1bef45d96a0cf707c4dc6a540db8138aae661b4277f2ed1645cabf26b8640857

Analysis

max time kernel
7s
max time network
66s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
03/08/2026, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bomber.apk
Size 6.4MB
Sample260803-qd2rpszyft
SHA256 1bef45d96a0cf707c4dc6a540db8138aae661b4277f2ed1645cabf26b8640857
MD5 a3358af5382ef44938f492df4f409ce0
SHA1 5c1148760548a1e4b93682d2204f7fbcae5f111e
SHA512 ff4099ccba9212ed3d0997287965960ae579fae9610a190a165bcfd9b823b4d75aa5da4f7d67017a18566785bed18aec3b0990c1980441c3545d4e906348da32
SSDEEP 98304:2f9Xc0D/V+3hQ/QnZCNEH9v+L0MyB3uEAULvFEeWDvv0rOaet3uSUQHtylLcLkeZ:2fxID/HFnMyB3zNoMtet31sl6OlWp
TLSH
T145662202EB29D59EC0FF46330976427412479D6E874797839AECB37819B75C06EEAEC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.aefyr.sai/code_cache/lLAPmTp.iqk	5085	com.aefyr.sai
/data/user/0/com.aefyr.sai/code_cache/lLAPmTp.iqk	5085	com.aefyr.sai

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.aefyr.sai

com.aefyr.sai
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:5085

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

lLAPmTp.iqk.tmp

Path /data/data/com.aefyr.sai/code_cache/lLAPmTp.iqk.tmp
Size 2.8MB
SHA256 14960cbb514d87eb00baf7f83266b1f4098834daa90415b88f7689f779a03014
MD5 dbb825663dfc9a501c15579f7dd53cb3
SHA1 0bbafa3cafa0e61b7efbcdf22dba6b421a4377f4
SHA512 0c7e665fa60c76481202a1becd634c8625421b3c3f8aa5411dcbcbdb3d9cfabed8467bf1adf34bd715d5158367f10674591784051143014ba65969a6471f5640
SSDEEP 49152:GUiPe8Jz8K62dLUWgK0pYlAvNv+jjw0K2o:NFK62Qf+UD
TLSH
T139D59D13AA094C22D4AD9339E0B75B10777061465B43E35B324EA1BFBC732C55AEA6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lLAPmTp.iqk.tmp

Path /data/data/com.aefyr.sai/code_cache/lLAPmTp.iqk.tmp
Size 2.8MB
SHA256 aa21149c7167acc82f06f25b2acaa0fe4ed1c5e75ddc8e47e9c710ebf8ea9d60
MD5 a9d37117a9448788f841eee06e5f0367
SHA1 da8822e1e00ed83c040130210bb8911732eed0fc
SHA512 a6954fbaf79b9984d0ddc12da326effa625730cb6410acac2e50337113db42b255d45b341ac476254d9a22d5674bb2342ceeb84371baab1611a7db2a289efcb8
SSDEEP 49152:CUiPe8Jz8K62dLUWgK0pYlAvNv+jjw0K2o:pFK62Qf+UD
TLSH
T195D59D13AA094C22D4AD9339E0B75B10777061465B43E35B324EA1BFBC732C55AEA6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geo_state.dat

Path /data/data/com.aefyr.sai/files/geo_state.dat
Size 1B
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads