a6cd7491360776f91fffb8c5610fc03c53d4348d10dab0c165dbd2c753f75229

Resubmissions

08/08/2026, 08:16

260808-j59hasce297

08/08/2026, 07:18

260808-h45bhscc957

Analysis

max time kernel
129s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
08/08/2026, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6cd7491360776f91fffb8c5610fc03c53d4348d10dab0c165dbd2c753f75229.apk
Size 6.2MB
Sample260808-j59hasce29
SHA256 a6cd7491360776f91fffb8c5610fc03c53d4348d10dab0c165dbd2c753f75229
MD5 ee8c40e767dca59fa26b2089b6e408e7
SHA1 0799d9956b40b50a827a9944f568339704c8075a
SHA512 7a06b89644af724eeb7cc48945a750a60b64a2bfbceb79f25f551f53b96cb6de1750008775be05da1387be386e830cc3afa03d0573f51ac58341e477850c04b0
SSDEEP 98304:IeVI//MuoJ1z+uq2qzkbKKNRfWeQ1zeHIcOE4Fhp9HHjORHoEkKmGywQ3XpK:IeG33oJ16VLzyKr1+BmZHjDKmGaK
TLSH
T176660187F334992FCC7701360EAA927552574E868E96AB8378443F5C68776D80F4ABCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nullx.corporation

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nullx.corporation

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.nullx.corporation

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nullx.corporation

com.nullx.corporation
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
PID:4989

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events
Size 56KB
SHA256 359307cb21dd1219a2b4d931f4618caeaa0c0cb372e01d9c419c8c5dd9b706c0
MD5 c9259a0a63e5d5ec2f8db208a1a5cfb8
SHA1 5841501ff466e821212abeb6ed73c8beb0d5ebbd
SHA512 8584231f943c9c18d379bfd08073923fd0556ce7afd1d16d92e65559390cd745863897ad9263044ebd1158ecb05b93a84120a07d344bdde588553262b927ef48
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSon:rAMEX0wIyNjao
TLSH
T18A43639D1A2C2221C57E283ED3E143635B7C93DF572392623D908DF98DC246974359A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 0788efb52d73c76677496d64ff1af709f0c755b89ca53b1ae305ea541e641571
MD5 d2fbd640f318e8d3368e662f2f1d1146
SHA1 f375f9d39686fc2172eea538cde9b5d434113d74
SHA512 91fc804c8e562bfc20297e16016a1a5ed1100d170035e77a075daceead4b4bf8e06073c0807f10204bfb1a1162ad26ee0c68b80a603f78b38a3c180bdf4b744e
SSDEEP 6:7+/l9sn17g9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKU:7+tAqLiuWdYRmBEyPbL
TLSH
T19C02228863800E12C82D17B790D883801D08A72B8561CB6B26A008942C079CCA4A0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 a84d762c526363fbea610f739d54f12f7bf8026832318d830989abe7e70c7ed7
MD5 ce8f9df26ce47f1129627f6e196f3b1a
SHA1 b939dd762829057753e255892494a89836d6c685
SHA512 25a2c17ca3690c7ad954ae42dcf1ff46cfa68f9352fcde94edb03216df5bc0f7632ec6d3b993b1f3b7ed3e3bd83a4ddc4bbd1f382e0c54a1f4028932bd61ef78
SSDEEP 6:7+/l93GPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKv/X:7+tcqLJdeWRmBEyPbgX
TLSH
T1B00222ACA3800803C0291777A0CCC3481F18AB28A223CB2726910864AC066CCF890E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.nullx.corporation/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 424bfc224977d20e75698bb3d6ffe248eec09065b86866addcd99c2aa7ecd013
MD5 019d78b76589cfbacb47e7252eba43ef
SHA1 d3bceeb3d2aca944c921839be9e29d7109d002ad
SHA512 42c5f003b1e42b0015747f1193830a7c5df65fee3eb6602f4fc64e3304cc93dae568035c8a93a0ce05ca1d98a4167b81f41e0d9a929d0f0a0976ef4c2cc710f1
MD5 SHA1 SHA512

Submit Download

firestore.flux-d05de.flux-d05de.%28default%29

Path /data/data/com.nullx.corporation/databases/firestore.flux-d05de.flux-d05de.%28default%29
Size 148KB
SHA256 d1c5bb5cdb5aa6b24442800d1b0e377f745065814a2484bb711493130963e5fb
MD5 da8ea1c479c6b287f5f7bc9488573a22
SHA1 625aae9a22043fa00f595802f50bd44951a1a258
SHA512 74028efb17d1eb5b6ee706213aa0159e69c02858c1671431b42852c2063e0750c0d6b147916c0a76e6613a1481013333cc85ad59fe43057701f2d96e4c304e4f
SSDEEP 384:73s435TivMiecZg3sWgxyt62A2cpBQtGG:73s435TivMiecZg3sWgx32A2cpBCGG
TLSH
T13CE394E21E345175CDC3313175B643332ABADB27AA63E3136D8C50138DBAA07901EDAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firestore.flux-d05de.flux-d05de.%28default%29-journal

Path /data/data/com.nullx.corporation/databases/firestore.flux-d05de.flux-d05de.%28default%29-journal
Size 512B
SHA256 1fd73fbdb014b52d92ac1fae0264f8947f8d0d610f0f39158027ff8bea062a3a
MD5 203ace77039fdf5c630340112e63b363
SHA1 a2601e1f02d354d7c3323a5b3a9e690f1a21da31
SHA512 04b4c958e4d22c8132c45ee4e3ba1809f840d819d819d330cf074d4cf204e5b950ac1ca3ae782d39c8bf40ae30b78a71da0105e4b7320ca90afd3935403d60b5
MD5 SHA1 SHA512

Submit Download

firestore.flux-d05de.flux-d05de.%28default%29-journal

Path /data/data/com.nullx.corporation/databases/firestore.flux-d05de.flux-d05de.%28default%29-journal
Size 8KB
SHA256 7141bef723f7a59a1cc8bd12f10beb9e74d31ca8ae8f9c72a7489c91819d6a24
MD5 3b3f752c298a5168498edb1927db83da
SHA1 05297a28f35177027d24b3f7d5a6f9549f05e21c
SHA512 acd82af150cf4aa7a747884c53b3b4ce9d75b7312a6bf3085f75e64aa35b93989eae8cb21d7f40b41ec5ff3a210be3b02770334c9a896316523a83cf3f41d00e
SSDEEP 6:7+/l993n1qvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKmrg:7+tcvqLiuWdYRmBEyPbX0
TLSH
T1660222886B800A13C82E767B90F683510D10A76C8261CB1B169008D42C076CCA8E0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firestore.flux-d05de.flux-d05de.%28default%29-journal

Path /data/data/com.nullx.corporation/databases/firestore.flux-d05de.flux-d05de.%28default%29-journal
Size 40KB
SHA256 a6ea7e392e9e1c08af39a1b79b9846e006ce8dd45f690e85807e000b15f9916c
MD5 857b08c6f3ff719eb42cecfcee38645c
SHA1 363790a40f05fd3dc4ae1c600bba163c9146ddd4
SHA512 f2ac4c8cf01fb7c137ed96bcd0f4239e560805681f4cc6ebca94fa7d88f38a5ab4a233e7ac0e5e45d89debdb3cbe66df5e409b9e4abfa5cbd96a2f3bcac8f02f
SSDEEP 24:7+tI/bdiCzCHCZHCIC84CZ9dRjj4qNsONKYlpon/GKeXqYHfRXqCaqAFOk:7M00Q4i9sST34qNsYNlpo+KIbFrDAFx
TLSH
T1FD1333A55E2092A5DFC136B280E5722138E85E374F65D2364608789FC2BA84FD034D59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation1751709697678152329tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation1751709697678152329tmp
Size 573B
SHA256 d469fad9d39c1124e8b02a0c2985e942e2afce0eee0e54b3c41ce0e1c37c97aa
MD5 1938545f09b8cd92fed1206dcbf89c25
SHA1 34610ded77c78da32ef49382d3f5b29c56f1465e
SHA512 ca80b5f0378ec8f13f25e3df87f91276d90344981c8b936e9f24fb4a6111af5e29bdde23a814c26a476db87d1f4be0ae0c8d9d757fb2e0b87a12d812d23f7fba
TLSH
T1E2F0961C1760023EE8473F2AB54D8C804C44C1D712CA19D83FCDC1B9C980770E16B0E8
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation4159371891388412415tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation4159371891388412415tmp
Size 572B
SHA256 9037138599560e4198b411a7ecf8e2263f5586990c6d8f7e1bd20982aaf579ee
MD5 7918ac4e9902c97516f740701e92c73a
SHA1 97a93e16fdb2b9ce14c7ad549e68dc3e02dd0081
SHA512 6d5a46c6732b7648b3eeb9a10f0be1f4366e85048e64ce40da93cbfdc2169ae48cb177f71e3780f639e9d8ea01c01e788e25db89ffcb15681796617bbd62c04e
TLSH
T1D7F041168A200390E48B3F02ECC8BE806C0097E308CC0AC95EDE4168CAA2BA6F516188
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation5253579470604405197tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation5253579470604405197tmp
Size 90B
SHA256 512625f27e7a9b4b4254320e1f917afb7add8294a58366bc0035791eb821f757
MD5 7267fe086284192189a4642b99201de8
SHA1 1b6ca9b6aa687a94bd2e9638850b4ee5a66f8ebd
SHA512 e8088b4e8e53cd2957fb358230d6f0c94ce5a3f4bab5f0469aedd852cbcee4a8f33ff345e88d793d0e06fd6722415d432c343bc1606d1db104d223cae6b37638
TLSH
T197B012454730C141A4D5F2076D8DD1007D412484044ACA085F0AA14000D21E0C32B9E4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation5771020472425042684tmp

Path /data/data/com.nullx.corporation/files/PersistedInstallation5771020472425042684tmp
Size 90B
SHA256 245f599cc2155032512edc5591712d83c739c03b453eb37e435ff4d18cbe4008
MD5 df3df4f3671d97c152c90c4fd9b6c276
SHA1 09f60dc5aeb8f54b30b8bbc6c5c4f28c28117663
SHA512 0114099ec048fcafc2bd67f0e154d8d886324ef605fcaa0b8c8521779fdcda2d42543131c029c7fe75da83ad803e5ee86b501cdac40387a9faf814369617e983
TLSH
T1A8B012439E3041C3C6C9F2072D8CF1002E503C430C4D8F040F4A909001E21D19113AD8
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.nullx.corporation/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 6b3a1b3b21089157aa96d89ef4cc05b0f228b04b57da6f99066ad6541f693cd9
MD5 db828c12015f703b5df037ad7c187d94
SHA1 31b6dcc0f13d0d05ca9af4eeba0ab0f8bc844dde
SHA512 d492ef3c39ed4c3f25f958bd33f04615a0d3ec48c7a7e6c5d94cc8cb44c2b6b12c4a7ebc2bf7460af8287ae88480b7790d710c62b14083aff1bf501e12bfb186
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 8d9abb92e7db334ff76d9ca1e2ff2df7b021bfa464d7bedb06f5570b6f16509e
MD5 9ffb675ea159a4a6bdd35ce540772594
SHA1 f7a86236f42d00dc3a48199e9663f0f24e991858
SHA512 4da1570aa31c803413134637fd4c8833746185f959d651ff6f3fe9b17f69d60392c605ddacdaa5a01e0f90e616a8ad9ccb973b70b7f766ad246f51108dc0dbd1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 8e86dbc7f2e2edd388dbd5c023fbf21ffe7e921ad361feb47410efa5582985e5
MD5 00ab6bae484b08be0f06dedb10ff15c0
SHA1 158c50b181a6ca3adffbc972a6daf18342ac083d
SHA512 d7ee4902c2f0f87ec049632fb1a920c60e11d1148f07a5ad29cc587bfd7379e35a9177aa8e429a14bb7dbfe6673c7dba96098cb5c7afbe021b169122861375d5
SSDEEP 6:KW4yFswfyL0Rg9FZde/kPlOERX4PBX4ogLugMBX4suuK+/nyYV9vy/qqlPyi+Ow2:K5oqzdeWRmBEyPbP/vnE8Ow2
TLSH
T12B722B88A399A743C19C4776E0C5D37D0E646B1D3B57CF4B175944127C023EC9490D0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.nullx.corporation/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 94f302965487d12c01e387a11a1ec70cf50501b74ef31fa3ca7c8de064923d46
MD5 018d0cbf84ea48c9b76df9da5273757e
SHA1 2492b5d5202c0e92d7123bedf2ef457db7615ce8
SHA512 03dd0bcf6fbcf73820e18d1d0b6bc78707386ef609d342d819b59fc6d14513483a1854cc784cc38b09ca879a86b0bbd651b852a6403ada867c2b5b8b92057197
SSDEEP 96:ICY3qOCWSDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:HeqDPndjnHt9S/f8JzSV+6D86T0ED
TLSH
T106B3CE8E0F6D3600C0ED64B0D5D00AB1793E472DA793E7E166914075BDD6A31EE29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.nullx.corporation/primary.prof
Size 1KB
SHA256 b5d58f460dced8e73f68aee22c253827e990dcd326051cf3ec5852aedace369f
MD5 63c9468b93a11850bde6cdcb470fa67d
SHA1 91f5ba34e1a9a9c573f2c8cf2aab9e18e8d6e753
SHA512 4efe3ac2fb3f14095b6b58cade9085ef6a7b5ea498beffd3164e8dd2f5291c9ba49278541514d27216f1c6b06974ded04f7ab379e119839049f0bd42c57974ce
TLSH
T1F0312A0B004A63FDE531751FC93845EEF6A2744FAAA2848AC3352B361D5257D5D5C0CB
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads