albiriox | 3269a0116ce0915afdd32e8d87b05ae9f5c00fcf0a6729add39a6a87aaf30089

Resubmissions

03/08/2026, 08:50

260803-krt15ascnc10

23/12/2025, 14:30

251223-rt4rnsspex7

Analysis

max time kernel
147s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
03/08/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dexopt.sssgf.apk
Size 6.9MB
Sample260803-krt15ascnc
SHA256 3269a0116ce0915afdd32e8d87b05ae9f5c00fcf0a6729add39a6a87aaf30089
MD5 b7555d45ec31adc23ea13ff173926251
SHA1 eb53b2e264c2eb9561b75ece770a259d55319820
SHA512 b70075402ba6d11f8b2dfe059acf1320389d8a995ed722f699679017724276f99daf53f13bbcdc441082fa35cbfdcf17d2470ad22e6346ccbb8767467ceb2c7e
SSDEEP 196608:ymztyyGUWebdmCr+0B7ed2HoCdKyOG9cw:y0YUWepr+Ac2H0yOG9cw
TLSH
T11076E08AFFC6989AC0F35B33CD7591B541475C2647838A836D58B26D187B6F08E4EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker defense_evasion evasion execution albiriox infostealer persistence rat trojan

Malware Config

Extracted

Family

albiriox

185.208.156.239:5555

Signatures

Family: Albiriox
Albiriox is an Android RAT and banking trojan first seen in November 2025.
banker trojan infostealer rat albiriox

Detects Albiriox payload 2 IoCs

resource	yara_rule
behavioral1/memory/4274-0.dex	family_albiriox
behavioral1/memory/4249-0.dex	family_albiriox

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.nmz.nmz/app_fix/ql.json	4274	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.nmz.nmz/app_fix/ql.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.nmz.nmz/app_fix/oat/x86/ql.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.nmz.nmz/app_fix/ql.json!classes2.dex	4274	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.nmz.nmz/app_fix/ql.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.nmz.nmz/app_fix/oat/x86/ql.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.nmz.nmz/app_fix/ql.json	4249	com.nmz.nmz
/data/user/0/com.nmz.nmz/app_fix/ql.json!classes2.dex	4249	com.nmz.nmz

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nmz.nmz

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.nmz.nmz

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.nmz.nmz

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nmz.nmz

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.nmz.nmz

com.nmz.nmz
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4249
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.nmz.nmz/app_fix/ql.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.nmz.nmz/app_fix/oat/x86/ql.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4274

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ql.json

Path /data/data/com.nmz.nmz/app_fix/ql.json
Size 3.6MB
SHA256 c8b988b62a303a591116fe6464facdfe978235b38617ff0c1b3a2a4eafe55208
MD5 a923deb7607199e2cefe9f3bb74c5bf6
SHA1 5fdd4871f1fa8235beafe19e9014c3f0009d78a0
SHA512 e61b4872c86b4997a2dd127110e17a4e2153bae556e6b7000181f17b7dd6e13419a1aa36d396e2800a37b1e6139d895dec1799a9896a60497228b7002e8f5c47
SSDEEP 98304:CloOI69AmwV5y8Qq825eaRSRs3JGWRQaMDC/gAH:QI6umw5NQs5IszJMDC/gAH
TLSH
T14B063324FD9FC16CD806C3A39FDFD51D00292DA160019AE976F5678138712BBA787F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ql.json

Path /data/data/com.nmz.nmz/app_fix/ql.json
Size 3.6MB
SHA256 ba9be26e035e007eb72919b5273c80bf52512f3da1cd0443bb0b3c0238272e50
MD5 7802242f0fd3e5e1816f5ede4a9a1f01
SHA1 5ab7685d26829357a0d2691c656feece1a6a4a1d
SHA512 5efac840b40c0d630a1449ff1ce0f269d97bcbf501c32077dda242da5b8b133195561f57aeaaecc4fe7c1e2a3995644381f7e1c07accee81ab8ba62b747ddad1
SSDEEP 98304:fct6GEbFLF+Ntc8yoG5cbTTQz//GMwZPLTJQUaVW9R0csw0arm0z7Ue:fct9E9UNKhoG5cbfC//KPXSFVW3rm0v5
TLSH
T1850633F1C54D461B274F2A600E86B91ED0334B654F43DCAA8B5CC768D5FA02B3F66A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/com.nmz.nmz/files/profileInstalled
Size 24B
SHA256 78ec79133825de5093383aaec794ad42ee8d7f0d34e6e422f343d6bda845553e
MD5 967a90b603906b6e2f52ec4ecd186186
SHA1 d68fa937c8ae5aea2261d993a91b09c6217d35f0
SHA512 9b3f73ab92d36b2ef2bea1b3ea7661e9d903c6301414ceb4f7bdee3fd22c045d50c18388741c4de851d464f4a5c38a16e2b995bcd5b53a495afe98e5cf7fabf9
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.nmz.nmz/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.nmz.nmz/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 aab2d0bfb2d71a37842ac66e71ebe38f3314470e4e314217865afe7abc66a579
MD5 9f1669a6521e42e154f141c3b73a9653
SHA1 35928f3bdca7f679ebc63bb682e95a9bc0a39bc6
SHA512 26407223203de8f96c9bc2667b14f398d6838852623f689465f695a8efa4e0e2ad47cf5ecc8ae7ce443659f85f58dd02eff3bd4e0bae2d6aee18c37fbb2865c2
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.nmz.nmz/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nmz.nmz/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 76fbf04749c1201255e6e67c9e7a0478b33fba589c232a6dfe7bc39a00d45c58
MD5 68f6d9b26f19b4ae4dad630b95268a1a
SHA1 bc901b53c83374d981b22a66dfcd4f2418d4a8f6
SHA512 de5246c2fdcc8b676b1353ce5f41823d4ed472458d3569a0a709f4cf04fd2fa8f7d1d494d7c24af467edcd6abb1c9321f03b581ea5b275977dbca49d0323d376
SSDEEP 96:ACpHmq6+etidjnZRWzzb8/KeKcK+zSjmQddKz+ZD86u0ExV:A2H0tidjnfWzzb83zSjmQde+ZD86u0ED
TLSH
T167C3558D0F9A6640C0A954F0E5E00BF1793E911ED7E3E7D2649110B5ADD2A31DE2ACF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nmz.nmz/no_backup/androidx.work.workdb-wal
Size 213KB
SHA256 821144fc7f5452ce9f79848308e60ba17b93dcbe124e3aa1ba504c23d179b9cf
MD5 a7d5edc46d75347ea99d30467946441d
SHA1 d02860bed4a06f354cd8ccbcc5edd75f9d5f7151
SHA512 c40333a740b1132e2d81f2c697ebd8d838580f2bfb1050ecced92c9f625bc984033dd3f217516de666b898163a17530b16620fe96d318854056c289eca88f5ac
SSDEEP 384:5w1DtY75+Uk1DtYf1DtY151DtYvd1DtYy:kDtY7IDtY9DtY1DtYXDtYy
TLSH
T1A8247DC6E3E2D2EEC124427BBD7146EC31B5EFA8C1DE4EE3225AB31132656160B1B714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nmz.nmz/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 998fbe0f65b095154e234a2e6e58ff4979545d431134dc3e5b3056f4f4f57ce9
MD5 b9cc74f4634990697f4d0dd0a1fcf548
SHA1 30b5e636950df5e1e83d8ba951877afae6542806
SHA512 574d0924ef4ed656ab8777de06fbd528fec0b4547f39913b4e61bc8b6fa647e6d06ee7531956cc27df43cde7c2c7be0057e9d74aff9df7578bdf5020207d6398
SSDEEP 6:KK4lR9FZdrlOERX4PBX4ogLugMBX4suuK+/DC9XlllPTllHbiOw2:KK4VzdTRmBEyPbP/gRlHbiOw2
TLSH
T1B472C251A3C29AD3C118033264F5C30D3E70F61AE6A2CBCB195428942D027A856A2F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ql.json

Path /data/user/0/com.nmz.nmz/app_fix/ql.json
Size 9.1MB
SHA256 df2fe248fb0c237fb66a8a8d32438450ddf855e0cf8d3715bdc574bd087bcd81
MD5 88163f09293e1594d8e5044a8cf014f2
SHA1 939abd94319ea0107901f452a63b534a76256551
SHA512 a39e7d844a3f54878d1a7d366386b4a47bf1b7b8b80b5d1cf754daca0ea86a787600b3d34d8bede20d3db78af538dd58bc56b197d63783a88e44c4a9e14c3874
SSDEEP 98304:XGGvqlRkiQyE9jLmMqFsme3XwczMRXSNdTmlB8OR:XG8qlRkLzFzMRg6bv
TLSH
T17EA67C57A7561833E1AE8B3258FB0346B733A2477F038B431605557CBCC72C49BAA7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Download

ql.json

Path /data/user/0/com.nmz.nmz/app_fix/ql.json
Size 9.1MB
SHA256 a1ed3680956862e0b42a8237a5a57669fb127cc76937a6494ed684404d98a92b
MD5 1b3e751ff8d8765dcc94b5e00b416a62
SHA1 900cf6d0119296db60794a25f09241e7440ffc76
SHA512 affa37da0a9adcf781b86268139d5137afb8f2b97500ee309155b8f86a515ff66c5b95fd49053f0dbcaca6c8f5fa8c5a76cbdeb02f188c402132e2a22a86394b
SSDEEP 98304:XGGvqlRkiQyE9jLmMqFsme3XwczMRXS/ghFN0tedXf8OR:XG8qlRkLzFzMRNv3v
TLSH
T127A69C97E7A20832D1EE87366DFB0305B772624AB7435B83124598BCBC836C4CB997D5
MD5 SHA1 SHA512 SSDEEP TLSH

Download

ql.json!classes2.dex

Path /data/user/0/com.nmz.nmz/app_fix/ql.json!classes2.dex
Size 396KB
SHA256 8d49b575ca7bb65a7eed7f5890d7f592e54e69c9f27d5c968bd2e96189c437c7
MD5 74bf018b88e99709f350b1ab9034876f
SHA1 17e99a52153715392d17c11cd0957b16cf0425dd
SHA512 e7e6f2999a255785cf68ee9ffaec20a75e6e68cf767911372e594db08979762e39302456782309e3c68ad5a04cd9a6d92320c23f1bd72ecf2bece875e4104276
SSDEEP 6144:s9V87MbZQfmS3HCVoe+4t7RiFQ5qwVMBjks4r4hT+vFac:yV8gbifuVou8U+BjZ4rOTYac
TLSH
T137842967F2550E32D57F0AB208E713E01320B3DBA793D7039A449668FC9B780D65EA6D
MD5 SHA1 SHA512 SSDEEP TLSH

Download

ql.json!classes2.dex

Path /data/user/0/com.nmz.nmz/app_fix/ql.json!classes2.dex
Size 396KB
SHA256 4a8a948659b56e63fd61b85f426f6d74ea981e3838c6a637b345014d20e0ac2f
MD5 8059ed50821caa10edbd7c3d436cec59
SHA1 0fd54297fd515ea5a67f492ced2aa5f0581c3053
SHA512 ad9caa4a68d8ba75a9f9d9151324c9c8d8f726424d408a688d35d63bd5dc5d19fd94f2caa51b644011ab6f40edddb90d5216abd366d10519a89b54ea1a82d0cb
SSDEEP 6144:s9V87MbZQfmS3HCVoe+4t7RzBvlNDIqo1Yo06CxOc:yV8gbifuVou5BvnD5UYRHOc
TLSH
T1DF844A67F2950E31D57F05B60CE312E02320B7EBA783D3039A44D698BD9B7C1D25AA6D
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads