdsad937

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    28/07/2026, 17:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1_b7e404b6ec.apk
  • Size 11.0MB
  • Sample260728-wevbxaaf68
  • SHA256 16ac49155d1ed38b1c65f7dd037e049263556e07e760d3a16d6810e7bf244d1f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bankercollectiondefense_evasiondiscoveryevasionimpactpersistence

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.bexearfpc.dfuxqmtej
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Reads the contacts stored on the device.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4857

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        classes.dex
        • Path /data/data/com.bexearfpc.dfuxqmtej/app_dex/classes.dex
        • Size 5.1MB
        • SHA256 2538c724edd97f50bc0399b67494bc8583e9e009d499c2bd7fd86ca6c32afac3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        classes2.dex
        • Path /data/data/com.bexearfpc.dfuxqmtej/app_dex/classes2.dex
        • Size 5.0MB
        • SHA256 160effae2978bce9bc81eb9bff0e79ea8e77b516e6a6f5fa64d0b87cf5fbefd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        classes3.dex
        • Path /data/data/com.bexearfpc.dfuxqmtej/app_dex/classes3.dex
        • Size 2.2MB
        • SHA256 fd020e224a9a10abf424c7e892306dd839bcdb2b82af3158794f2b70101ae9b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        classes.dex
        • Path /data/data/com.bexearfpc.dfuxqmtej/cache/classes.dex
        • Size 2.0MB
        • SHA256 cf5c42266cb651ad5c37a873ec49099631f0cdb3b56b1889a9c37f493672d2eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        classes.zip
        • Path /data/data/com.bexearfpc.dfuxqmtej/cache/classes.zip
        • Size 4.7MB
        • SHA256 f745250d71bd5bfad4781926db27dae076ee29d22ba555595952984b6e162dba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        classes2.dex
        • Path /data/data/com.bexearfpc.dfuxqmtej/cache/classes2.dex
        • Size 1.9MB
        • SHA256 b695f62d73ba03f42df44c704756010c44004a33cc54341140def3192ec84012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        classes3.dex
        • Path /data/data/com.bexearfpc.dfuxqmtej/cache/classes3.dex
        • Size 816KB
        • SHA256 07b378df3b2e3b047e5fa3e23f1d5a7a421afa62a5d27ce282e33e24e4e1ae85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb
        • Path /data/data/com.bexearfpc.dfuxqmtej/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/com.bexearfpc.dfuxqmtej/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 4afd4abb38ee84fc3eab78dc286df45b1273a7ff3353629293832083b15f7d55
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/com.bexearfpc.dfuxqmtej/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.bexearfpc.dfuxqmtej/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 4a9ecb245c07a8d5f775c1db7d565797cddff02beb7b625867786a4f60762cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.bexearfpc.dfuxqmtej/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 1bd8e12d1bc1f7c959ba5b7b9a07126fed9424619e5be3325bed4020070a0f2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download