ca53f94f4a75bc5d42df92e04442efc6a7a8503d2b3b517b8b0e6efeff570b92

Analysis

max time kernel
31s
max time network
153s
platform
android-14_x64
resource
android-34-x64-arm64-20260325.1-en
resource tags

arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
submitted
10/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ready.apk
Size 3.7MB
Sample260810-addrwafp8t
SHA256 ca53f94f4a75bc5d42df92e04442efc6a7a8503d2b3b517b8b0e6efeff570b92
MD5 4df204a0beda0d457df3ddf5c19a5427
SHA1 1c5b71018f6bd523d1729b510c4c7dd99dba0a58
SHA512 fdec17e284070369728e2d5354e76eab138ba9466a2402abcf3f53bc63f01c24f00ac035bae7a275775af56fab85e63081b8622402eaf47c90a7e21ecb439545
SSDEEP 98304:3dqu1TJZkB+T7iOpDL2WmzjzBVTQ0t0hqYa4:3FFZVi62hz779O
TLSH
T16C06E047EF85CADBD4B983F16B330D992A170F19C642AAD70468367E2E771C11EC5A8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery execution persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	informative.gossip.grip

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	informative.gossip.grip

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	informative.gossip.grip

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	informative.gossip.grip

informative.gossip.grip
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4320

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

base.4320.tmp

Path /data/user/0/informative.gossip.grip/cache/oat_primary/x86_64/base.4320.tmp
Size 24KB
SHA256 3bf64420897369005e1ec0087d71061ce64611bd7cf2ea993c53f54ea8b7ef1a
MD5 a022e0290d4989b0933140ebd5e3f728
SHA1 24179a40a0a18da665bb39142fbcb1a46be05bb1
SHA512 e3d451f996560b6854875e023b3abe179aa3602e48541b5387836db1b627607cef1bf2796b0963c4da9c5fc5d31b54d8a4cdf143a24937189c1f1eecf3cf27f8
SSDEEP 384:BYoluKyx1r8sebnG7fALHGmQy9APrVX3j9qjIXbr8WHkp5qiOSeL:pSubaSGmQdt3U03rkpw
TLSH
T1A9B20A6FE9A25060C092FFF2EA8716A8DA76E036170A6A2494F1773FA433F41D714F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log-2026-08-10.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2026-08-10.txt
Size 33B
SHA256 e174bd88d346084a09a8a7a725a58454c707259aa36beac5bd83f850cf1503c5
MD5 67bcc37a9b6aa7a023fcdd514f7670e8
SHA1 8545df8b54081ccc21fb117c107226107af02680
SHA512 756aef13b043f8e5fe4c48c948b1aa949fe4e5bf4e833292ae736e1b94eaded3aa0fa08339f8d9246a7cf10a0a78b9b78c871a1fc2eef5c3593a904809bc5b01
MD5 SHA1 SHA512

Submit Download

log-2026-08-10.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2026-08-10.txt
Size 33B
SHA256 0a6f86946b122728952d9d932b2262029502d42b4e7ec2be7a297659e85f1dd1
MD5 adac2a3a49a1e86a81069e5604973483
SHA1 e2f48c1bc3eb1588ddf5140293576378dae7e261
SHA512 c7fb4153604dfa199dfc8a44378c72bcd6e3cf33825cb3fd91c0a5cc5907931787eea82f5bb813c855746e78455d569b93f5821bb18e5d932c005ec5c2c2cd38
MD5 SHA1 SHA512

Submit Download

log-2026-08-10.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2026-08-10.txt
Size 25B
SHA256 a1ea0cecec3d74e34e9874060753be7786995c8cc62e1daa420f930122f43eec
MD5 29c860eaf6f36678345f0a9f6b9cc0d9
SHA1 7ffbfbc250be31fd70760cb9f0536e6e4f45c6ef
SHA512 290f920dbee3dd59bd258ec398f0816ee24a620392ce8deaad0e6d1eaa1208f891393522d8125aea4aef9163f9011a02b3463e2d41a4e24bde065fcbad57ed20
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads