0fa3360a6a00ec8d3c988f4f81be8e79674bb8cf58c9350237062eb60f54bf4a

Resubmissions

16/08/2026, 17:57

260816-wjr3catxhz7

16/08/2026, 16:53

260816-vedhqaep2y7

16/08/2026, 16:47

260816-var6bascmd7

Analysis

user interaction
yes
max time kernel
142s
max time network
147s
platform
android-14_x64
resource
android-34-x64-arm64-20260325.1-en
resource tags

arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
submitted
16/08/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tiktok.apk
Size 20.8MB
Sample260816-var6bascmd
SHA256 0fa3360a6a00ec8d3c988f4f81be8e79674bb8cf58c9350237062eb60f54bf4a
MD5 e7fefa4fb1638159e8fdc3d96d766909
SHA1 b5ee0505e6d5dd47fb5b1e5ce1e67268208a1273
SHA512 44eac68d0ec35a192d59775928bbae7a372d9d6e0c4cf2002526ffdb611f84c39e9ad72276c1ac8b6df3f8874e2d80182ad3d6d2200bfc837d4b4a3c0550bbc2
SSDEEP 393216:I8LfifaTzVI9XUSoDqQxgXWff/RA/XMxTy/R0fExFH:I8TTz+iSiNcWn/RuXMxTyCfop
TLSH
T11727339BF706559AC9F6573748726A7125478CA2CF87C7C36810733CA87B5E40F8AA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker defense_evasion discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.flmao.zmpelbh/[email protected]	4369	com.flmao.zmpelbh

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.flmao.zmpelbh

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO

com.flmao.zmpelbh
1⤵
- Loads dropped Dex/Jar
- Requests allowing to install additional applications from unknown sources.
PID:4369

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

classes.dex

Path /data/data/com.flmao.zmpelbh/app_dex/classes.dex
Size 1.4MB
SHA256 695b38e0ab6a84a22fbf51572951daf0f238ddda3ec14d1db1eb61864d33bff0
MD5 11135fe2377ba69c2da4fc01a5937b7a
SHA1 59227a34cf72407cea8d91b1286419a9d6a1a907
SHA512 cf07107805e843eab250aaac3be1d0e4a7bd10a32442f0ab33bf7fff3f394f5d9408bf67626a7005768f6af3fd3db17f059cccf3a8643ea464a95b2fe6cce5a8
SSDEEP 24576:DQC3DW1LbcQL8pUVYLpUGTGTI6GWE1eEeQLjztqcL+u:9/QL8pLTGTIxWE1eE1nr
TLSH
T1B5654B21A603BFE3C66FE3F860552F71BF24AC64A9962F21070FD970AD4318E6675E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_install.apks

Path /data/data/com.flmao.zmpelbh/cache/apks_temp/temp_install.apks
Size 19.8MB
SHA256 9e9c83d805d95f3d96fb342b238165d91e32615abf364d49a2eeb623fb96bc94
MD5 2acbcf5767c757d02ffc5d331cd6e3a1
SHA1 d20b0c21a5705ca2d279294cf23ff86355313f28
SHA512 eef5303b6397ffc185a924b31b11c90bec196db40145d3058300c41a7e080181088718d8a3b590d0408d5a19ee0b7d504580726db716699a5704d5d9c8186d11
SSDEEP 393216:qOhKkqblILMnJvATrfxPq+o3wqQxGWVv30I/HA6i+h28u970ihoQ:VqbQ2vUPq+o3wqoGW1/ANS28u970SoQ
TLSH
T103272347F789AA5BD4F753B24A3947A140175E628F43CB872918333C58B7AC02E5AFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.4369.tmp

Path /data/data/com.flmao.zmpelbh/cache/oat_primary/x86_64/base.4369.tmp
Size 12KB
SHA256 e69dc156860410254da9b05ad0f3df16d797f16e58a79ebb40e827c7c0adec4e
MD5 e5a16b0b78fd5508b3e56696e3fe5224
SHA1 1e2a143a1bccb405d22ef40b1f99ce5737e74f7e
SHA512 1d0f4ad04d8399b506732a18262a17c94a0c881e39995411c4d0acad95a5c664f77bf5431c4fef7678b8a443a9ee0e130f8a5810525a68483e810fe41c91ea67
SSDEEP 96:2kWEBv4iku24E510wR9YbX1TEF+mlTfJJB9TZfbETgzJ16y:2klWikH4Epo1GfvTZfbicJ5
TLSH
T10542C5236512A1F0C0D3BCF58ACE53D8EF7B09F006052E288972A73FA854719DF62B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.apk

Path /data/data/com.flmao.zmpelbh/cache/temp_extract/base.apk
Size 4.4MB
SHA256 34565b3e1f5b977c5ed95ee99d2c469f72634455e41c2b7747146d69e31f2f84
MD5 d5cf38e16c52f57e5180bc753414d538
SHA1 5c17b7beda388162d36e53176799c3ecb07cdc0a
SHA512 ecf1cff220387c40c2aafc83c0100457d95f4f0f6e96611a92fc6ced9e8fda89b2ffbfbdce5b9204fcd90c77aa6e9025bf9bd4c670518a21e4ab2df238d52d12
SSDEEP 98304:v3mgLCrD9OyzQTEFbrHRPqJgR2zN3mta1p1dRQaw5Y2EAiGde:v7ytFfxPq+Rq3wa1p1jQakY2EAte
TLSH
T1D726DF47F349AA6BD4F753B2493947A541175E628F43CB876908323C08B7AC42F5AFCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/com.flmao.zmpelbh/files/profileInstalled
Size 24B
SHA256 e4d4fff15db12553a92c82dc3eae21b3083cbcff9e33c262b76aba07dd6f67cd
MD5 3a4673b3b07f91a8a29fe6166761e9dc
SHA1 9cb1b051cfa7287df0f1b9d9e23744ff7614b630
SHA512 2990a1f13a232276abd809bbe03e70c85f71a86d5114c9cd16a2b7b186f692a15a9b6413edf7270fb80c0ddfd23425a15d6826b2da4d24a1b4d9ef79ddc41e8d
MD5 SHA1 SHA512

Submit Download

[email protected]

Path /data/data/com.flmao.zmpelbh/oat/x86_64/[email protected]
Size 29KB
SHA256 c1fc256d7dac3d05f59c8777be6efe2e514186256ba1ef57ff76e90c92debf4d
MD5 3c05ee9b33b0efbad917bbeda8352425
SHA1 8924089946bc020e0d7ab16c9f7ddffc40b3a525
SHA512 f07f445cdf33b025a073a0c76528f286dee348b9405d1098788acd3c02303b4a8993478bed0a6a11cafd90dd931f67eb0f66dc7cf31ccedbf5dbfe7df5d3482f
SSDEEP 384:wKaE4JFcTXROKwCTwPU5+NKXZxnrz2DNgnQifkj8oiKK57O0VxnKh3zZ:ETJCpBZxBJ8j8oiKK5KYYd
TLSH
T1AAD24CCF6598923ED0D2C3BE9E3D543E918647F3E607B2B9D6118C8081D3B90D7B9662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads