Overview

overview

6

Static

static

6

Services.apk

android-9-x86

6

Resubmissions

13/09/2026, 08:45

260913-kn8ecaw1dz6

10/08/2026, 12:28

260810-pnhadaydpc6

10/08/2026, 00:04

260810-acmcmaxgkc6

Analysis

  • max time kernel
    1s
  • max time network
    3s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260325-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
  • submitted
    10/08/2026, 00:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Services.apk
  • Size 134KB
  • Sample260810-acmcmaxgkc
  • SHA256 96e6b11b992ac2ec74c14cba62b5e0fe952224ae026d3be82a141fe6213dd731
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasionexecutionpersistence

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • system.bin.svc
    1⤵
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:4329
    • sh -c dumpsys deviceidle whitelist +com.google.android.system.service
      2⤵
        PID:4356
      • sh -c cmd deviceidle whitelist +com.google.android.system.service
        2⤵
          PID:4370
        • sh -c cmd appops set com.google.android.system.service RUN_IN_BACKGROUND allow
          2⤵
            PID:4389
          • sh -c cmd appops set com.google.android.system.service RUN_ANY_IN_BACKGROUND allow
            2⤵
              PID:4408
            • dumpsys deviceidle whitelist +com.google.android.system.service
              2⤵
                PID:4356
              • sh -c cmd activity set-standby-bucket com.google.android.system.service active
                2⤵
                  PID:4433
                • cmd deviceidle whitelist +com.google.android.system.service
                  2⤵
                    PID:4370
                  • sh -c dumpsys batterystats --reset com.google.android.system.service
                    2⤵
                      PID:4455
                    • cmd appops set com.google.android.system.service RUN_IN_BACKGROUND allow
                      2⤵
                        PID:4389
                      • cmd appops set com.google.android.system.service RUN_ANY_IN_BACKGROUND allow
                        2⤵
                          PID:4408
                        • cmd activity set-standby-bucket com.google.android.system.service active
                          2⤵
                            PID:4433
                          • sh -c echo -1000 > /proc/4329/oom_score_adj
                            2⤵
                              PID:4478
                            • sh -c echo -17 > /proc/4329/oom_adj
                              2⤵
                                PID:4511
                              • dumpsys batterystats --reset com.google.android.system.service
                                2⤵
                                  PID:4455
                                • ps -A -f
                                  2⤵
                                    PID:4555

                                Network

                                      MITRE ATT&CK Mobile v16

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      libkys.so
                                      • Path /data/data/com.google.android.system.service/libkys.so
                                      • Size 173KB
                                      • SHA256 23c474b202d48fda1a584b46cacc9af3cb2ed1548d9f5f0b67177c5fb2070bbc
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download