20e8688726e843e9119b33be88ef642cb646f1163dce4109b8b8a2c792b5f9fc

Analysis

max time kernel
46s
max time network
153s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
13/08/2026, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20e8688726e843e9119b33be88ef642cb646f1163dce4109b8b8a2c792b5f9fc.apk
Size 13.5MB
Sample260813-a131aaybkc
SHA256 20e8688726e843e9119b33be88ef642cb646f1163dce4109b8b8a2c792b5f9fc
MD5 acaed4c74eb9f0c85c603d4077a95697
SHA1 6683969c617c5d72dcd1cf32500ed34ecb427ecc
SHA512 a41a994d918362c767932cde41552426de32494996d0ce5e6345b1082ff257e09497909264d2d1ce5485416c895dd242f0238eb4036f688733809bd48d7e0114
SSDEEP 393216:lYbH5macX7X52NWdXJq2TNhTfwa5pMrfum7j:lYbZqgY56eqj
TLSH
T172E6228BFB98C51FD9731632C917453372A31E0824929BBA2315F32819B7D425F57BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker defense_evasion discovery execution impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.abbondioendrizzi.tools.supercleaner

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.abbondioendrizzi.tools.supercleaner

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.abbondioendrizzi.tools.supercleaner

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.abbondioendrizzi.tools.supercleaner
Framework service call	android.app.job.IJobScheduler.schedule	com.abbondioendrizzi.tools.supercleaner:BackgroundService

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.abbondioendrizzi.tools.supercleaner

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.abbondioendrizzi.tools.supercleaner

com.abbondioendrizzi.tools.supercleaner
1⤵
- Checks the application is allowed to request package installs through the package installer
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5043

com.abbondioendrizzi.tools.supercleaner:BackgroundService
1⤵
- Schedules tasks to execute at a specified time
PID:5121

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

dbytes.db

Path /data/data/com.abbondioendrizzi.tools.supercleaner/databases/dbytes.db
Size 20KB
SHA256 9e64343b7809521d691507395087aba66a11835b55d2d489506dccd0b4726e06
MD5 4c01c77b31309cbe270fa97a581a4151
SHA1 95bb06b7da5708cfdbee5f19a3bdcbb5e32a089a
SHA512 d001123ba6a5f24d417b38ff2d71e2bbfa2f1f499ef78558d2c846a6d2700d5e1f6bfae8d16874c9c470fa4024f8085349146bfbe47854906e8d40e0e3a7ce6b
SSDEEP 12:TLyKEVwTUDz/RmBEyPbAVOwNHEwnpPHEM:TLy9VmUDwGSENHEsPHEM
TLSH
T17A92C6659BC92533D3305575CC02A3418EE9D37B8745E7A354A12844BCC130D6C51E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytes.db-journal

Path /data/data/com.abbondioendrizzi.tools.supercleaner/databases/dbytes.db-journal
Size 12KB
SHA256 c1649c9425077397ee2e560ca69dab923aef3bc50c1192f36caa84acb5cfea8a
MD5 2e86beed5d2c34712847ef813ec8f7a4
SHA1 f6c2d5bd5864679d9c4ad1478a15d61c44c8ad85
SHA512 76a88e464a69cdc2014ebd7c459a43bc71f505abcac32b41c9c6d20aabec040ffe81ee430085798f7e4b61e97c84c80d3383e3f09992d93a04dfd8f951910067
SSDEEP 6:7+/lLrcim/aZ/ng9bNFlq4yl1Wl09d3RRztLu6fNZ74LoDp7t8ERX4PBX4ogLug/:7+tLrcim/K/nqLm3wTUDz/RmBEyPbW
TLSH
T16742C046EF013433C139E1F1DC921351ECF033484176C77325E12828FF5254450B9D60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytes.db-journal

Path /data/data/com.abbondioendrizzi.tools.supercleaner/databases/dbytes.db-journal
Size 512B
SHA256 a0969b95201c9af5146338e356a603c34f1d0cf5295a7025ff52b0e5b3368399
MD5 5f6f2aba5577280e787e9f91b7a8f574
SHA1 314b46d6a7d8663cd31c286a7e29835980132047
SHA512 6ee3caf739387ce401d746a848501469014e601929d499823974f2cd30e9dd385fd862ebf7fbe354f346a2525ea77d5865d14d30d7c114acaa45020b72030e59
MD5 SHA1 SHA512

Submit Download

dbytes.db-journal

Path /data/data/com.abbondioendrizzi.tools.supercleaner/databases/dbytes.db-journal
Size 8KB
SHA256 355c9d8872b8271c72169f5212dfe4245d023f5cc0cd73171234262961cdc3e3
MD5 a8df8a5ddfb5b0652d5786330cb64911
SHA1 065b5265700d93a8dfc342800819717dd0208f1d
SHA512 e45510849da35ba0035deba074eb2395b15ac2c69bbfbab041a194ffe4a72b97231b7ee864ad285b90e5e569b8c4a32cf9afcd4e895713aea62e72e0ac361e96
SSDEEP 6:7+/l9bAon1snvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKeE:7+t50nvqLiuWdwRmBEyPbTE
TLSH
T1DF02228963800922CA1926B7A0E583411D40F71A8371CB4F2B6009983C038CCA4A0D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytes.db-journal

Path /data/data/com.abbondioendrizzi.tools.supercleaner/databases/dbytes.db-journal
Size 8KB
SHA256 af929a06a8bae16d9564ecace7c89f93610c8044ab73be96730b5aa7ffbd2a0a
MD5 eae5ca19deffb99e2b53ccf06dec610b
SHA1 d8518777f5e34e435321a6c23bc704a0eea69c81
SHA512 06e01203e3b79f0309bda0c9a712c246da46b6fae07eb21ad430df65bae2ddf8de7273c0b5b0c425eb8c6a9f2be9ebc66eacb90fe65f68e70b710f10654b91f6
SSDEEP 6:7+/l9HCFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKsO/V:7+tlCBqLJdTRmBEyPbv+V
TLSH
T1CA02228963400A13D41997B7D0D883403E10E7B48223CB1B15A008B87C026CCE890D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.abbondioendrizzi.tools.supercleaner/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.abbondioendrizzi.tools.supercleaner/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 25d90cf0490ed943f2883425229e33a13fe64476af8b44abbc4ea893436cecd0
MD5 7abc7f55bae045103911cd864e102152
SHA1 03e38276a3869bc2de03b33df3f33b4c29d19a30
SHA512 2829996f8d0a8475bb8fefe59bc6de7d50a9be5b93a021c04ee97542238204798c9a36bc65f7f6291d24112a14e5ab8a8bc04fbcb0d483abfa10fc02b77a4ca8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.abbondioendrizzi.tools.supercleaner/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.abbondioendrizzi.tools.supercleaner/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 f7cd000a1692ca7627f57fa5e7b7e6364ec6ee5c366d57b85ee8a0e5ea17e4ae
MD5 a2a774a896c1b75840ca8c0efcf40497
SHA1 c2ce668b38d4c7acd547e176c962b7e91a821713
SHA512 b98152fb6ad5569a97a1b136855d9abe466267d8d1427aac886148a0aba88a45be2fd8de425e8637a5ac9c6f731106c8508733eb3dc84e7a8e0961ff357c4878
SSDEEP 6:K1dKtyeVWg9FZdrlOERX4PBX4ogLugMBX4suuK+/9alXw191AFiOw2:K1YFzdTRmBEyPbP/9Ow1HOw2
TLSH
T17872C295D3C00AA2C204477650C4C7D12DA35A1847F3C757D52406D9EC61698F561E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.abbondioendrizzi.tools.supercleaner/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 4a2b6535c2e2ad4c2c0f0fb15833065a2c7c79435407cb22ef2da412d677dc40
MD5 17cf2d7779fe62f421d066dc0d422a51
SHA1 cb7120218fc141eccddd854368c2d6b51201556e
SHA512 f7334f69dce40636bac5a10ee420edc03e930ba41a4887e6f2204195b40fbf6ac2c6450f47573cdcff4cd08731def54a43ece4fec96ae1f04dfeadd5884c0fb2
SSDEEP 96:gDkZ6+hdjnHtDRMpf8UzS5+TD8q0ExPODd:TVdjnHt9Mpf8UzS5+TD8q0E5Op
TLSH
T113B3124E0F592500C59998F096D00FF1793F452E97E3E3F5A59101B9EED2920EE2ACFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads