Analysis
- max time kernel
148s - max time network
153s - platform
android-13_x64 - resource
android-33-x64-arm64-20260708-en - resource tags
arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system - submitted
10/08/2026, 00:05
Behavioral task
behavioral1
Sample
ready.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ready.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
ready.apk
Resource
android-33-x64-arm64-20260708-en
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
ready.apk
Resource
android-34-x64-arm64-20260325.1-en
4 signatures
150 seconds
General
- Target ready.apk
- Size 3.7MB
- Sample260810-addrwafp8t
- SHA256 ca53f94f4a75bc5d42df92e04442efc6a7a8503d2b3b517b8b0e6efeff570b92
- MD5 4df204a0beda0d457df3ddf5c19a5427
- SHA1 1c5b71018f6bd523d1729b510c4c7dd99dba0a58
- SHA512 fdec17e284070369728e2d5354e76eab138ba9466a2402abcf3f53bc63f01c24f00ac035bae7a275775af56fab85e63081b8622402eaf47c90a7e21ecb439545
- SSDEEP 98304:3dqu1TJZkB+T7iOpDL2WmzjzBVTQ0t0hqYa4:3FFZVi62hz779O
- TLSH T16C06E047EF85CADBD4B983F16B330D992A170F19C642AAD70468367E2E771C11EC5A8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId informative.gossip.grip - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock informative.gossip.grip - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground informative.gossip.grip - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo informative.gossip.grip - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule informative.gossip.grip
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-08-10.txt
- Size 25B
- SHA256 a1ea0cecec3d74e34e9874060753be7786995c8cc62e1daa420f930122f43eec
- MD5 29c860eaf6f36678345f0a9f6b9cc0d9
- SHA1 7ffbfbc250be31fd70760cb9f0536e6e4f45c6ef
- SHA512 290f920dbee3dd59bd258ec398f0816ee24a620392ce8deaad0e6d1eaa1208f891393522d8125aea4aef9163f9011a02b3463e2d41a4e24bde065fcbad57ed20
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-08-10.txt
- Size 21B
- SHA256 d153cc76e9f7a12c26dbe0d197285a77fc8efeed1b1f3d35c25ba386711b5c80
- MD5 40fcf48a4ecdb632240619eb756772ce
- SHA1 83706b0dcc3ff8032962dcd0d73a36ba65dd6f30
- SHA512 4757ed0904a24ed77c8c2dca9be96f084cebc54a93c43eb0eb27545aba7e58916abb0b639254d90ebffea1e760b85d0a0fe53ada28194734748116475dd9829b
- MD5 SHA1 SHA512