Analysis

  • max time kernel
    65s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260325-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
  • submitted
    21/08/2026, 12:18

General

  • Target
    bd80bd3c3d0e4bf6b5b4a825650d01f5.apk
  • Size 37KB
  • Sample260821-pgwt7abd46
  • SHA256 8e48cca62de5d69f29da5326827e2b0635630c99536e42399b62ff69755a1c4c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 8 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 TTPs 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs
  • GoLang User-Agent 6 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

Processes

  • com.tw.jar1
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4319
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tw.jar1/files/.mm/.h.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tw.jar1/files/.mm/oat/x86/.h.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4347
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tw.jar1/files/.mm/.d/sdk.jar --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/com.tw.jar1/files/.mm/.d/oat/x86/sdk.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4381
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320.jar --output-vdex-fd=84 --oat-fd=85 --oat-location=/data/user/0/com.tw.jar1/files/.a/.io/oat/x86/.71ab5517f71866279d0d87d37f2ae320.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4501

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .71ab5517f71866279d0d87d37f2ae320

        • Path /data/data/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320
        • Size 25KB
        • SHA256 906734ebb9a274c5c83a22a4475e27354857d7b5b62a4ab6bb5d8d365692e963
        • MD5 SHA1 SHA512 SSDEEP TLSH

        .71ab5517f71866279d0d87d37f2ae320

        • Path /data/data/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320
        • Size 12KB
        • SHA256 5efa946600929e350b2d683593d22b21787e641901b33a4dbe1abeb9fb2f2b2d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        .71ab5517f71866279d0d87d37f2ae320

        • Path /data/data/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320
        • Size 25KB
        • SHA256 afcd3818818d1768030da94c0947832e8cc93be7f2d19b7d2fbbdbdfcd13b38d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        .px.tmp

        • Path /data/data/com.tw.jar1/files/.mm/.d/.px.tmp
        • Size 57KB
        • SHA256 2318cb7db721d2465acc94d1708b353529d984f5b1f97298eb56ec3b8f537aab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        .ver

        • Path /data/data/com.tw.jar1/files/.mm/.d/.ver
        • Size 4B
        • SHA256 a0c26f389e99b61080679e5d80ded4076a6dd07fdb5acbb4b727e804a718f0f8
        • MD5 SHA1 SHA512

        sdk.jar.cur.prof

        • Path /data/data/com.tw.jar1/files/.mm/.d/oat/sdk.jar.cur.prof
        • Size 243B
        • SHA256 5f32cbe62a670c4916c527e21973c6d78d0dc1e4b12cf111fa04ec7e5c22a6e4
        • MD5 SHA1 SHA512 TLSH

        sdk.jar

        • Path /data/data/com.tw.jar1/files/.mm/.d/sdk.jar
        • Size 57KB
        • SHA256 79e01a591c81554b57e0baaf877ca0a1a1f86f39d38973faa1580089b675838d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        .h.jar

        • Path /data/data/com.tw.jar1/files/.mm/.h.jar
        • Size 14KB
        • SHA256 cf5c8c624967775230573a5a552e2e4e2b3653f2362e8c9b66a801e3b251f37c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        .h.jar.cur.prof

        • Path /data/data/com.tw.jar1/files/.mm/oat/.h.jar.cur.prof
        • Size 158B
        • SHA256 ea8fbfdd1e5bf14ccd583da5a4c946e82a69a95bba256d1eb3cafc0f63e07578
        • MD5 SHA1 SHA512 TLSH

        .71ab5517f71866279d0d87d37f2ae320.jar

        • Path /data/user/0/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320.jar
        • Size 51KB
        • SHA256 f841d46db15f1e68c5718668042bc9ed64d0fe600fbae32f1980624cbc0a3fa9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        .71ab5517f71866279d0d87d37f2ae320.jar

        • Path /data/user/0/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320.jar
        • Size 51KB
        • SHA256 ae9f2394db2f954c30cf4f084b9ad32c34c0ff3bbcac63e83cff69bc28b08cbd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sdk.jar

        • Path /data/user/0/com.tw.jar1/files/.mm/.d/sdk.jar
        • Size 129KB
        • SHA256 eb3d45bb9f5b3c3f722ade4e44acaa6d58ebb1e1648f62c74b6ce9fb1564ddaf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sdk.jar

        • Path /data/user/0/com.tw.jar1/files/.mm/.d/sdk.jar
        • Size 129KB
        • SHA256 dfaad8174222b82fdc26e4041a8bb47fc55109533b14cd0938543272c3ca663d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        .h.jar

        • Path /data/user/0/com.tw.jar1/files/.mm/.h.jar
        • Size 27KB
        • SHA256 d92a64adec6135724d75791a3799cf744039c298fb87b5b000e83b45d65e34b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        .h.jar

        • Path /data/user/0/com.tw.jar1/files/.mm/.h.jar
        • Size 27KB
        • SHA256 13aebea08ffca833c2a55e7230c26955c56fb61dc6bffbeebb40b131c92d316f
        • MD5 SHA1 SHA512 SSDEEP TLSH