Resubmissions

29/07/2026, 06:43

260729-hgx9paaq5z10

29/07/2026, 06:07

260729-gvr46aysdy10

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    29/07/2026, 06:07

General

  • Target
    db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c.apk
  • Size 9.6MB
  • Sample260729-gvr46aysdy
  • SHA256 db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.oupplf.hjxwoz
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Checks CPU information
    • Checks memory information
    PID:4799

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1

        • Path /data/data/com.oupplf.hjxwoz/cache/1
        • Size 427B
        • SHA256 f53622ba575388bca270c7137327e12d4996587047a31fe57c586f2fcdbaf1b6
        • MD5 SHA1 SHA512 TLSH

        ~test.test

        • Path /data/data/com.oupplf.hjxwoz/cache/~test.test
        • Size 4B
        • SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
        • MD5 SHA1 SHA512

        app_icon.png

        • Path /data/data/com.oupplf.hjxwoz/files/app_icon.png
        • Size 100KB
        • SHA256 a1f9632e4fde058b43bbeb137ad446d761e54950b9e5e238ef4d76cb8ee4ed83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        db.db

        • Path /data/data/com.oupplf.hjxwoz/files/db.db
        • Size 44KB
        • SHA256 274fe3e82fc2630d99809afd6a1c64768a77ed69c04b33e0df6a292a5a042203
        • MD5 SHA1 SHA512 SSDEEP TLSH

        design.txt

        • Path /data/data/com.oupplf.hjxwoz/files/design.txt
        • Size 1KB
        • SHA256 ed5bcc3fe37e5ab8e659b891bbd1ff76d75cb7796b371fb158d567eb22d290c7
        • MD5 SHA1 SHA512 TLSH

        designxiaomi.txt

        • Path /data/data/com.oupplf.hjxwoz/files/designxiaomi.txt
        • Size 1KB
        • SHA256 6462cdc6bdabfe21a3232252e29ba091dfcf6243335345ff1a17cd7fbafe97e5
        • MD5 SHA1 SHA512 TLSH

        files.zip

        • Path /data/data/com.oupplf.hjxwoz/files/files.zip
        • Size 2.7MB
        • SHA256 553952900bf10d8d63955de2af68b8f5080d7815e0393f32ee484e1b72330ce9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        imgarrowdown.png

        • Path /data/data/com.oupplf.hjxwoz/files/imgarrowdown.png
        • Size 1KB
        • SHA256 32d9f596bcb9a6c5b497c843d4a1176979fea3c4bdb77b8c9f1a13726003e146
        • MD5 SHA1 SHA512 TLSH

        imgcamera.png

        • Path /data/data/com.oupplf.hjxwoz/files/imgcamera.png
        • Size 6KB
        • SHA256 9bb1a42dbcb9acc9640727d6edfede011df24e0a3bf7fe4c7bb74c8a9d65b85c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        imggallery.png

        • Path /data/data/com.oupplf.hjxwoz/files/imggallery.png
        • Size 6KB
        • SHA256 deca6226c9ef5ebd1fca2d06036eaabe9e8745b782b46872dffa2dfa49b9caf7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        imgmessage.png

        • Path /data/data/com.oupplf.hjxwoz/files/imgmessage.png
        • Size 5KB
        • SHA256 e9089bb6e29e711b36116bcd7ba87b9592c239a4b9b4fd1155ec28cb4d471c23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        imgphone.png

        • Path /data/data/com.oupplf.hjxwoz/files/imgphone.png
        • Size 5KB
        • SHA256 af70d22ce6d7c2af6cc81e87e1380334ef5d9bba38d6de1cf94eb83a5d97705b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        l_homescreen.bal

        • Path /data/data/com.oupplf.hjxwoz/files/l_homescreen.bal
        • Size 2KB
        • SHA256 731766f79da8aec555e20f75a7f4ee29f4eedda8aec373e92c6fbfab0136210a
        • MD5 SHA1 SHA512 TLSH

        l_pagescontainer.bal

        • Path /data/data/com.oupplf.hjxwoz/files/l_pagescontainer.bal
        • Size 1KB
        • SHA256 43bb1cf8a7316de8ba757a1bdc5aa399a230f6dce758202734f22e0b56855720
        • MD5 SHA1 SHA512 TLSH

        l_pagescontainer2.bal

        • Path /data/data/com.oupplf.hjxwoz/files/l_pagescontainer2.bal
        • Size 1KB
        • SHA256 3fd58ca0c4af622c3abd12ddeca20b75d8224610bba9476d7da4582264a26b9e
        • MD5 SHA1 SHA512 TLSH

        l_pagescontainer3.bal

        • Path /data/data/com.oupplf.hjxwoz/files/l_pagescontainer3.bal
        • Size 2KB
        • SHA256 6f976842593169bdc5aaad6845c2cec3cc54bb9b29009480324e75e78baba294
        • MD5 SHA1 SHA512 TLSH

        layout.bal

        • Path /data/data/com.oupplf.hjxwoz/files/layout.bal
        • Size 1KB
        • SHA256 47e720e35e185d8497e80ff0e4c8c48ff0623b37feabafcee457073a5d2ba37d
        • MD5 SHA1 SHA512 TLSH

        loading.gif

        • Path /data/data/com.oupplf.hjxwoz/files/loading.gif
        • Size 121KB
        • SHA256 2013f490d45638cada331b3474ed65b9a43cec60da773accc98332e58c06336d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pg-de.html

        • Path /data/data/com.oupplf.hjxwoz/files/pg-de.html
        • Size 420KB
        • SHA256 ba6c903c5e79d53ababf0995977af72885f942e54458eb6eaa534e023eb2f493
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pg-en.html

        • Path /data/data/com.oupplf.hjxwoz/files/pg-en.html
        • Size 420KB
        • SHA256 6c99eaf9f9dd37bfd95a2b115461217d16b459a6b63c33cee56b37286379c83e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pg-es.html

        • Path /data/data/com.oupplf.hjxwoz/files/pg-es.html
        • Size 420KB
        • SHA256 a2a61b3a253554768f6ce48523fc0c6c492230317db072a9be0f8a2e95ce1a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pg-fl.html

        • Path /data/data/com.oupplf.hjxwoz/files/pg-fl.html
        • Size 420KB
        • SHA256 ea01b841d8fe42d6e9b819b14886375684f4875042b20bb4c6091f7e1347f205
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pg-gr.html

        • Path /data/data/com.oupplf.hjxwoz/files/pg-gr.html
        • Size 420KB
        • SHA256 759f26572c97390acedd5373ad039870914095e0c0ce0aa421ec95793a886187
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pg-it.html

        • Path /data/data/com.oupplf.hjxwoz/files/pg-it.html
        • Size 420KB
        • SHA256 bb882a49f48e199bbec097e87efe1224a0c79db0464b17e407858450f9dc0404
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pg-pt.html

        • Path /data/data/com.oupplf.hjxwoz/files/pg-pt.html
        • Size 420KB
        • SHA256 1e34f728255a05d5daffa36e7124dd9fc4204def9102a0cf27588e8c0db2d734
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pg-se.html

        • Path /data/data/com.oupplf.hjxwoz/files/pg-se.html
        • Size 420KB
        • SHA256 f496a030259c720c36d3cb3049ec031db32b1ca478df32f44f38da062efd31ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tmpico.png

        • Path /data/data/com.oupplf.hjxwoz/files/tmpico.png
        • Size 2KB
        • SHA256 23afbd8afbe3f734e1a6208562bffbd7baf0e6857476a5cd6e64a337ecb3ccde
        • MD5 SHA1 SHA512 TLSH

        txtscreensize.txt

        • Path /data/data/com.oupplf.hjxwoz/files/txtscreensize.txt
        • Size 11B
        • SHA256 2230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89
        • MD5 SHA1 SHA512