Overview
overview
8Static
static
68d04bf95bb...53.apk
android-9-x86
18d04bf95bb...53.apk
android-10-x64
88d04bf95bb...53.apk
android-11-x64
1asset.apk
android-9-x86
1asset.apk
android-10-x64
1asset.apk
android-11-x64
1asset2.apk
android-9-x86
1asset2.apk
android-10-x64
1asset2.apk
android-11-x64
1asset3.apk
android-9-x86
1asset3.apk
android-10-x64
1asset3.apk
android-11-x64
1asset4.apk
android-9-x86
1asset4.apk
android-10-x64
1asset4.apk
android-11-x64
1installation.apk
android-9-x86
1installation.apk
android-10-x64
1installation.apk
android-11-x64
1Analysis
- max time kernel
149s - max time network
157s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
08/08/2026, 18:13
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
8d04bf95bba283046f069dbf3ee94261a4a7a35838ec8a569b14d03703b8cc53.apk
Resource
android-x86-arm-20260325-en
android-9-x86
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d04bf95bba283046f069dbf3ee94261a4a7a35838ec8a569b14d03703b8cc53.apk
Resource
android-x64-20260325-en
android-10-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
8d04bf95bba283046f069dbf3ee94261a4a7a35838ec8a569b14d03703b8cc53.apk
Resource
android-x64-arm64-20260325-en
android-11-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
asset.apk
Resource
android-x86-arm-20260325-en
android-9-x86
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
asset.apk
Resource
android-x64-20260325-en
android-10-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
asset.apk
Resource
android-x64-arm64-20260325-en
android-11-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
asset2.apk
Resource
android-x86-arm-20260325-en
android-9-x86
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
asset2.apk
Resource
android-x64-20260325-en
android-10-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
asset2.apk
Resource
android-x64-arm64-20260325-en
android-11-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
asset3.apk
Resource
android-x86-arm-20260325-en
android-9-x86
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
asset3.apk
Resource
android-x64-20260325-en
android-10-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
asset3.apk
Resource
android-x64-arm64-20260325-en
android-11-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
asset4.apk
Resource
android-x86-arm-20260325-en
android-9-x86
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
asset4.apk
Resource
android-x64-20260325-en
android-10-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
asset4.apk
Resource
android-x64-arm64-20260325-en
android-11-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
installation.apk
Resource
android-x86-arm-20260325-en
android-9-x86
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
installation.apk
Resource
android-x64-20260325-en
android-10-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
installation.apk
Resource
android-x64-arm64-20260325-en
android-11-x64
0 signatures
150 seconds
General
- Target 8d04bf95bba283046f069dbf3ee94261a4a7a35838ec8a569b14d03703b8cc53.apk
- Size 16.0MB
- Sample260808-wt45nabn4w
- SHA256 8d04bf95bba283046f069dbf3ee94261a4a7a35838ec8a569b14d03703b8cc53
- MD5 5b07f67da34f7f82085596377cbff072
- SHA1 13e77efda43d51f0fdabd553d18f1c967ed54ec0
- SHA512 be8918eeafe39613ffa8962c315220c02d67266f5ccdb12b5a63433d96d63d22900e41e4860a676e625324a01a8ec70480a2a2d79d5fe1f22d16734b91a44e3e
- SSDEEP 393216:PEyW9gM7lYxUlJZ+1BdkndAY31E4BftkDuybF:PvW9gkYxUlJ0BdkWE1E4BouOF
- TLSH T138F61288F768D42BC4777536517AA722414B8D068E83EB87B9047E0C6DB76C51F8EACC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 3 IoCs
ioc Process /system/xbin/su com.fireway.test /system/bin/su com.fireway.test /sbin/su com.fireway.test - Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN - Declares services with permission to bind to the system 1 IoCs
description ioc Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE - Requests dangerous framework permissions 64 IoCs
description ioc Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to modify and delete media files on this device or any connected storage device without user confirmation. android.permission.MANAGE_MEDIA Allows an application to read audio files from external storage. android.permission.READ_MEDIA_AUDIO Allows an application to read image files from external storage. android.permission.READ_MEDIA_IMAGES Allows an application to read video files from external storage. android.permission.READ_MEDIA_VIDEO Allows an instant app to create foreground services. android.permission.INSTANT_APP_FOREGROUND_SERVICE Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows financial apps to read filtered sms messages. android.permission.SMS_FINANCIAL_TRANSACTIONS Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Allows an application to read the user's call log. android.permission.READ_CALL_LOG Allows an application to write and read the user's call log data. android.permission.WRITE_CALL_LOG Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS Allows to query ongoing call details and manage ongoing calls. android.permission.MANAGE_ONGOING_CALLS Allows the app to answer an incoming phone call. android.permission.ANSWER_PHONE_CALLS Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS Allows an instant app to create foreground services. android.permission.INSTANT_APP_FOREGROUND_SERVICE Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Required to be able to advertise and connect to nearby devices via Wi-Fi. android.permission.NEARBY_WIFI_DEVICES Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Required to be able to connect to paired Bluetooth devices. android.permission.BLUETOOTH_CONNECT Required to be able to advertise to nearby Bluetooth devices. android.permission.BLUETOOTH_ADVERTISE Required to be able to discover and pair nearby Bluetooth devices. android.permission.BLUETOOTH_SCAN Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows financial apps to read filtered sms messages. android.permission.SMS_FINANCIAL_TRANSACTIONS Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Allows the app to answer an incoming phone call. android.permission.ANSWER_PHONE_CALLS Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS Allows a data loader to read a package's access logs. android.permission.LOADER_USAGE_STATS Allows an application to collect component usage statistics. android.permission.PACKAGE_USAGE_STATS Required to be able to access the camera device. android.permission.CAMERA Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to modify and delete media files on this device or any connected storage device without user confirmation. android.permission.MANAGE_MEDIA Allows an application to read audio files from external storage. android.permission.READ_MEDIA_AUDIO Allows an application to read image files from external storage. android.permission.READ_MEDIA_IMAGES Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS Allows an instant app to create foreground services. android.permission.INSTANT_APP_FOREGROUND_SERVICE Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Required to be able to advertise and connect to nearby devices via Wi-Fi. android.permission.NEARBY_WIFI_DEVICES Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Required to be able to connect to paired Bluetooth devices. android.permission.BLUETOOTH_CONNECT Required to be able to advertise to nearby Bluetooth devices. android.permission.BLUETOOTH_ADVERTISE Required to be able to discover and pair nearby Bluetooth devices. android.permission.BLUETOOTH_SCAN Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows financial apps to read filtered sms messages. android.permission.SMS_FINANCIAL_TRANSACTIONS
Processes
-
com.fireway.test1⤵
- Checks if the Android device is rooted.
PID:5027 -
chmod 755 /data/user/0/com.fireway.test/files/root.sh2⤵PID:5076
-
-
chmod 755 /data/user/0/com.fireway.test/files/su2⤵PID:5089
-
-
su -c sh /data/user/0/com.fireway.test/files/root.sh2⤵PID:5109
-
-
su2⤵PID:5186
-
-
su2⤵PID:5210
-
-
su -c pm install -r /data/user/0/com.fireway.test/cache/asset.apk2⤵PID:5240
-
-
su -c pm install -r /data/user/0/com.fireway.test/cache/asset2.apk2⤵PID:5290
-
-
su -c pm install -r /data/user/0/com.fireway.test/cache/asset3.apk2⤵PID:5329
-
-
su -c pm install -r /data/user/0/com.fireway.test/cache/asset4.apk2⤵PID:5360
-
-
su -c pm install -r /data/user/0/com.fireway.test/cache/installation.apk2⤵PID:5394
-
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.fireway.test/cache/asset.apk
- Size 5.6MB
- SHA256 7fb6d1fcd935b51daa5198001dd09a1ed22497071ae14dacf7137a7cc0127b46
- MD5 f27addb601a513c135bb273bb1fdb2a6
- SHA1 903da9273dfdfd8739b9f40f93750677f6f12cbb
- SHA512 a94ae86d43d131550b68024ae56b8d3c0885eec18caf6877da40043e99d2eb6ff83fba955af7b6f34f5ac67626d6926ea2712ffb41ec46c0589bff6a6d722d5b
- SSDEEP 98304:CChcO8ftRrda8VYW2g7U8Avke75EEppppTuE3iO6eHvjJCpXujHaFZyOT2UyJLty:CChh8VYF8AsytupmvjJCpXmaFZTOy
- TLSH T1E346F185BB48D92FC477703645BA9722514B4C168E83D793AA543E0CACBBAD40F5EFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.fireway.test/cache/asset2.apk
- Size 116KB
- SHA256 88fc4cf626c1e47aae476379b7c929908cbeafec23915b4a53f20b105af5555e
- MD5 df15e8a0453576f9eb04722730c886d9
- SHA1 4fed63d5240e28c84af20191f85e7624178fcade
- SHA512 1a28fe832965ba1b8bb17ca08c2382ec99de7366c10886984cc7a8f0c55ea70fb8a2c9ed0af4cd36b5379b56c314cd515505baccfea215e3b55c5158944f0579
- SSDEEP 3072:eN9ECS+FAsATF1ncX/2XWJK647IgmSoalKcg4xh:TOucX+G/43mh2VvD
- TLSH T14DC31216CF68142FFEF6F234208F67BBB966E2BBD85C81B726C508111CF26516D8614B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.fireway.test/cache/asset3.apk
- Size 112KB
- SHA256 1b6b477bcddd4caa0c030db534658034885271a6e617680e1e6620002887ff7b
- MD5 5dae0e1317fe8a8faf6636e00d23148f
- SHA1 b1459609693fc9159b6993c53bcbfb5cf6747e1d
- SHA512 2ce1a0d186b867c220659d9faf5df35b208eaccd4da28f150d1bae962da669edcacb2f135a8fff667e865fcb03a01ffc786edffbbdcadb6caf522da30094e3f1
- SSDEEP 3072:xeDDpfiATF1ncX/2XWJK647IgmSoaNtqn804vv:sDgucX+G/43mhytU804vv
- TLSH T1E3B30229DB35C039DEBFB63490C7539EB673D69E6484A3E7182464922CE1972288B1CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.fireway.test/cache/asset4.apk
- Size 100KB
- SHA256 6bf848b116ca94712993e841f1c99ab8d1f0c10c2991e0cc3bf84fab91921e98
- MD5 0eb72b7e7a6c1f4522d197eb23ad4caf
- SHA1 de8a26c16471405c75210918a06e5c98b447d7a2
- SHA512 f041a06be2555d4f8da1bdc2dbf1e42e5483604f1f227f464d8b4dbbfc83836f383079ddf58b9c8f31d6d61fd6fe50cde655dd8851316cb7f4353c7e56237c76
- SSDEEP 1536:MWeIfAAH7H0TFU4nGlvDbgau02XWJVcmV4iMVz5O9ivmSXBYnHhwF7ohugo3MXhc:s36ATF1ncX/2XWJK647IgmSoaYVm8Q
- TLSH T164A31265CF3C112AEA76F63851AE3B537E36A5E7704C51B328D908A23CE27721D8709D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.fireway.test/cache/installation.apk
- Size 6.0MB
- SHA256 9d1eeb420a8d3cdeb9851404a335695ca556e28c647a4fa94caaf80e2d637d6a
- MD5 b8f56cfac14fd78d0952e104a6daf37b
- SHA1 c97460bb1c98d755da17fdbebbb4eed9b8af9569
- SHA512 e48314b87ef627bd07f7373e7e13f5c9325c2138e01e50783edc1eb8a573e177631b35eb7feea25205402c05ed32b1403e3b0a4ecbd629e9f772875f4ec3e670
- SSDEEP 98304:U69+A0GHGpdSW297U8AvkeaiEEppppTJE3KOLDAvjJCpXujHvALyOT2UPzQhOEI:cpdSo8AsatJldvjJCpXmvALT+RI
- TLSH T13356F188FB48D92BC477553345AB5732418B4D069E839763AAAC364C6CB76D40F8EFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.fireway.test/files/root.sh
- Size 780B
- SHA256 f144de6105f3102164babe1e73f52e6c764a1cb612552f30d8086096b7fd354b
- MD5 f2439ef4706c559fd814f65eb81979c7
- SHA1 e26a3c40747e808bbc5ac9453623ee02d5a84139
- SHA512 09923d9ee32d53c275ab136f1be02b67037350ed9f67347aa4414160c8b35d97aa83dc85ab418c3803ede36f2027f69fc4bab7f90431866a2e0a767f29f852d9
- TLSH T17A01D0667704A4B08D262374A45D0CB82B24713C7B56BC2D1CDF52B972241EE2B7E7A9
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.fireway.test/files/su
- Size 25KB
- SHA256 3c8505a3452d1045f33e0a2bcd1d8650056493229b501bfed46b54ef0d7f5f66
- MD5 6a64d2ed128b3229d66cd0b075e721ff
- SHA1 6f1c70772d2f81cdaf6062c92dfd50121cd99e2b
- SHA512 f3ee2310417112b280af97292cb7ff54905e95c1a81cc1a6132ce8a48728964e7499abc1b6b48f8c53eb2fed4d7cd82a3609434971d71e6aa48764043118b3fc
- SSDEEP 192:Nak21ufrlyK7rsasnRqeC8oToQy3CheXz7VHHUu6SLt:augu4RJBoX0SeXz7KSLt
- TLSH T134C2B3CAFB272C37DCDA0734621B0D232E7CA48587991B2B6C4A61B93905B0DE356FC5
- MD5 SHA1 SHA512 SSDEEP TLSH