Overview

overview

8

Static

static

6

sysorbit.apk

android-11-x64

8

Resubmissions

09/08/2026, 08:41

260809-klmd4acj7x8

09/08/2026, 06:14

260809-gzn83asbnh8

Analysis

  • max time kernel
    6s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    09/08/2026, 08:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sysorbit.apk
  • Size 2.0MB
  • Sample260809-klmd4acj7x
  • SHA256 f1d67dc388635f8e854dcd04b7a2c423ee64d60f21a760104ba4a679ebe3f46d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionevasionpersistencestealthtrojan

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 8 IoCs
    defense_evasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

Processes

  • com.sysorbit.service.security:system_update
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Makes use of the framework's foreground persistence service
    PID:4733
    • pkill -9 sys_update_helper
      2⤵
        PID:4823
      • pkill -9 libsystem_core.so
        2⤵
          PID:4808
        • /data/app/~~0RmGfX8-FE3jECBZ-ozc5g==/com.sysorbit.service.security-lWrKLme62PmJRBdHF5sepg==/lib/x86_64/libsystem_core.so
          2⤵
            PID:4845
          • pkill -9 libsystem_core.so
            2⤵
              PID:4874
            • pkill -9 sys_update_helper
              2⤵
                PID:4888
              • /data/app/~~0RmGfX8-FE3jECBZ-ozc5g==/com.sysorbit.service.security-lWrKLme62PmJRBdHF5sepg==/lib/x86_64/libsystem_core.so
                2⤵
                  PID:4907

              Network

                    MITRE ATT&CK Mobile v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads