a6cd7491360776f91fffb8c5610fc03c53d4348d10dab0c165dbd2c753f75229

Resubmissions

08/08/2026, 08:16

260808-j59hasce297

08/08/2026, 07:18

260808-h45bhscc957

Analysis

max time kernel
125s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
08/08/2026, 07:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6cd7491360776f91fffb8c5610fc03c53d4348d10dab0c165dbd2c753f75229.apk
Size 6.2MB
Sample260808-h45bhscc95
SHA256 a6cd7491360776f91fffb8c5610fc03c53d4348d10dab0c165dbd2c753f75229
MD5 ee8c40e767dca59fa26b2089b6e408e7
SHA1 0799d9956b40b50a827a9944f568339704c8075a
SHA512 7a06b89644af724eeb7cc48945a750a60b64a2bfbceb79f25f551f53b96cb6de1750008775be05da1387be386e830cc3afa03d0573f51ac58341e477850c04b0
SSDEEP 98304:IeVI//MuoJ1z+uq2qzkbKKNRfWeQ1zeHIcOE4Fhp9HHjORHoEkKmGywQ3XpK:IeG33oJ16VLzyKr1+BmZHjDKmGaK
TLSH
T176660187F334992FCC7701360EAA927552574E868E96AB8378443F5C68776D80F4ABCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nullx.corporation

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nullx.corporation

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.nullx.corporation

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nullx.corporation

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nullx.corporation

com.nullx.corporation
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4284

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

flux2-8ebbb-default-rtdb.asia-southeast1.firebasedatabase.app.443

Path /data/data/com.nullx.corporation/app_sslcache/flux2-8ebbb-default-rtdb.asia-southeast1.firebasedatabase.app.443
Size 8KB
SHA256 42ae3e017aa87eba0a675741af4b44e411a99612ade20bcc936b74318b7d235b
MD5 90d14894065bd0ebfc31d44267c0ea4c
SHA1 35c8bd417b3d5101d68f54edd900f73634fcb9c4
SHA512 f40b8828338e103ba30be17518916531be67162acc4c100865ffb819433547ffbea2d331ea9261f9405b00dfa752e581fe35a274ad4601d42fbd6b65245de27f
SSDEEP 192:yyWTFFxqko1lBLB+ayXQzWTFFx+ko1lBL6+ayXQ:yySodLB+OOodL6+
TLSH
T12E02F8DA0F7DBC07BB6ADD24F4D98A0F7D7066C1A98D2492B206C13D5D48BC47E5150D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 18c4431e82e8c017022872133295a6f2cf98d605f1ea5f01c9ea5bc8fe55f997
MD5 f160b0db17999bdb18b92f312a6cace3
SHA1 2b9a6c19933bd34f94b58ad92f71e469fd07e3f7
SHA512 f54ee493d208c9a12603745c66503ad27c9013282d493a573803d703b41c23b46e19acd92d6a31da4d1e801b76badace11dc7c3baf97a879a60926e8019c437e
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-wal

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events-wal
Size 68KB
SHA256 37939fbe5df605bac8122f146299db74a0432dfd671027183ae973783ea067a9
MD5 431f974cadf458b04a58fbc855447699
SHA1 1fc0e8181b81c09ed34e4bfbfb3d7ccf84ec8dc1
SHA512 e3db00c3e642e06cc1b4dd12fa174891a91ee68ad930db7efd9610d38eca726a6f6286c60277f7bf11a7c9c4f5b964be0a7f56d96e68f3f9d8a2de98fda8c682
SSDEEP 48:VzNSP/wh1g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSP/UHkc:R0P4IMEX0wIyNjaPI/
TLSH
T1CF63525C9B283223C1AD1C3ED3E243531E7C93DF976383663AB04CE9ACC61597061999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firestore.flux2-8ebbb.flux2-8ebbb.%28default%29

Path /data/data/com.nullx.corporation/databases/firestore.flux2-8ebbb.flux2-8ebbb.%28default%29
Size 148KB
SHA256 c5e2caead9a6eefc75765d29cc2de573555822e1810c0d3c3bc6cace54b272c7
MD5 d20d6b0496194eae033863b523fb0871
SHA1 97ca448685425ccab3903fb69fa0e3ff5ec890ed
SHA512 cc92f75b80af587741b715a8ee53150606c8b8185468a9bf1a640c413cbb8b79eb89f63284c3f4709379be326ebc015cd47502bf1bdf63cda375d278a52fe9cb
SSDEEP 96:8oQIVR0FkLoQIVw0FkOobIVW0FkCobIVm0Fk+U08keqoQIVR0ljg3DEIG3QIzZ6u:8iud778keqng3DEIyt62A2cpBQHNGG
TLSH
T1DAE367D21F24A224CCD3163265F347737AFA8B86B96372817CEC82164CDA241996DDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firestore.flux2-8ebbb.flux2-8ebbb.%28default%29-journal

Path /data/data/com.nullx.corporation/databases/firestore.flux2-8ebbb.flux2-8ebbb.%28default%29-journal
Size 512B
SHA256 435d1d67458de2c5d1d5f407aca770da1e6aa15036cb3484662d6b21c3c9c1fa
MD5 5c6cc3d5f6d903105c092c944e396e3b
SHA1 ff927c03d899b9f3b6651ef614a5b29058358e96
SHA512 0502cf8712950324e7164650a66d79fd3b708da3399ac01ad68ff7ddc301ee5560ce9fdd2c4a1eae49879a7cd42af6a9d446b3bac5c036779b095a089ca9cec9
MD5 SHA1 SHA512

Submit Download

firestore.flux2-8ebbb.flux2-8ebbb.%28default%29-wal

Path /data/data/com.nullx.corporation/databases/firestore.flux2-8ebbb.flux2-8ebbb.%28default%29-wal
Size 410KB
SHA256 eb87d9f6f7b4e9109c85cef763be2bd9af27a3b632cd69c6d0c3e310c547e1ef
MD5 531a4ae21ee1805e39c7d2564cc02b75
SHA1 1683e561c5a6076c0961eef8976f839fae172e55
SHA512 98cd0c13d6c28ed1e14329cd35c7a93510b63f0e918017f69cb74b9ecadee02dac1bb8dd2c59909c49f5a077d868acb6363014ae82f758de7176c1ba49b134f7
SSDEEP 768:R83jA2cpBCGMpi7avd7kiud7Vaiud73Y2:R6pi7avd7kiud7Vaiud73Y2
TLSH
T15C94C9811B20F134CCD137729DF3C77335A68EDD6897A2C6F498D616C4DA502BAA8E8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation1579213648175274549tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation1579213648175274549tmp
Size 569B
SHA256 a81c2f4a605677a440bc0ea8706302c3a2660d1f7b1abd57fa3dd64426243177
MD5 76a57fd62e7fed2903011cda60bb3f0a
SHA1 02a07b3e4ccd2340f7ce150602e9b2616a468bb5
SHA512 6538c4247df67a6ffce3fb641e619175f2cd6113738907f3eca2f8ad3110e05c6894f8ecbdbea77971c403181fe1a0eecc3f31d0cdbbf4b236e9ea45c331a2d9
TLSH
T14CF0205B4F210790D0BABA56184DF8116D2D0CD826EE04F2BFBC843829D487FD58B998
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation291666680653034802tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation291666680653034802tmp
Size 90B
SHA256 1c39a42c00b0af1fd35c9ca269f74602911e8f715b5bba5cd9a6764082353712
MD5 accde9cc34e7637b64cc53e1f9f45224
SHA1 3f2ec16b5be0e2aaa89c843f82d00216cf617a25
SHA512 890a57c0eb1c3c18b190e139c3539fa3a33457f8e96344667ea63471c0f85886ee734ec59fe48498707e94957a9b00f468b5acc7fff4e2824de8c79b36031937
TLSH
T163B012419B304591C88AB30E1D8DB2001D451880040FCF090A0CA04000C12D8C1279A9
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation8459852792579349436tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation8459852792579349436tmp
Size 567B
SHA256 bdffed746a0f1fbebdbbb0d98ace70b4a3ed9116783a9256648e82342b10449b
MD5 7e04b99a5faef1448d6d675fa1420c58
SHA1 11b9bd6051fbc4ecb768bf9fb46f7ebbcbb73f63
SHA512 493096aadfaa4fdfbb6b8219c3704621683fb9e9d12520ac0909dc2ebf7893c48e5c7f349f27e821bccf01458f31f54cd80651e8bc47e5d4c7f1cc2acca6bbe8
TLSH
T1A1F026117E708804C4DBE7071D9C74100D5EDEE61592AAD1799C001857E066BF01794E
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation903491823480057195tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation903491823480057195tmp
Size 90B
SHA256 356983d4a406436fd9f1a45211abfc277662b727f9016be4b6bd3733caae2471
MD5 ee6d80f8e09014cc4224a3a72ca850d5
SHA1 09b8e5e1ce4e8a397aaf8e8918ba32ba68582063
SHA512 1b3f69983633bdb7201487fdd77a2d1383d944016ba52282c245716e77e02dd812dc0aa37defcb884d9003a3e5e1eea26fe8be47f3c4f8da0deb1fd6c1d3400e
TLSH
T16DB012094B7181C1C495A3021C4CE1002DF134400809CB081A0CF35001811E4D1A3DA9
MD5 SHA1 SHA512 TLSH

Submit Download

profileInstalled

Path /data/data/com.nullx.corporation/files/profileInstalled
Size 24B
SHA256 e6123064723579d6ed207fbd12d48ad9b03818f6bd4b70fef0c6f5dc2d3f8625
MD5 30190a3bdd5d6a05a2fe4070502bc74a
SHA1 09256bc4a04c5c3dc1ee37d938050cf3b9548ad4
SHA512 3e581aad16e6b95250b74131f0074024a40bdef0a0bf344f8df653b6446cde77a88acdf1494056f77655449e57149c2a536bd3136d0863378ac639aea8aa502b
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.nullx.corporation/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 56c613d88bab96936580dae8d0d66f7b5921f3d86c98228fd1caee8cdc1194fa
MD5 82b479afe63ca5e052c39f590b232527
SHA1 619091eedc46ba1993e041b10e91acd8912a9a97
SHA512 c209051e96bb5ff1f11e3d7598ab9e2e41bc4589d94f9fd61d124aa85d0be5829cf2295c00b5c3917b357ef0fb800d62ae1748f895389059bccc182506f1ce49
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 2fdab570331722db94119b8b168dda9ccf3e27099435e45aa6a9215925868be0
MD5 ab5c3239d5b2189980abe1e42cc0d63f
SHA1 a1f17e31e7016154d68a232fa248fbe9a80adb77
SHA512 4702e139514875dc24b0a2f2caf9f1082b49bdd5b3ebb57e0b536c9521bd8cd7d795697fdfac9304030cb925c09eaf78da0ab8ee27323838d28df2385424aed0
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-wal
Size 120KB
SHA256 dc4f58392056ead3874462847ff5b43bd1362660aedc24b7c70a0266db534fc5
MD5 9531311dc1a14014ecabb07794936b4a
SHA1 eb815f3de96d7a540e385264e534eebb0d6c7995
SHA512 df41cf4776e858195a879ebb047d8564c9016a4c8404a57ca7d08f246a185bea1220588a49e42b80f99af349ccbb0e29c229a4cfbb548bc1252dfa9a01b4987a
SSDEEP 3:RVPz+QJnpHwzXtRKVjWDxl6tr+JrIlsc0XllgoqKXtRKVjWn:7SQN+72Vwl6tr+JrIH0p2Vq
TLSH
T112C392E32B699813C916877CED3F5E885A22C90144D8ACB2A61E49A828A03C84AA4C10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 08fc3377911cf76850e675ee98e180ed0e3cee94ca410a025ecb680718806673
MD5 a553d138e10f802dc52c582cf7de21a5
SHA1 ed3ee93c78c3f4470587990b78ca4d21f06e4835
SHA512 5b88046f408885279560347627e8555f3e9811fc89e3712ef587b0fa3b2e7baa9162afdff68b433c7b4e365c34ee733a16f1aaf36c724572ecb60e76ae0838e7
SSDEEP 6:KvGUkPNtMiy9FZdrlOERX4PBX4ogLugMBX4suuK+/JyMPNtG+/V/1G+5Ow2:K+P4i8zdTRmBEyPbP/zGAVNGcOw2
TLSH
T153722B64AB800553CC17037A70ECC7551D705A9FE773CB0B1510881C7D037C8E250D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 8bc41993f35e83a3b57a299d6d22820ace34ad53bf5162336748ab22c5afa2a6
MD5 4ce6c787d7f06edb903cfe5ce3f1d6bf
SHA1 31d2bf9109929d23322d2cc6193e2e8ea9faaabe
SHA512 d2aa39984f2cb0bced08b377730e2e4182d33a4cbd21c1f57a3edde5a2706ced49f1f6f469432715d1836d24b524b3ef08c2c2c2db68ae4c8c5e68c7222a4761
SSDEEP 96:7PfHQWgbDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:7PfwrndjnHt9S/f8JzSV+6D86T0ED
TLSH
T1DBB3118D0F5D2501CCAAA4F4E5E00FA17D3E852E9393E3D165918079ADD3921DE25CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.nullx.corporation/primary.prof
Size 1KB
SHA256 b5d58f460dced8e73f68aee22c253827e990dcd326051cf3ec5852aedace369f
MD5 63c9468b93a11850bde6cdcb470fa67d
SHA1 91f5ba34e1a9a9c573f2c8cf2aab9e18e8d6e753
SHA512 4efe3ac2fb3f14095b6b58cade9085ef6a7b5ea498beffd3164e8dd2f5291c9ba49278541514d27216f1c6b06974ded04f7ab379e119839049f0bd42c57974ce
TLSH
T1F0312A0B004A63FDE531751FC93845EEF6A2744FAAA2848AC3352B361D5257D5D5C0CB
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.nullx.corporation/primary.prof
Size 7KB
SHA256 eb8da7c02b525d9f81eeecdd1c489521851604fdeab0b7b5dc506bedf5c54229
MD5 a2a477c93f42f975323e429d6951f68d
SHA1 19c000cf75ab9e46047885647eb5cc6e19fbbbb0
SHA512 0df656358d0c0b8cadb280597ac9157c261c47fc3613ad5a9a48778a27365f61ecb088a264bfdc4ab376c2fe00f476b14b30a5265934bf9b91777e27e0f1db53
SSDEEP 192:ur+NamW27IvoCokf15gr5fkJogp1DGWVPVPkGHvYUrIuzGBONAhTg2ix+j:u3mZSASPM58JLRRPkGPYUrhzhNAFg2iE
TLSH
T17CF1BEC65794F18ED39AFC89031216F5E891CDD90211C4BA7A3BF614C02CCBF122888E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads