a6cd7491360776f91fffb8c5610fc03c53d4348d10dab0c165dbd2c753f75229

Resubmissions

08/08/2026, 08:16

260808-j59hasce297

08/08/2026, 07:18

260808-h45bhscc957

Analysis

max time kernel
131s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
08/08/2026, 07:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6cd7491360776f91fffb8c5610fc03c53d4348d10dab0c165dbd2c753f75229.apk
Size 6.2MB
Sample260808-h45bhscc95
SHA256 a6cd7491360776f91fffb8c5610fc03c53d4348d10dab0c165dbd2c753f75229
MD5 ee8c40e767dca59fa26b2089b6e408e7
SHA1 0799d9956b40b50a827a9944f568339704c8075a
SHA512 7a06b89644af724eeb7cc48945a750a60b64a2bfbceb79f25f551f53b96cb6de1750008775be05da1387be386e830cc3afa03d0573f51ac58341e477850c04b0
SSDEEP 98304:IeVI//MuoJ1z+uq2qzkbKKNRfWeQ1zeHIcOE4Fhp9HHjORHoEkKmGywQ3XpK:IeG33oJ16VLzyKr1+BmZHjDKmGaK
TLSH
T176660187F334992FCC7701360EAA927552574E868E96AB8378443F5C68776D80F4ABCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nullx.corporation

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nullx.corporation

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.nullx.corporation

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nullx.corporation

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nullx.corporation

com.nullx.corporation
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5086

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events
Size 56KB
SHA256 a10ca717f2a52d187ae179b2ababed8850e03e8665f25d5905354ea7c0427607
MD5 2ce1fd49d7c72ae9561c1ae04cfc5034
SHA1 c7757c0d7403694a3ebbd1171deeae86eeb07df6
SHA512 b6193d0926cac26dfa4bbc9083e026b12ab74709756183fcd7976790e6ec39b75fd18f88c17d74187d7ae7deeb480ed1866c9b8dc339ef484f2fb2510325c80f
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSw:8MEX0wIyNjaw
TLSH
T12E43639D1E2C2221C57E283ED3E143635B7C93DF5B23927239948CF98DC206974358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 a9832bbe2cad6fd84d4f2a871013920d26423798952384403cc26130d911303b
MD5 e3c491793c372d5369b21525c4deb1e6
SHA1 a15901540f0ef69daaa947f04dc0365c2db0c442
SHA512 a16ac4b5d450a750681738ddda385b3620849d2f961e67860ae81a43a6ac7a218522a1c3d85be2f0c968a7c066eed89dd6e7306a70b347f605294f8d578fc240
SSDEEP 6:7+/l91pll0Fn13pg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKu53:7+t5lcqLiuWdwRmBEyPbf53
TLSH
T1CA02228967810A32C91A9AFB90F883810D00E719816ACB07166008993C074CCA4E4D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 d822a73fd91fcfa4fb134018c16c1afa6cc35b454cd8ec3f25e953233b468e47
MD5 55b56017073fcc1a020fdce1d044c8b9
SHA1 e125a6cf8e1eb239df1a34315ad2f55c4998a3cc
SHA512 68da9e0629bb633bd81a76b9d1e8c1a24218697bfc79f3fa2ec0954a16047877b80de9a1d2c6af043013c754ec84e79ce39415865f66859e6474d81a1fabcc0e
SSDEEP 6:7+/l9hYFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK6qt/V:7+tcBqLJdTRmBEyPbL+V
TLSH
T16002228A63800A93C81917B790CC83442E20EB2683A3CB171AA008983C066DCA8A1D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 7763c0a6ab3749a5464a7691f0e7da10e3cfc39d68e82c5e6a656f366969f930
MD5 94ea9da57b8370396d3f5e010e2a9874
SHA1 3ede218f9dec9ed52fdeeaa082f7ac8556e6dd7d
SHA512 14a47a457a02db9fc24dd82c2f11aa26d66e1cf27c1bc0c9abc322c8e640d317f5c539d34e62db3f8d4031ad61a171a75096b1f8d65e2705e0933fa04c9df6dc
MD5 SHA1 SHA512

Submit Download

firestore.flux-d05de.flux-d05de.%28default%29

Path /data/data/com.nullx.corporation/databases/firestore.flux-d05de.flux-d05de.%28default%29
Size 148KB
SHA256 669089a2004dbb219361854af516aace77289fd41a2f3d3f19e6f87cdc5bcff5
MD5 176d8a8a539314fb4c4686e48d5fbc51
SHA1 e121892f5d204fdb5d38b79ec938f2aedf169ef5
SHA512 044f9582b4b1d38a16f7efada0aaf6136ad9491c412537dbc2d19347b8a617210be642bfbd272c99a49102238968b4091c42da3ef8217c69eb0c7a8a43838723
SSDEEP 192:UUrwUED5875JB1OZuUrng3DEIyt62A2cpBQHNGG:UZ/mHOZuAgxyt62A2cpBQtGG
TLSH
T180E345E76F18A179CCC71132B59683B31FBA9F07F7A3B2026E8C44058C9E742955C5AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firestore.flux-d05de.flux-d05de.%28default%29-journal

Path /data/data/com.nullx.corporation/databases/firestore.flux-d05de.flux-d05de.%28default%29-journal
Size 512B
SHA256 6266e1b56d8c5ade30d9806b27acbdfa3444f512390f23a3c9c48003974bf939
MD5 23ce1b040619a91391de806d8070df34
SHA1 ec6f5e23f88b681e8d79d93fad6151237d3e5a69
SHA512 27b4cee050dc354003690763dd71e7f4b456c680b997a5dd40f4168f63eeec5d271fb3bd4f6312467f7e96c5273c358751fe5cbdb31283bfa3d70df17c06bfd9
MD5 SHA1 SHA512

Submit Download

firestore.flux-d05de.flux-d05de.%28default%29-journal

Path /data/data/com.nullx.corporation/databases/firestore.flux-d05de.flux-d05de.%28default%29-journal
Size 8KB
SHA256 5cb0436b1498712d138fd33f3f8f6803dda2b363acc99665545e3cf5cadd2a8a
MD5 208a0f07036386a02794180459c88ff4
SHA1 37bfc40982768dc9c54db2b6b256253fe34327fa
SHA512 72b55a2b81d00b95cf9002e67375bd1cbd5d84e0c9c9cbc5f328a85718dd9194178473f57a8a28e0fc468d8873808c6b6eb7eab0dc7d6cca0f3c114e82aeeeef
SSDEEP 6:7+/l9s4n1Mg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK5:7+t6RqLiuWdwRmBEyPb2
TLSH
T11C0222896B810B22CC1B66F7A8D883800D80EBB98171CB4719A008987C438DCA4A4E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firestore.flux-d05de.flux-d05de.%28default%29-journal

Path /data/data/com.nullx.corporation/databases/firestore.flux-d05de.flux-d05de.%28default%29-journal
Size 40KB
SHA256 b646ac4c0d6763940062933550c4f060baf1060fd296165cfda0e9d2ec9a9888
MD5 6b9d40be02b66cc3944d7e780fc6d12a
SHA1 7136d36d0c82ecc2b9d9d9d5caf7c5559d1e4ac7
SHA512 1f7ab9aac3fba23270e5f4e9e4402967d15d4f286c23b3cf87996bfa42eec6ea1ef6f6d0bdd179fa2062a80c373fd0c6746255b51b21ddacbae185dcf1310b84
SSDEEP 24:7+tNdkBBog2aJdNr5NKY1YonxE/hmgf2/hm2acb0J:7MMBBognd3N1YonxcoUCo27C
TLSH
T136139BDB7E5DA09DEC9A82B7E486C1F62E542D0657CDB0010B0C4949895F24BE0BC09D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation6046851778117444679tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation6046851778117444679tmp
Size 570B
SHA256 10dc5c85e71d9e41cd72708984d0672e76554b068b355fbcf4685477470ea249
MD5 cf4d14b70b158bf0edc33a8305a61833
SHA1 102d7e38dba839cdf6026281ed2193e1c2d2552f
SHA512 c2b6924a26a13eb8018d873c2e58c35a496894da3fd6fd24bd22274fe102c2889ebc5655d79ad6cdbc1ed7b89200f6e7339e85aa10339e40200065a6c1f79025
TLSH
T1D7F096A674400370E4576B0E1888BEDDFC84C0E0A4C804D937E58464CEA13D1FB8328C
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation7394752432591180852tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation7394752432591180852tmp
Size 90B
SHA256 74dcd4c37a8404e09266b090c79ea19d34571b26d7c714b65dfbe534a95504e8
MD5 29385fa1bdbb5f4e59ddcc5f345db768
SHA1 a229bc6c681a7d8cd2928292dbeffb5825a22c1b
SHA512 203584aa30e4bf5a65f0f46164221422ada70ab9e1c80ada02426559d6032cfbaddf4bb8a19d43997d354e0b8a53c10837339d95e737b2cd7491fc8ee354634b
TLSH
T152B01205863181918D89A2062D8E91002DA51840840EDF16CA18A1A002811D1C2079B4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation7408386385985657222tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation7408386385985657222tmp
Size 573B
SHA256 303ab3f4e4a8f4cbbeb16d670f42dde395964a0a27f63b2e39858c3a4236893c
MD5 cd15c568d600c7bb36d62645f205f9e1
SHA1 6d0c1581dfbcdc6e1b5dd043de1b1303cb329a07
SHA512 95be13281a2c49c4b664e172499e556c61119794563a112a09081d9ffb8c4953c7a33dd0a49d05e1870e5a2540e8c124547c5f351ead908624d6f45035923aa0
TLSH
T14CF00D1551038204FE4F9F4119CC7E006C2484D005CD01E87FCE2D68C367A54CC1740C
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation8880283026583084015tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation8880283026583084015tmp
Size 90B
SHA256 c1f1d0735bff0c3ca076c77f9f0418d17154f575bb933efb228f078307cf110c
MD5 e47f34dd679452710d15a03f8c898bce
SHA1 ee1ce8f2554eae3755319cf3e14391c6fe4a19c1
SHA512 a815af2f835cd697f34ae2bc916262592bbb4d87ad6dd48bed21f1accddfb5261c0468a4fc869274672f009a562833fdd232d51b254a9eed6010ab199b011ec7
TLSH
T114B0125246304151C4B5E3071D4CE2147E5524406889CF040B09D05000922E0C2C3BA4
MD5 SHA1 SHA512 TLSH

Submit Download

profileInstalled

Path /data/data/com.nullx.corporation/files/profileInstalled
Size 24B
SHA256 0ba5112a4498c7b7944ebc6a6537370ad78fe85b67b3b5121845b8da0af1ea4e
MD5 f1c99079f834063f45adfaebecdfcf42
SHA1 7731ecdaf2c8eaa50ba89233116b02e4463ef2dc
SHA512 374312d7e29dc341498eead49fa79a2f9cd282d29175cdd22e85b590c8b8ce1b6c37244de3449eea87796ab3a7684a0c386e8c0cd73a495665b47168d71336c4
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.nullx.corporation/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 12cbc9bba1372b8e750cd50f179570f46abcb864cc07e2e08b1834d1ce78a0a1
MD5 0cb1b8a6ffdec77c0666bb95eb942254
SHA1 6ed7e5dc3f21a70b88df6b8ea4c81f57b69cbc9c
SHA512 b2995420006696947f28c325a493cc509b2516a6849cdaffe9e7d3fa33a5b59ca296ef52a414e08d498d4b6be60b4e5f47f7ffa5df6e7d995bf20812f6672df8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 a43bfeaed6658ea3424627ab2d3fac3328ab28ad43291f43bc98d26f147fb6d3
MD5 bc5a85f10fa8f42885370f9c91db67e9
SHA1 fd83095507e45bdf52f0043e3a863d056a02fb1b
SHA512 e151a0354de050f1c976047ba5886a794e6699b90d3cb0a9eff696058a94860e645d544c9cfe68ad887f1fca210ca5bf3a477e258576161f8484352688cfbbcc
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-wal
Size 120KB
SHA256 d690b5612bf0b71f3976f40b5533c59e6dd5ab45c6d6f98b28259164094d2587
MD5 23ba3e142da33d4f978bc39502151fe2
SHA1 ca235518a0164cd52974116d9faa6350ba4f3dfe
SHA512 c5493db624fc63ded03b2333e4d862b538d3258dc02c6d5ebcf5922daf72bafd2428624f208e5e294958ce2a2feb4259677031f21103cc49cefac35ca1d8d810
SSDEEP 3:R2tqqxQ3S142wzXtRKVjWAX/lU0px1sMiFjd0XllgoqKXtRKVjWn:QWSGp72VP9t940p2Vq
TLSH
T184C392F3262948ABC019477CE92B5E9C6606CA0086DABCBF652989A12A203887935001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 a0513f3e238f020c1c07975c051a3d76cb12b905923859dbe68a33916d657ad8
MD5 7920b8b364394eb5ca8092cc132e62ba
SHA1 f57013164e11b33f28cb43492479ad6a9fb8d343
SHA512 3a568fad346a35618d46977c7bafa16a2712bbaff60e690db50d5702cf34faedb98787b9f459d77b7d96740fde7bd9cf99005e674c1098e45712634c4bb72a69
SSDEEP 6:KkrZn9FZdrlOERX4PBX4ogLugMBX4suuK+/B7AtIouikOw2:KkF9zdTRmBEyPbP/BktyOw2
TLSH
T1B172C29993882AAAC1048676A0C9CB9D1EA057096253DB8F25314854AD12ACCF553D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 f10d871882f0e8dd1b2b470ba63387d8f6a90a979c8dba8c35a4c8f97baddc84
MD5 e8895df90a382ab760b87cb890f9ab0e
SHA1 7f02e733f771f08d535be7da690263bbca37a181
SHA512 1e15d4e7cf17b6f58aa7d2817f291d8437579c1113078ec9ce7608be43ee9b3856c5882dff42e60593bd2e5101bde242c7732557c6eacfdd882b8daf2bf78fd5
SSDEEP 96:KXNrztiNWEzDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:KXNrw1HndjnHt9S/f8JzSV+6D86T0ED
TLSH
T128B3228D0F5D2540C4A9A4B095D00FA17D3E462DE393F7DB25A18075ADE2920ED26CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.nullx.corporation/primary.prof
Size 1KB
SHA256 b5d58f460dced8e73f68aee22c253827e990dcd326051cf3ec5852aedace369f
MD5 63c9468b93a11850bde6cdcb470fa67d
SHA1 91f5ba34e1a9a9c573f2c8cf2aab9e18e8d6e753
SHA512 4efe3ac2fb3f14095b6b58cade9085ef6a7b5ea498beffd3164e8dd2f5291c9ba49278541514d27216f1c6b06974ded04f7ab379e119839049f0bd42c57974ce
TLSH
T1F0312A0B004A63FDE531751FC93845EEF6A2744FAAA2848AC3352B361D5257D5D5C0CB
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.nullx.corporation/primary.prof
Size 7KB
SHA256 c808647e8f8bb89794621196230d6578518b2d5495eee4fb5d0d7581d7d971d6
MD5 63c592bf249474a62ad1f8b5e8761ab1
SHA1 7d94b8af54f81c3c85d628837916eda446949808
SHA512 b8efc65d2dd794b467e847b15fb3c8261276bfd7f191406249bde972d7900436c9bba7bb78e9f21a028fbe9d6c56608945e84245586b16e547d461750331f9fc
SSDEEP 192:sD9h5prF8pJ/qMGwvdY3cZDHXmJLIVoTHQ/:sOzvdYk60
TLSH
T189F1AE1416530A3BC2E57BACED4FE3C2186E5CECC9DA00DFE37451441593EAF5E58948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads