e5b96e80935ca83bbe895f6239eabca1337dc575a066bb6ae2b56faacd29ddaa

Analysis

max time kernel
18s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
18/08/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5b96e80935ca83bbe895f6239eabca1337dc575a066bb6ae2b56faacd29ddaa.apk
Size 13.5MB
Sample260818-2tsphsan2t
SHA256 e5b96e80935ca83bbe895f6239eabca1337dc575a066bb6ae2b56faacd29ddaa
MD5 ab25bfce859ba1bb374eda63e1be92d3
SHA1 065e0ef6aab548cdc764aadd4c41ad815fda78f8
SHA512 eaac24f849d25477b95d346dd5063d9dd3f550700ac87f29ff6ca6ff80be192b2ffe4cf501af0e991764f92b9c93bb4e4aa48a4ef78b93af1852a7fff1a82938
SSDEEP 393216:P9XnFH5macX7X52NWdXJq2TNhMfw6zpMrfum7E:F1ZqgY5b2qE
TLSH
T1D1E6238BFB98C51FD9731632C917413372A31E142492ABBA2315F32819B7D425F96FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker defense_evasion discovery execution impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.pagnotto28.sellsourcecode.supercleaner

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.pagnotto28.sellsourcecode.supercleaner

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.pagnotto28.sellsourcecode.supercleaner
Framework service call	android.app.job.IJobScheduler.schedule	com.pagnotto28.sellsourcecode.supercleaner:BackgroundService

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pagnotto28.sellsourcecode.supercleaner

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pagnotto28.sellsourcecode.supercleaner

com.pagnotto28.sellsourcecode.supercleaner
1⤵
- Checks the application is allowed to request package installs through the package installer
- Makes use of the framework's foreground persistence service
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4761

com.pagnotto28.sellsourcecode.supercleaner:BackgroundService
1⤵
- Schedules tasks to execute at a specified time
PID:4901

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

dbytes.db

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/databases/dbytes.db
Size 20KB
SHA256 08b82ba685fac79817276da8e64230cd630f44f3a33042746dc8b44189d299de
MD5 3b492089f64cbcba9f0207dbc71d2aa9
SHA1 c27b9a5bf9e966a9aa4195bd0364ed5b65839813
SHA512 8f2faaa92235211b2bcb13fdc522e08bf422931211a27fd3ecc73c2c1aac4a55fca76735aab731a246707f153a7617a6c2b34b39ce5a85c32dc5af6481d266e3
SSDEEP 12:TLyK2wTUDz/RmBEyPbAVOwUVODdDno9ybOSdDnoF:TLy7mUDwGSE0aDnoVEDnoF
TLSH
T11292C0C7A7003E10D63EA179C84297D1DDE3E7190B1E83F358E120602DD3B16A475D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytes.db-journal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/databases/dbytes.db-journal
Size 12KB
SHA256 94bf890df1aad5e38ae2382cf8f52c91565c28532709926e1fa031f2b4e055b0
MD5 7f499103c9b08ef43bffc329964afe3f
SHA1 4a39399b36f4a74228c8512d8aa35feceb94a646
SHA512 2d344c5f3404d9a47cb2be107b4c57b78e5ee05a6963033633477f45b25765d820160b3cd548bb34b20e092f7a275a2e9c031c66e4d0487aac2e1be42f0437da
SSDEEP 6:7+/lC0iP/aU//vg9bNFlq4yl1Ol09d3RRztLu6fNZ74LoDp7t8ERX4PBX4ogLugw:7+tC0inrnqLmvwTUDz/RmBEyPbB
TLSH
T15542C0859F012521C17DD171C8B24350ACF173584569C76775E52814AC4398450BBE30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytes.db-journal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/databases/dbytes.db-journal
Size 512B
SHA256 3d690f4355e05cbc0fb8e4d1130c75d989869f4ec7ad4feca5feff2b32530480
MD5 643a1ece53da25b34fbe3d141cb96028
SHA1 f16db32904e7881e6b9ccef60270660be8ca1631
SHA512 57c130cb5e3e9893e9d7e16fcf4f408618461cd114f39b7afdb6f9a3ca3219d1ca96de9b2c65232af5f204fbae39bbef5b3c38fe00207ae08757c1338112eec2
MD5 SHA1 SHA512

Submit Download

dbytes.db-journal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/databases/dbytes.db-journal
Size 8KB
SHA256 983b2487b0e8cf04924798136441b0ef368925c713d3a8b7ef5c3d51bbca2617
MD5 99d534057003933a1081f5f99cd7cc33
SHA1 72ecb1d00856bb56941217e022b8bbdf92dddde0
SHA512 da6c33e8f3e4b219edc1a2d7d271d15537cdb0bc6d0b50e9ab67b1a0c4f1ee594eb65470758fefa5798507c9b4c3b55918a00aeea70120205a40436e018452b0
SSDEEP 6:7+/l9NSn1VRg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKI:7+tkqLiuWdYRmBEyPbT
TLSH
T1A002C08CB3801D13CA2F1F77BCD493404D20F7289175CB2726B018A43D4B6CCE8A4D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytes.db-journal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/databases/dbytes.db-journal
Size 8KB
SHA256 f71cffc9412700214ee4ec4f98c8fad7dfdf40d34f2880cb8890eb0412712469
MD5 fe70de8b1da913816d15aff472f52585
SHA1 e350f9a67733975592b494954c4800fa473b1178
SHA512 7bb674635c975ccd3956bb51aebc4d86195767ac5c526bb01bf9c96cefca5ccdcd76b055edc8650b2c3fbbdd9b5ecc35a5d05175c3e315bb6546c81ef0597ad8
SSDEEP 6:7+/l9uq+Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKB/mM:7+tgnqLJdeWRmBEyPba1
TLSH
T1A20222C863800803C02E1B77A0C887801E24E7289363CB07169108943C06ACCE890D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 463cf3eb21f50879510f98b9538eef1166f6ecf1fc55d0c2de4a874da5d05b51
MD5 2e428cb15c983bd138f717a5fd5fb9d5
SHA1 520c9cc17d3105dcbff26f712016573f9ecd5a12
SHA512 8c511b18b7e4efd6344d454ef8b1be35f10300a7da5bc7ea40e68e4f830d3e1ba97c042dac22989a18688d55c6cd65d7db971a64cf2833a093246d16703f6613
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 53de5e0323c2b9d235970d035b8dc31eea37c2b287faf0e97e82320e74b7cc94
MD5 15f8bcbd9d1f6fa6018d50653faf9936
SHA1 7f955d314bb728b62ae8672b08bc8db56ca130cb
SHA512 35c8a833b18952059165d2257e55216c3a4e7eb92db0585a46d09d83dd6e4aa5616f9e02800c9dc8dd602374b179e6293b0dcda5daccab8a31b15fc7279edb70
SSDEEP 6:KOkx7iZ+9FZde/kPlOERX4PBX4ogLugMBX4suuK+/LdJ4kth1C4kF41Ow2:KLx7iCzdeWRmBEyPbP/D2gOw2
TLSH
T111722B6CD3400A63F30E073398E5C3DC1D60562C5332CB0F126108652DD27CCBC50D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.pagnotto28.sellsourcecode.supercleaner/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 7292fa4c2123b0661e7a35dfc0629ea0818076c32417a32c9bf7448ced6feb83
MD5 f9e225cff70c440432a551dd263362c8
SHA1 9480a78d26e398bc0d0422175f8a7524a25fd20a
SHA512 78d8b90ae2b978fc2bb856b0d1904aa156dd19f73fc1014a4bd1978b6a3335c67919f3a1954ac41be7c79f7fb7868d8c32dbe9a75fd012b862ba4b0bdd3695bc
SSDEEP 96:DkZ6+hdjnHtDRMpf8UzS5+TD8q0ExPnsud:QVdjnHt9Mpf8UzS5+TD8q0E5L
TLSH
T164B3334E0F192501C69998F0E9E00FF1797E412EC7B3E3ED65924075AED2921DE29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads