0fa3360a6a00ec8d3c988f4f81be8e79674bb8cf58c9350237062eb60f54bf4a

Resubmissions

16/08/2026, 17:57

260816-wjr3catxhz7

16/08/2026, 16:53

260816-vedhqaep2y7

16/08/2026, 16:47

260816-var6bascmd7

Analysis

user interaction
yes
max time kernel
107s
max time network
148s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
16/08/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tiktok.apk
Size 20.8MB
Sample260816-var6bascmd
SHA256 0fa3360a6a00ec8d3c988f4f81be8e79674bb8cf58c9350237062eb60f54bf4a
MD5 e7fefa4fb1638159e8fdc3d96d766909
SHA1 b5ee0505e6d5dd47fb5b1e5ce1e67268208a1273
SHA512 44eac68d0ec35a192d59775928bbae7a372d9d6e0c4cf2002526ffdb611f84c39e9ad72276c1ac8b6df3f8874e2d80182ad3d6d2200bfc837d4b4a3c0550bbc2
SSDEEP 393216:I8LfifaTzVI9XUSoDqQxgXWff/RA/XMxTy/R0fExFH:I8TTz+iSiNcWn/RuXMxTyCfop
TLSH
T11727339BF706559AC9F6573748726A7125478CA2CF87C7C36810733CA87B5E40F8AA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker defense_evasion discovery

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.flmao.zmpelbh

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.flmao.zmpelbh

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO

com.flmao.zmpelbh
1⤵
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
PID:3272

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

classes.dex

Path /data/data/com.flmao.zmpelbh/app_dex/classes.dex
Size 1.4MB
SHA256 695b38e0ab6a84a22fbf51572951daf0f238ddda3ec14d1db1eb61864d33bff0
MD5 11135fe2377ba69c2da4fc01a5937b7a
SHA1 59227a34cf72407cea8d91b1286419a9d6a1a907
SHA512 cf07107805e843eab250aaac3be1d0e4a7bd10a32442f0ab33bf7fff3f394f5d9408bf67626a7005768f6af3fd3db17f059cccf3a8643ea464a95b2fe6cce5a8
SSDEEP 24576:DQC3DW1LbcQL8pUVYLpUGTGTI6GWE1eEeQLjztqcL+u:9/QL8pLTGTIxWE1eE1nr
TLSH
T1B5654B21A603BFE3C66FE3F860552F71BF24AC64A9962F21070FD970AD4318E6675E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_install.apks

Path /data/data/com.flmao.zmpelbh/cache/apks_temp/temp_install.apks
Size 19.8MB
SHA256 9e9c83d805d95f3d96fb342b238165d91e32615abf364d49a2eeb623fb96bc94
MD5 2acbcf5767c757d02ffc5d331cd6e3a1
SHA1 d20b0c21a5705ca2d279294cf23ff86355313f28
SHA512 eef5303b6397ffc185a924b31b11c90bec196db40145d3058300c41a7e080181088718d8a3b590d0408d5a19ee0b7d504580726db716699a5704d5d9c8186d11
SSDEEP 393216:qOhKkqblILMnJvATrfxPq+o3wqQxGWVv30I/HA6i+h28u970ihoQ:VqbQ2vUPq+o3wqoGW1/ANS28u970SoQ
TLSH
T103272347F789AA5BD4F753B24A3947A140175E628F43CB872918333C58B7AC02E5AFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.3272.tmp

Path /data/data/com.flmao.zmpelbh/cache/oat_primary/x86_64/base.3272.tmp
Size 16KB
SHA256 f5791fe6899399b0ee23dfb53bc669ffe6bfdba22e56a0b4e8ff6aa2a6832d21
MD5 5dc043ef2c58277f70ed3700cd498f87
SHA1 95b06f5bb757f1f1b5e897011dd656aacbd4ae0f
SHA512 188f6eb09f5e697e1bda61cf70e6eaec108fbb7df7c31645856cc1655b991eaf9319d12615c4e6208cef303f44069d44456ed9cbc107938333643164df40f0ab
SSDEEP 96:jsgicISSa9Tz27FO0lRKn/QqAJCorZfStNUC1:glSRz27QhcrZfStNl
TLSH
T1F4724D0FA7123024C1D5E8F9CAE31CDAE92617A2034E1813ACB9177FE5B4B08D759A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.apk

Path /data/data/com.flmao.zmpelbh/cache/temp_extract/base.apk
Size 4.4MB
SHA256 34565b3e1f5b977c5ed95ee99d2c469f72634455e41c2b7747146d69e31f2f84
MD5 d5cf38e16c52f57e5180bc753414d538
SHA1 5c17b7beda388162d36e53176799c3ecb07cdc0a
SHA512 ecf1cff220387c40c2aafc83c0100457d95f4f0f6e96611a92fc6ced9e8fda89b2ffbfbdce5b9204fcd90c77aa6e9025bf9bd4c670518a21e4ab2df238d52d12
SSDEEP 98304:v3mgLCrD9OyzQTEFbrHRPqJgR2zN3mta1p1dRQaw5Y2EAiGde:v7ytFfxPq+Rq3wa1p1jQakY2EAte
TLSH
T1D726DF47F349AA6BD4F753B2493947A541175E628F43CB876908323C08B7AC42F5AFCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/com.flmao.zmpelbh/files/profileInstalled
Size 24B
SHA256 41e68ad6a575c1d6694c3c644519cdaf20915e1d0f78c4871a7cd1d413b18953
MD5 b194d3ff8b36481a6d63dced0110a68a
SHA1 c29c460a70bd86583b6dda0fd1442abefc7c12b7
SHA512 0594d9d197003db7a3485b7e7a15b377f24281999de447d389c7008ed9e6dc938eadbde5f1cef27427a3fbdc6e61282100e9836df5ab0e3105d4766a05e99985
MD5 SHA1 SHA512

Submit Download

[email protected]

Path /data/data/com.flmao.zmpelbh/oat/x86_64/[email protected]
Size 29KB
SHA256 c1fc256d7dac3d05f59c8777be6efe2e514186256ba1ef57ff76e90c92debf4d
MD5 3c05ee9b33b0efbad917bbeda8352425
SHA1 8924089946bc020e0d7ab16c9f7ddffc40b3a525
SHA512 f07f445cdf33b025a073a0c76528f286dee348b9405d1098788acd3c02303b4a8993478bed0a6a11cafd90dd931f67eb0f66dc7cf31ccedbf5dbfe7df5d3482f
SSDEEP 384:wKaE4JFcTXROKwCTwPU5+NKXZxnrz2DNgnQifkj8oiKK57O0VxnKh3zZ:ETJCpBZxBJ8j8oiKK5KYYd
TLSH
T1AAD24CCF6598923ED0D2C3BE9E3D543E918647F3E607B2B9D6118C8081D3B90D7B9662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads