44f9d5c684fb6f34465cd7593709a37cadb57aaf41430b0d043fa593e4faacab

Resubmissions

13/08/2026, 20:23

260813-y6mggsxvax7

13/08/2026, 19:41

260813-yeemkawwhw7

11/08/2026, 19:39

260811-yda8ragc937

Analysis

max time kernel
7s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
11/08/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TikTok18.apk
Size 8.4MB
Sample260811-yda8ragc93
SHA256 44f9d5c684fb6f34465cd7593709a37cadb57aaf41430b0d043fa593e4faacab
MD5 1da48686908f9535d7123713deddbd7f
SHA1 7f6982bb0b21b1d4ef0b8a21e5a7ddc7dfc4b09b
SHA512 a5971a9179f32d5085b09e1ca7e3c3501f90b9cf9523603e570feaf2cc2d4616b50c90bbbfed57cdafa01ab4fb5d5a1224b3fe0b09655e4cbe1b9a83e56eaf97
SSDEEP 196608:9KVxAgmf7PFRljf+yW+QxiXqKIeN4UbhwCBZa3q:EC7xfbW/XOThwQZZ
TLSH
T1C896225AFB05D09EC0FA42364A350266150B1D6A8E83E7875959733C1DBBAC08F6BFCD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	video.lotus19.ridenovel31

Requests dangerous framework permissions 19 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	video.lotus19.ridenovel31

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	video.lotus19.ridenovel31

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	video.lotus19.ridenovel31

video.lotus19.ridenovel31
1⤵
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4323

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.payload-id

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/.payload-id
Size 64B
SHA256 5896f30b2637444064f15042dacfb2748a48ded5a8f9117427db7e4f1c2bfc78
MD5 78f55c4109e256d31ce72c7c9b96a176
SHA1 46e09f2be51ab8567a7d24cab404ecfd0593b366
SHA512 d544c507def2b2ded69c6c896d9693d5ecd99be646fab2e008783c01ddb4757675e610f0fc5a6645d6e50bd478a62c1af63f7b92f617b19ef7dd2c49a1f75528
TLSH
T190A0220AE830800EB0CA00EE33323A2820F2C030228820AC020800E20CE0022B8A8028
MD5 SHA1 SHA512 TLSH

Submit Download

child.apk

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/payload/child.apk
Size 7.8MB
SHA256 3c669c3143af7ad4a6c099ddc0c8ebd4cd8cb4c9c582d202fd01b4bdd3b4e1e6
MD5 6401fa4e7622fd6facf931e479cc6eac
SHA1 8291f6c99f9bc623646ba3a40b3b5eec8e81de1e
SHA512 c4add856f177e240e17a260861cf2a4a32de40a449321daa906c70cbaed7fa94b58fce175eba035bbb25a0a9d3265fa92241390998abe2fb809d0a54e9cc54f8
SSDEEP 196608:7BTzGidntWEIZ+HJLuPdZG/fZp/cXus9b:7BTJWDZ+pKcfoem
TLSH
T1E186BF07B3418EB2C8BE637295B35B3163335D46AB0397472508B6BC6CB75D42B89BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n-catalog.js

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/shared/i18n-catalog.js
Size 39KB
SHA256 4cd4ceb977ba55e4f2ba30072642dd8d8a3b75a1d77f6b9a284776bf0b0160e7
MD5 138848003779943552e8994f2e91d297
SHA1 b34ab15250d7f8196c7e1c274564f2d743e8e13c
SHA512 afb5b806ee71c9bfcfdee53e5c6142c92fa2ac195307a351c886c6590a3d24032bd9689bb71677e1da1b0470b265fca9a585b78d44ccf2b9d59eea2361a5745c
SSDEEP 768:XesNs0gkN917lZ+oT35V32sxu63w45uP7Ha5H3MHeXt0EYsJvI9fg14olFkL7V+2:Xees0gE7lZ+c35V32r6A45OmekfkPV+2
TLSH
T1D6032C6EC25562206D84A385091B35312E2048B37B2679E43BDE59D14F8E58FE3B37BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n-runtime.js

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/shared/i18n-runtime.js
Size 4KB
SHA256 633fd94bd7547ecd11bd23d0eb16c11122b37c667458eb1223bcd5a9da205301
MD5 d9a7dfc6a4d70fbee09033516dd6f360
SHA1 b2bc6969a5d274a871369475ee5b940e665a67cf
SHA512 1046809eef6ad06c5abd45a0e5f9ed5cc61e286eb914ae7be635e2a5115d6c47f38102fb28d390489d1428771107638d30fe2ce8f931f326fc467e04a75ba915
SSDEEP 96:yiO51aE6oFyp+oryLvCXMA+RoWQ52do0Dos7owo4oLogo9oplFCtK6iQ2Wf7tG7V:ifGpQjCXyjQuyyiQ2Wf7tG7eNjc8liQO
TLSH
T10581B9ADBCE311025502742C09BF0680783480070AADEE42BFAD99565F985FF66FBBDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google-play.svg

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/shared/icons/google-play.svg
Size 1KB
SHA256 8b25682204477dec055a59f72cb72574e2958196c715391b2364e4b086d314f9
MD5 579b8189936bab6778bfdd8c19fc493b
SHA1 f81cfd87d033bb64c537dec8031ea542d8f22b03
SHA512 7532233d9561bdb8072beb7f97144a278f61a9c8f478c69f95434d00d34217f4aa9e3dfff7e8c540c320ee4f350714a96f5a188a1f5b7d108e338ef5e806a00d
TLSH
T10631310DA5965C3F5A72C7A462F49D8B673224C783A8C8DC85A92C3EE65C5C021BC6FD
MD5 SHA1 SHA512 TLSH

Submit Download

star-outline.svg

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/shared/icons/star-outline.svg
Size 278B
SHA256 c08437af20cb85cbd5f0a4c901f63476c2f717b37ba07ad546315ef514d317d2
MD5 a5feff4b1477efe7a3d525856fbcea71
SHA1 298d27aefbff453371ed0e432117fd3c0f0f1eec
SHA512 d76e3af49a883214cdba317f9e215a476e84c79c04357e3c5efc2951a49792c43fd3396289de584b64182e568487f14d1c3839ff5b358a4bb10db0e1aa14a2a5
TLSH
T15BD02B3BE0296D88477F429109B9CC8DB27D921B45DD003DC9BA514485A1AFA7B2A4BC
MD5 SHA1 SHA512 TLSH

Submit Download

star.svg

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/shared/icons/star.svg
Size 381B
SHA256 513a0f450ac62c6bdc6c6cb8701896ea4ac7a82121b9e19cc52596fd7ce3b5fc
MD5 fc5fd2338d246078b4a4fa29413f23e6
SHA1 52d73cabeb5e64bb9e1e024623a90a0e0cb888b6
SHA512 8abce8608cc9351440e7ec2cb624841b9357f1e6a8a9f926f4801f11b691c8cc1a2961c5c22373b677255e8ed51856932c33bfd4245ab1836c43c03a7ddb8afe
TLSH
T142E0680BCA1C6626838C0655A978B884D13F436A426E52DDEAF751106408BBFBC4EB88
MD5 SHA1 SHA512 TLSH

Submit Download

install-state.js

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/shared/install-state.js
Size 9KB
SHA256 e40a4d7a2782580309da5ee86bc24150fcbf7df17f65899c22bc2e97591a78cd
MD5 79fb64672fc268e918c2e31dc3f37fa5
SHA1 223c7ea25b4a72ed1d9a144e99a4da2d12601da5
SHA512 78733179ec45dd0f2bdb954653f845287cc0dc38d6a0e3ae7997061c75be9d477731c562729397c332e141ea5f7c7596bc06cb6352ddf5e6af0c786cfb5a0688
SSDEEP 192:pbCjNkD5WkoQi0TGyo10CEfoPnEBEaOAAeDHl7pPcsOPEHr6JSFP0HPie:pb9FWepr6IFM
TLSH
T18812838F949314B59C17B974C64F41503D21499B240DFE10BDADEBD0DF830A9A2BABFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/upgrade-template/app.js
Size 4KB
SHA256 c7f7411489da72c3624f0f0a6654eb8f5b19dc2eccfcebfb9dccc91aec94c128
MD5 972d7bb25d74a85b01fceb92e3d37e81
SHA1 f9d9a07271104073395c705c77b10c2f5b2c1d66
SHA512 b85ec05d9643bb687b98a973da2a0820b28b234a1bfb3d9dc6cff4972e5cdb731d0f10c9aed2739fef640f3de8bfdc68481710310b8a8fda1cda743ea5cb3115
SSDEEP 96:3n7TLwKdwA4Mv8+xs+95g06aQa+ZqhqG8+27hXP39dV+O+/Cx8zWp/Q:3DwKdwA4Mv1xs0uqhepP3vV+1w8/
TLSH
T16C913F28A8E3147D8527702D136F36847C2680131402EC19746DC8DABFAAD63A7FEEDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n.js

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/upgrade-template/i18n.js
Size 5KB
SHA256 c771ad6ac7446a58072033fb6245146259c996ff2abaf31d9d497a552a66a810
MD5 c00aa9ef7ab440e001c443a6a3fa2a5f
SHA1 2df57a4884211b6541d84ffbb5e4a795d6fbccb7
SHA512 5892871315abe40bd76f1ce7d0b6cdd515ef4f7fb66b5e43f061a9307a9081e59c439bac44289a0b3a89807d1a9a33ca606df5fc54d261a29d0e6204ae0dea0b
SSDEEP 96:8Dg1tFcIJTX6pOfqIMoDKo/DrRWiY8+I+kWwaw2JE/9xz4h24s4BWrcGOoqKKhMY:hK6pY3E0OnXT4icGOFKW
TLSH
T146C1853906972485899CB3AB228E37327878A09E561CF8F07C6D95D54F8C9569334BB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/upgrade-template/index.html
Size 47KB
SHA256 07d22ac76f402b6d09f03996a27d4129b0e9a3845ee5d599fa2c3ebcbbba9665
MD5 a098be9a8270ad9546110f2a9179d8ae
SHA1 d4b01ac5b32e690c353341491d4a7404b49ccf90
SHA512 0785793454dd5acd8ba5dcfca6cdd5271c4af739395b9ae1c03165444c5024fe1815750022622612649f36bf51ea1fc2cc2a99deb831e326894151852d093dca
SSDEEP 768:8C34s1S0HUpRtvrbXyHzwi3dzsE1WP7GCl1zNpmVCvWqc5oqCwqLQjw34Mvsem:8C3r1l0TbazwyZsE1g7rl1JYCvWqhdwP
TLSH
T1142301515C72F9B60351D9E9BAA12E18FDF08DA3C38A449C717C1D930FEAD68DC6291C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.css

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/upgrade-template/style.css
Size 10KB
SHA256 fe17237d9cd947f794dd6e3a197d2ea06575e7cbf0fe635fe9172238ad51dc54
MD5 eff83f68b893847e5e3a6c2acd567102
SHA1 60605d2c6a4bc95f8cebe3f34c59e73e4c3c73c7
SHA512 754cee095fc66252bb6d381ff06736e2d2483a852f7a09b3c50431ed5fcae9ef881a39694ce9ddc928743fdf12fb981bcae8580772ad5c6c1389f4192728ee3b
SSDEEP 192:VArgWLXaui42Lkz7ZB4Vw61xPmN3CtYeK7cxFwAF2VL2C6Y/2LfBKFCw3YI/NxE/:4lJW1KwvQl6gboFkhgHl
TLSH
T141324312A630D57D7C3FD6BD670B5B1AB7688906090ACDED6DE8200C5FC53FB6422B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vault-config.json

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/vault-config.json
Size 114B
SHA256 22a607b9254796ee95f3f4038af91cd91a08eccc12e6905f28289670501b02dd
MD5 6eacc8d1ca5dac9403cde422a89c2e17
SHA1 45da27f40d5d094115d3d6886b54b18c2af285f7
SHA512 3d603edd3cd681bdd007ae886eb153da34ded843b74ca9552bd3edf81d447a63b683e9963ad07a08e8de7f03c42c1e968740587043c98c23f9e7fd78bced1c75
TLSH
T13DB09216B382425637E635AE102DD1061CC4188667024CF2BFFB1F4CB81B20B219F84A
MD5 SHA1 SHA512 TLSH

Submit Download

profileInstalled

Path /data/data/video.lotus19.ridenovel31/files/profileInstalled
Size 24B
SHA256 4e0d16176ea3be18456cc502c3b8affdf6a176de565d2c7e17d169e23dd59da1
MD5 d80fdb7f3b8c017f31b19629d6e7af0c
SHA1 49968b6596070055cc32a5b67a47562832c51bfd
SHA512 6523cf7582471d559991bbd200e5690839ad632a6b5f5693d2f9e3959c021623cf4afa2e88eed0c996dabd803a14e1f14045ef036d74832c7f0b443373503c72
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/video.lotus19.ridenovel31/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 782ba70124b1748768da45308e51cb1f1eb6129fe9a043c7646765386539399b
MD5 68e51b104a7b738d2505ce6b78c0fe8d
SHA1 c87bb3cd0f67c2a2a7b3e9ab2656320e8eb1a601
SHA512 2a06a9ad2026786dd27a632422cdac427be62374f9ce910327afcfce35945f2910c789a1fef82d15984b1bfe752905cc98c924c778f47012df2ad6bc85259c08
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/video.lotus19.ridenovel31/primary.prof
Size 1KB
SHA256 c61c6215449b3f00165cc632b025b2090ce7d4e50e27c0807ae556d4ffb3fa34
MD5 c33cedb12258bc3098760145d27f93e0
SHA1 4023ccd244e7a59fc7d0cf865987093316637e11
SHA512 fb950a8e7603c3bc2e17ccb486b2ee039d6184608f40a089f7052013b26f3e69426dc8acb570851866583b6d5bdc0932052f7b27d66619e0f699acc1b845f04c
TLSH
T1C921C6C0562C96928B36FF58C521841C2ADF1F494C3234AE47223A988C99318DEE2DA7
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads