Overview

overview

10

Static

static

6

6a41be0be4...2e.apk

android-13-x64

10

Resubmissions

29/07/2026, 06:50

260729-hmfltsar5t10

29/07/2026, 01:55

260729-ccfaesep3x10

29/07/2026, 01:54

260729-cb1vqsep2s6

Analysis

  • user interaction
    yes
  • max time kernel
    42s
  • max time network
    46s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260708-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
  • submitted
    29/07/2026, 01:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6a41be0be47457c93f9639921e5199c3cb89ba117dcc6f05e86441414384422e.apk
  • Size 6.5MB
  • Sample260729-ccfaesep3x
  • SHA256 6a41be0be47457c93f9639921e5199c3cb89ba117dcc6f05e86441414384422e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bankercollectioncredential_accessdefense_evasiondiscoveryevasionherodotusimpactinfostealerpersistencerattrojan

Malware Config

Signatures

  • Family: Herodotus

    Herodotus is an Android banking trojan that evades detection by mimicking human behavior, first seen in October 2025.

    bankertrojaninfostealerratherodotus
  • Herodotus payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Acquires the wake lock 1 IoCs
  • Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

    Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

    defense_evasion
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Requests enabling of the accessibility settings. 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    defense_evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.ypunxi.uzonfcyw
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Checks the application is allowed to request package installs through the package installer
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests enabling of the accessibility settings.
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4178

Network

        MITRE ATT&CK Mobile v16

        Initial Access

        Execution

        Persistence

        Foreground Persistence

        1
        T1541

        Privilege Escalation

        Defense Evasion

        Download New Code at Runtime

        1
        T1407

        Foreground Persistence

        1
        T1541

        Hide Artifacts

        2
        T1628

        User Evasion

        2
        T1628.002

        Impair Defenses

        1
        T1629

        Prevent Application Removal

        1
        T1629.001

        Input Injection

        1
        T1516

        Subvert Trust Controls

        1
        T1632

        Code Signing Policy Modification

        1
        T1632.001

        Virtualization/Sandbox Evasion

        2
        T1633

        System Checks

        2
        T1633.001

        Credential Access

        Clipboard Data

        1
        T1414

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Discovery

        System Information Discovery

        2
        T1426

        System Network Connections Discovery

        1
        T1421

        Lateral Movement

        Collection

        Clipboard Data

        1
        T1414

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Screen Capture

        1
        T1513

        Command and Control

        Exfiltration

        Impact

        Data Encrypted for Impact

        1
        T1471

        Data Manipulation

        1
        T1641

        Transmitted Data Manipulation

        1
        T1641.001

        Input Injection

        1
        T1516

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        mqttAndroidService.db
        • Path /data/data/com.ypunxi.uzonfcyw/databases/mqttAndroidService.db
        • Size 20KB
        • SHA256 0bc5025aa612177c29db427df9c17ee83801b9cda45e87066073819ed3ff3621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mqttAndroidService.db-journal
        • Path /data/data/com.ypunxi.uzonfcyw/databases/mqttAndroidService.db-journal
        • Size 512B
        • SHA256 a7d0e2e80295d246bfd8349b84e7d94ebbd6fb322406df0ddb453be0321359a2
        • MD5 SHA1 SHA512
        Submit Download

        mqttAndroidService.db-journal
        • Path /data/data/com.ypunxi.uzonfcyw/databases/mqttAndroidService.db-journal
        • Size 8KB
        • SHA256 707a6f56c1a933620b7732661cf89027c5a7cd5b7fe1560c8c49c22dee248009
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mqttAndroidService.db-journal
        • Path /data/data/com.ypunxi.uzonfcyw/databases/mqttAndroidService.db-journal
        • Size 8KB
        • SHA256 fa04c41f4c663db49e7ce89c2007156f660cfd2c5c88f0e8823596aafa7eb0a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        profileInstalled
        • Path /data/data/com.ypunxi.uzonfcyw/files/profileInstalled
        • Size 24B
        • SHA256 3b362372bc78c6df973fbbcfa580907a9ef2d46b47d0152f55e0bc97ba9e6065
        • MD5 SHA1 SHA512
        Submit Download

        profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Path /data/data/com.ypunxi.uzonfcyw/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 d48a359efbdcc737c43c06e56fec31e926ede5b57fd9cc17c6a18f42cea81198
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb
        • Path /data/data/com.ypunxi.uzonfcyw/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/com.ypunxi.uzonfcyw/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 e23a27e64e2e70acfea758d952862428b4e220808febfd86eadd3d1965f2a3c4
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/com.ypunxi.uzonfcyw/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.ypunxi.uzonfcyw/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 f029f994b8c541486a00bd65c1881bb3909b7ede16cbd725135a9eea7d3a470d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.ypunxi.uzonfcyw/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 bf0747d2b4443aafe67065d83b97ce1fac367e2aa55c715b32527cc7b0fb17c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        [email protected]
        • Path /data/data/com.ypunxi.uzonfcyw/oat/x86_64/[email protected]
        • Size 13KB
        • SHA256 0b8502444c8f5a36a523f85d8d3e308d9f8cecc277730f60c46d2f9f04126f0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        primary.prof
        • Path /data/misc/profiles/cur/0/com.ypunxi.uzonfcyw/primary.prof
        • Size 1KB
        • SHA256 2427b46543739c43daa347264b4898cd847505895d6edb8844251c758ac472cf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        [email protected]
        • Path /data/user/0/com.ypunxi.uzonfcyw/[email protected]
        • Size 602KB
        • SHA256 5281e44fdd82e2c79a54b145517bc7295dd14adc10ca69ec6986dcc242394ae9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download