e5b96e80935ca83bbe895f6239eabca1337dc575a066bb6ae2b56faacd29ddaa

Analysis

max time kernel
61s
max time network
153s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
18/08/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5b96e80935ca83bbe895f6239eabca1337dc575a066bb6ae2b56faacd29ddaa.apk
Size 13.5MB
Sample260818-2tsphsan2t
SHA256 e5b96e80935ca83bbe895f6239eabca1337dc575a066bb6ae2b56faacd29ddaa
MD5 ab25bfce859ba1bb374eda63e1be92d3
SHA1 065e0ef6aab548cdc764aadd4c41ad815fda78f8
SHA512 eaac24f849d25477b95d346dd5063d9dd3f550700ac87f29ff6ca6ff80be192b2ffe4cf501af0e991764f92b9c93bb4e4aa48a4ef78b93af1852a7fff1a82938
SSDEEP 393216:P9XnFH5macX7X52NWdXJq2TNhMfw6zpMrfum7E:F1ZqgY5b2qE
TLSH
T1D1E6238BFB98C51FD9731632C917413372A31E142492ABBA2315F32819B7D425F96FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker defense_evasion discovery execution impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pagnotto28.sellsourcecode.supercleaner

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.pagnotto28.sellsourcecode.supercleaner

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.pagnotto28.sellsourcecode.supercleaner

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.pagnotto28.sellsourcecode.supercleaner

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.pagnotto28.sellsourcecode.supercleaner
Framework service call	android.app.job.IJobScheduler.schedule	com.pagnotto28.sellsourcecode.supercleaner:BackgroundService

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pagnotto28.sellsourcecode.supercleaner

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pagnotto28.sellsourcecode.supercleaner

com.pagnotto28.sellsourcecode.supercleaner
1⤵
- Acquires the wake lock
- Checks the application is allowed to request package installs through the package installer
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5056

com.pagnotto28.sellsourcecode.supercleaner:BackgroundService
1⤵
- Schedules tasks to execute at a specified time
PID:5134

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

dbytes.db

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/databases/dbytes.db
Size 20KB
SHA256 c6cae5cdf9a8fa20f75a0909a91c5522db1948b9a3e85b08df31e3d3dfefb456
MD5 c7e353cd3ea58dd0fac47a4e847c2187
SHA1 f8670a14e55661a4be90b222f623f08df6428023
SHA512 a96de057b6a80b8ee92bdaf2cf67c72db0b851e45fa419110ee6f1be13e7be116387fdbd4b881aeb5ea108e520fafc9d00dfab538a4b12c3aa7900db00c1cf45
SSDEEP 12:TLyKEVwTUDz/RmBEyPbAVOwUVODdDno9ycodDnoF:TLy9VmUDwGSE0aDnoDKDnoF
TLSH
T105928BC7A7003A10D22AA179C84297D18DE3E7190B1D83F398A120646C93A16A466D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytes.db-journal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/databases/dbytes.db-journal
Size 12KB
SHA256 6f403f24221a4ee7b5a2a5fd78d65872ec274058a29e8c58f0d960026445e704
MD5 931c906cb004d9d7e0ff4809ee9859a7
SHA1 6a9c30b2f7ad1bf7d7265eb214a06f110dd9a093
SHA512 bf08099857dcee03ddb36b3bae2e057a4b36b9f86cff2bf9dbc6e78482008eb37674b5ae768e3db668c8866b0e992bc8ca23fdd408173697610391855b6c7330
SSDEEP 6:7+/lSEZ2sI2Rg9bNFlq4yl1Wl09d3RRztLu6fNZ74LoDp7t8ERX4PBX4ogLugMBw:7+tSEZ2z2RqLm3wTUDz/RmBEyPbk
TLSH
T14542C056AF022431C139D5B1C8925360ECF037499165CB6325F32858FC63A4490B9D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytes.db-journal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/databases/dbytes.db-journal
Size 512B
SHA256 db5da7a0d4de68afba00c6b69b8b644f915d112c47edfbdb23f6527876d119ca
MD5 9ccf7deed70692954f9b0a332ba0b55b
SHA1 ecb7b8851ba3a8320ee1319905649b2bb329edf9
SHA512 a50df577801de2630999fd7b356bd40a9faf01e1ac9d427db6bc3508344dcd6f0bb0ffe72e63fe64eb0fab94ccf9cc8b7df21af8441cb265a4167fa0bd41a7dd
MD5 SHA1 SHA512

Submit Download

dbytes.db-journal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/databases/dbytes.db-journal
Size 8KB
SHA256 466425deab3649999c91506e7ad3c0522ee4320c8c34f7e518dabe1c659f250a
MD5 0302fe0964ca864f2406f289d3416531
SHA1 19e4addac5d640f0b13b6a2c31c65888f1535aad
SHA512 50b1e3b634d7c7068ccc0e7db501307401844ba755336fac969579cc46736cb653d46c300ddeb1cbf3e89e8d77fe0e059ee9097e770db909dc93bb5193866167
SSDEEP 6:7+/l9/8uHn1FWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKkU:7+tdXGqLiuWdwRmBEyPbu
TLSH
T13D02228AA3840823CC1956F794E883800D00E719C1A7CB071560089D7C034CCE4A4D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytes.db-journal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/databases/dbytes.db-journal
Size 8KB
SHA256 a887ce147717a4c5dc703745709aaa9004ead2a9bb4fa7f76043d7373b16d2ff
MD5 1f1639c393a876e1be5e637e8002cac4
SHA1 bddfa3adf466a8abd436b0cef26ada51d59cf2c6
SHA512 53711f5cd65e5b820d0ed2680a75de36b8ebc4a1b80d2ee24b8f654bc4fac3bdc6570f7e5c3e2bdd1f987f0e3f77fed1a16bbf48c65c30f23170ec3da7f3a773
SSDEEP 6:7+/l9SNOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKply//6Nn:7+tLqLJdTRmBEyPbVX6N
TLSH
T16E02229963400813C09957FBA8C883A02E10A716C33BCB87156008E83C036CCE892D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 cf0d5c31e831b1fca6cb759b0676eeff48cf6a7d4cb989700b250a08ff891286
MD5 0a93cabd0e5c4fe03ebdd47adf31640c
SHA1 fc0d85f10d086b1c6354c4362d031841f2453be0
SHA512 0ec9bfee3be2ab7b5eb5e696c4c70219611d74c65d4197cc5d6b8d761633c7d40f70f38e30f85825bb1476c784e17e6c669bdc8878c603e78943006e9def5b08
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 477ac87bfc087230a2814cd62c7448368d6b2b0d213f6118dc34d642bc24be66
MD5 3c60fc676a404c09f8d60c03d2df05e3
SHA1 5e391a7414316c8a4ed468f44ed3e64b85b1e629
SHA512 22696a272a8764640fac973c28c6e84a9e527bdd285a2c72c1e39e3ac80b79aa572879522403b6d194717b8d11248a2c561e5a00a1da6be266eda33f9e72c6ff
SSDEEP 6:Kig5sFoM4JWy9FZdrlOERX4PBX4ogLugMBX4suuK+/o7s6YaYlAM9Ow2:KigOCPJTzdTRmBEyPbP/oaBOw2
TLSH
T17272C24593806A52C62E537EE0D5C3850D78B63A8312C70B27681A55AC037C85060E8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 517dd687f5958d5a1b2c43dd4f7cae1f44e9ad29734b3d0b017e7642c450665c
MD5 35d9367b4e0a8a337e105db5a62bf478
SHA1 94f8c068c2c697ac7913e297a798d883ffbf0afa
SHA512 f0d6eaf95bd27d18ada4f1b8b32ac4f4745da112ba260ecd64869aed1d011722c2466211e4b2d7a1444c55b3933ba989ab6a1e89af85488c4f27fe4c9358d49d
SSDEEP 96:5nkZ6+hdjnHtDRMpf8UzS5+TD8q0ExPQGlwFIi0t67prP52h41qfR731d:6VdjnHt9Mpf8UzS5+TD8q0E5J7L
TLSH
T161B32F8E0F192540C4A998F4E5900FB1793E553FD3A3E3E56A920175AEC2960DE29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads