a6cd7491360776f91fffb8c5610fc03c53d4348d10dab0c165dbd2c753f75229

Resubmissions

08/08/2026, 08:16

260808-j59hasce297

08/08/2026, 07:18

260808-h45bhscc957

Analysis

max time kernel
136s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
08/08/2026, 07:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6cd7491360776f91fffb8c5610fc03c53d4348d10dab0c165dbd2c753f75229.apk
Size 6.2MB
Sample260808-h45bhscc95
SHA256 a6cd7491360776f91fffb8c5610fc03c53d4348d10dab0c165dbd2c753f75229
MD5 ee8c40e767dca59fa26b2089b6e408e7
SHA1 0799d9956b40b50a827a9944f568339704c8075a
SHA512 7a06b89644af724eeb7cc48945a750a60b64a2bfbceb79f25f551f53b96cb6de1750008775be05da1387be386e830cc3afa03d0573f51ac58341e477850c04b0
SSDEEP 98304:IeVI//MuoJ1z+uq2qzkbKKNRfWeQ1zeHIcOE4Fhp9HHjORHoEkKmGywQ3XpK:IeG33oJ16VLzyKr1+BmZHjDKmGaK
TLSH
T176660187F334992FCC7701360EAA927552574E868E96AB8378443F5C68776D80F4ABCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nullx.corporation

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nullx.corporation

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.nullx.corporation

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nullx.corporation

com.nullx.corporation
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
PID:4766

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events
Size 56KB
SHA256 a2ce8af15b93cfa2eb3c5eb0672f6b376eae83fbd807bf11c74c77596057911c
MD5 86bf487fbac0da40c033fcec76f3b4bf
SHA1 91443687b63db0713804f486bffd4dadfa8e4ad3
SHA512 38aacff0cd67bc5a820bb634dc71b86e532464d4e3f3790683f84552514739d3e33c8cf7b25cba03bf8c39a5bc59e637f24a986e131d28a48d7c22a2831aa054
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSk:rAMEX0wIyNjak
TLSH
T16B43639D1E2C2221C57E283ED3E143635B7C93DF572392623D908CF98DC246974358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 a4a8bb9d2dc5e056aec016d9fbe343bc3b85936c27657e0a87e3fc264f87ffd9
MD5 bc47771fbe58843b602e2de79e076bb2
SHA1 f81bbacec1e64e6df42e1346ff6d68ef541549e8
SHA512 85bb90eb8704648c20c8b8abf46b0c85f954bafbc9c594d8d562b37a944ab2e678505d0056ff83fa733e9beffe3fb419f273bb2624b0085847da07b60df85b47
SSDEEP 6:7+/l9iGn1qJvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKv:7+tcHpqLiuWdYRmBEyPbE
TLSH
T19E02C08C63800C13CC2D6A7B90D4C3600D04EF28A1B5CB171AA008BC3C07DECE4E0D84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 f04e2316321b72f23118c56ac0a7c4a6601b042fa867fb6ba526eff724c678ea
MD5 df2f37f451fa0cc87d5ffeb876188e08
SHA1 bd1c556bf019f443614fd36c7a8c70399ba33311
SHA512 d263891beb2ba6d4d6afa3817b0c06d19879a598b2f670a9097a30659ebaedc139396888d2e6569fdf8f8ea33a9a24fb296665ecda8ce3c6f789b2948daa1e0f
SSDEEP 6:7+/l9ouPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKuq0//4:7+tBqLJdeWRmBEyPbfv4
TLSH
T10B02228863400803C02B1BB7A0C883481F10A728A233CB075A9208D46C0A6CCA8A0D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 0a2056f2c8d0beb31e4bb455794b5adde9579d16e7fefc3e6e477e7965205a6b
MD5 8c5855dc1c70620ec420f0a06ccdaf56
SHA1 a6194b304b842ae9592bc4f19b907b9133758d45
SHA512 57430c4abbf41127368b863235275472ca7d2d8fb4b1346d49913da98e90ae91762cfe12cfb126dcb52802963a3565296b3457bf569973ecd1d136daa3207f10
MD5 SHA1 SHA512

Submit Download

firestore.flux2-8ebbb.flux2-8ebbb.%28default%29

Path /data/data/com.nullx.corporation/databases/firestore.flux2-8ebbb.flux2-8ebbb.%28default%29
Size 148KB
SHA256 d87945428b1da7be111f856d8823bcde5976a694ae8725eabd7ad5c46c4e6e88
MD5 bc2a1253247b262f8a29dc78b3b88575
SHA1 652d59a4522240d8fb17696756dd129fa96e4903
SHA512 eb6cc0a4c8c5a7ceee83e00979c3a09e870402c4eddc16c33ac08d498e99ba297e16971b79ae7ea3d65ce13a4b7f795a2ac53a960372c1771848c13a2ffdfd51
SSDEEP 96:rvo+rog17pog13So+rog1Wpog13LoBrog1Hpog13noBrog1Rpog13C3ZCo+rog1x:rvRSyLInyqZCrg3DEIyt62A2cpBQHNGG
TLSH
T15FE374D61E686229CCC72132B46193B32FFBC747E933E3232DDC64159CB9602951E9AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firestore.flux2-8ebbb.flux2-8ebbb.%28default%29-journal

Path /data/data/com.nullx.corporation/databases/firestore.flux2-8ebbb.flux2-8ebbb.%28default%29-journal
Size 512B
SHA256 db0b29f271f77326fa8eafec2dfbefe196be6664cdbca93b0d691a81681e774d
MD5 a53f32bc5f91ee1326d5b8bcd63ba8ff
SHA1 870766df7b2e1f72cfed8c20e98bac9697a596d1
SHA512 c74305c56345bbbc553f6f69cd567e8d519a54a831f35e332eba70088f5eeae93f047fd4ab5d5cacfd5e599a7cfa114ed84c00371e50d5f5ea8423268e367b9f
MD5 SHA1 SHA512

Submit Download

firestore.flux2-8ebbb.flux2-8ebbb.%28default%29-journal

Path /data/data/com.nullx.corporation/databases/firestore.flux2-8ebbb.flux2-8ebbb.%28default%29-journal
Size 8KB
SHA256 559a86db9229a71a382c0acab6b4d789c4ae9531c4dd9bf9fd1d2ca1490ed9cd
MD5 dc9e569d7578366d6943ef01d0f105fc
SHA1 c3ef8bc9ccd4729fa5c2966e6021fe36fe4c8228
SHA512 d1ad0478fc554f0eb54cea71baae7d00e441be2a2011d3e1b7144c64d11d979ef127f1c72ed5a0762f7b9fd679840ef01eaad2fc3dd2fea00f4e5eeff7985d13
SSDEEP 6:7+/l9vac4n1Zvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK0/:7+tNac4vqLiuWdYRmBEyPbp
TLSH
T10502C09C63800C13CD2D1BF790D583C00D40E729EB72CBA726D008947C474CCE4E1D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firestore.flux2-8ebbb.flux2-8ebbb.%28default%29-journal

Path /data/data/com.nullx.corporation/databases/firestore.flux2-8ebbb.flux2-8ebbb.%28default%29-journal
Size 40KB
SHA256 b03cff1b4d65723f7fd4324160269a067ba041a915d3c623c8e31ac8fdb1d225
MD5 fa777d6b5c90ccef6d47c7db2934a458
SHA1 e4fb47603429e4d7f74885d5cfc2c198f000da35
SHA512 59951651da941c5448566e8fff51329c9c819d3fe9845d9dad53364933e30a5042d7dfc75fc43b4b5652485588ffc2d81f7fc8e5d58ca7e203b0e803a1ca58ca
SSDEEP 48:7M6Q4j9s0C1Nlpo+Kk3ogl/iDd3ogl/HDR:7C/o+rog1Wpog1HV
TLSH
T1751303D806546219DCD43176C420F3E638DB4A168F72C03A0D0D7CD9C6B684BE13CA1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation155017446377214171tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation155017446377214171tmp
Size 90B
SHA256 4cf19d37a9716b49aee3d018d7346e3faff08e068056f07d04312f83939dafc3
MD5 be2154b455559b6cd2603e41f71405fe
SHA1 e309da5561ee55b70306da82b6971a8702a67f86
SHA512 2f4d757ec3c34dc90f5f0a03c9b87dc062322dddb96abf6dc9794f75bb019b3acdcec3d03fd430c9b0cd56a47b406420ba2630b115b79c77fd2cc9bda275f178
TLSH
T11DB01200AA314292C5F5E2031E8CD1001D5015401809CF4B2A0C984002911D0C1139E4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation3693786788484309446tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation3693786788484309446tmp
Size 569B
SHA256 01502ea547df0e28317c49ef7d91bc2eee41c6ec418b8eb6964fe9410408d722
MD5 c6553323671e6529297734d93acbcfc4
SHA1 ab307df5f93523dd41908a740d2c1e7881ff88eb
SHA512 9b0a68ccb9fbb569df4b5b53c8d8068be9f407139aa32606f785ba7a788da63f9b77a44f2093afb184daef83a71f0bc4f2fa90fb14016aef9dc1b0001447971e
TLSH
T1BCF0E12679E2C61C80CBF5433DC8B801292815ED025A58C12EA885A859D919BE84F845
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation6005847269654082755tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation6005847269654082755tmp
Size 569B
SHA256 b90c2505f7a8c6385cf969fafe10fe3ee2c651f7a9a0d143217a18a1d8b255ec
MD5 5c846cdfd6b6f68426dfddd071520403
SHA1 b0140ecf2434b83ce5f10396a3944bc2d76d2392
SHA512 b7bf76c510e4ed767611d12bee37158b8eec7a0a83fd0717c67b93ad6ba5512180dd19924dd322feb09ad9f7363e826c930cb0825579b4af77b2c767e4bb6516
TLSH
T159F075A97B108615C4E5DD0329ACF81A2D2408E0022AD8FB7EED887097A47F2E08F4C8
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation908303664139017523tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation908303664139017523tmp
Size 90B
SHA256 9407a7a68da6d51c2687d194c1843aade3260a6795c7f77c020b907652942ba1
MD5 0be0bf487f7add0f8fe6e938945658b0
SHA1 c3b09a722bdd505ddfe1c0903f018404e88bb3e5
SHA512 9807f4e32879d0a783e641c920eecc5384c3ccfe676720622f74ad9a8b06f68a5d2ccb18d808971063cde36dbec9af139d2ee583682dfaa19bf74e721cfeafb1
TLSH
T1C0B012059770414684DFF2433DCCD2001D9028C04849CB140E1DD4C014A23D5C2879D4
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.nullx.corporation/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 2ee4b7214d2c6301706c1e4d5d4d967741d089c80f98ff1d4fbb5b4ff395bb1b
MD5 251158238f1d05b730760f508d424214
SHA1 1f5c10f03415f85d19c81e215bed2006bef11d94
SHA512 7b2929ecf410053f5d8cec1bc035f9cfbee6ccddb8c0a633225d2dff6f4d546a31bfdbd9f2a23e113f9693f3a062a65c42decb88d25d4696e724458eb1031edc
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 27ae0f8f214ac934a249f859c9cb0fd82b8ed88db442d622b7d5ac6d45c38ab4
MD5 0a5b72acc30f8bca597114db93899728
SHA1 d0454afd01cafd430959fcaf491769d4cc5a1851
SHA512 08ece07405e005aa6bd00897dfa60c90c2712158a05a2af821917133ced8b03d17186594a798bcdccfb026a1e8465a6f4cdef987659176131ec37af2f3c79689
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 046cee1a838b895acb535a476679fc85482b980f61ba63fddceed8f349c4d780
MD5 1acf88eed5b1644b2c150b4618383fc9
SHA1 ea5a9bb7b755e0f2f070a59ee2547b9aaea71acc
SHA512 47daa77cc7046e9303abf3a0e5edba0b3bc847b7091b5521573b6485ba477d7ecc7521943f552051f7de127dcfb0c11b7415e584aaae475b2f4226e7bbc6630c
SSDEEP 6:Ki+kWcqpv9FZde/kPlOERX4PBX4ogLugMBX4suuK+/xpCO/t1CeRugOw2:K4WxplzdeWRmBEyPbP/xpCyiSOw2
TLSH
T17472C289A7800972C117537270C6E3640DB992193712C71F65B705A53C432CC56A1E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 5361454c99bda85b5678c044ccc02f882b60fa98469746656206a18127808671
MD5 c17ccfabe339eabb08ab047de29c007f
SHA1 663e8daebe8f0bf33926de20aba45bd006fcb7d3
SHA512 c211a2451185271fc247afb943db5ac6ffaf002c7716a666e3220cd195052c5fd0480882850bbe4351e88cc51ba6cf59e2a1dbfc33e616097ef703742dfbb7bc
SSDEEP 96:6msP2WoDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:nsP2hndjnHt9S/f8JzSV+6D86T0ED
TLSH
T159B3018E1F592510C4AA64B0A5D01FB17D7F412EA393E3E665A200B5FDC3921DF26CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.nullx.corporation/primary.prof
Size 1KB
SHA256 b5d58f460dced8e73f68aee22c253827e990dcd326051cf3ec5852aedace369f
MD5 63c9468b93a11850bde6cdcb470fa67d
SHA1 91f5ba34e1a9a9c573f2c8cf2aab9e18e8d6e753
SHA512 4efe3ac2fb3f14095b6b58cade9085ef6a7b5ea498beffd3164e8dd2f5291c9ba49278541514d27216f1c6b06974ded04f7ab379e119839049f0bd42c57974ce
TLSH
T1F0312A0B004A63FDE531751FC93845EEF6A2744FAAA2848AC3352B361D5257D5D5C0CB
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads