Analysis
- max time kernel
65s - max time network
152s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system - submitted
21/08/2026, 12:18
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
bd80bd3c3d0e4bf6b5b4a825650d01f5.apk
Resource
android-x86-arm-20260325-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
bd80bd3c3d0e4bf6b5b4a825650d01f5.apk
Resource
android-x64-20260325-en
9 signatures
150 seconds
General
- Target bd80bd3c3d0e4bf6b5b4a825650d01f5.apk
- Size 37KB
- Sample260821-pgwt7abd46
- SHA256 8e48cca62de5d69f29da5326827e2b0635630c99536e42399b62ff69755a1c4c
- MD5 6c2e34b30da42085240ede53ab6107d4
- SHA1 f99e858aa42547adfa5efb1f78b8ae5a4eb5279f
- SHA512 bb22650ceb6ffd255bffbf39fb7cf1ea6ca93b4fd0ecb31068e33697a466cff125cc7997051816eca54df24de03f8ac21661bf3d9f0f4f97c86c2e8fe67ddbc8
- SSDEEP 768:znMqUSPqlHCOCRMfgXh9ALWcUlPKetsYQpSLrXO:zMBSPqlHpgRCLWRpVW
- TLSH T1D203CF99DF79052AFEFF22300166A76067301A70B072931F764B95771A4A225ABC23E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 8 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.tw.jar1/files/.mm/.h.jar 4347 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tw.jar1/files/.mm/.h.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tw.jar1/files/.mm/oat/x86/.h.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.tw.jar1/files/.mm/.h.jar 4319 com.tw.jar1 /data/user/0/com.tw.jar1/files/.mm/.d/sdk.jar 4381 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tw.jar1/files/.mm/.d/sdk.jar --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/com.tw.jar1/files/.mm/.d/oat/x86/sdk.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.tw.jar1/files/.mm/.d/sdk.jar 4319 com.tw.jar1 /data/user/0/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320.jar 4319 com.tw.jar1 /data/user/0/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320.jar 4501 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320.jar --output-vdex-fd=84 --oat-fd=85 --oat-location=/data/user/0/com.tw.jar1/files/.a/.io/oat/x86/.71ab5517f71866279d0d87d37f2ae320.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320.jar 4319 com.tw.jar1 /data/user/0/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320.jar 4319 com.tw.jar1 - Looks up external IP address via web service 1 TTPs 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 181 ipinfo.io 27 ipinfo.io 28 ipinfo.io 86 ipinfo.io 87 ipinfo.io 171 checkip.amazonaws.com 172 checkip.amazonaws.com 180 ipinfo.io - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.tw.jar1 - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.tw.jar1 - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.tw.jar1 - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.tw.jar1 - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.tw.jar1 - GoLang User-Agent 6 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 254 Go-http-client/1.1 HTTP User-Agent header 275 Go-http-client/1.1 HTTP User-Agent header 35 Go-http-client/1.1 HTTP User-Agent header 174 Go-http-client/1.1 HTTP User-Agent header 185 Go-http-client/1.1 HTTP User-Agent header 252 Go-http-client/1.1
Processes
-
com.tw.jar11⤵
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4319 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tw.jar1/files/.mm/.h.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tw.jar1/files/.mm/oat/x86/.h.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4347
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tw.jar1/files/.mm/.d/sdk.jar --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/com.tw.jar1/files/.mm/.d/oat/x86/sdk.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4381
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320.jar --output-vdex-fd=84 --oat-fd=85 --oat-location=/data/user/0/com.tw.jar1/files/.a/.io/oat/x86/.71ab5517f71866279d0d87d37f2ae320.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4501
-
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320
- Size 25KB
- SHA256 906734ebb9a274c5c83a22a4475e27354857d7b5b62a4ab6bb5d8d365692e963
- MD5 71ab5517f71866279d0d87d37f2ae320
- SHA1 389e9359bbf41e044375a581ee431941b6708f0f
- SHA512 b57a7727e690f386674a5a48d438569fbf76e7b0f1b188543256f450b93a9499163ee71ebbf88d581c4a523894f97b98849ec8f1ead6a47d463492d22622b6c7
- SSDEEP 384:R6umjE3rzRthBBXsmm3sjhg+PyhME79VUElp80+TS2vlsuwB+WilwPt46O:MVE3rzDtszIGIigEf+W5AtlIt4v
- TLSH T144C2F17A381E4260D96D92A8F9C5DCDA46431895F66C4240D2B0055D9D1FFBE77A3CC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320
- Size 12KB
- SHA256 5efa946600929e350b2d683593d22b21787e641901b33a4dbe1abeb9fb2f2b2d
- MD5 afad96b8a98195764fc49e3f4ca61f8d
- SHA1 559b46d53a5247f061cd4556872e99b50c5f81c7
- SHA512 d98b594103ed418dfcfe4ab33344a1e80011ca961d9f4bba552eab90e025ad0c11a53b3f46c3e517c1c8155179652b69ac4ab69e7d5ea7761fe1a8f57870db48
- SSDEEP 192:RBEGEuPD3ijrsd3rgsp/3jRthBBXmzlIDS5xUPrRTj3xgetP2BQ5o2veI:R6umjE3rzRthBBXsmm3sjhg+PyhE
- TLSH T15842C07F34841039EC4A618CFDC5ECEA825A4495EB7802C8B261187C9E4BFA83A735C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320
- Size 25KB
- SHA256 afcd3818818d1768030da94c0947832e8cc93be7f2d19b7d2fbbdbdfcd13b38d
- MD5 9001f22b5997a09e57922c4190720aa0
- SHA1 acd9958a4d449aef1cbabb33e7e9bbda8605b31d
- SHA512 5ad803f67bf2b714e7e0c7e910b46e2f162edd129f80a17570d3a7dd3c4ffcc4fb1b991e666b48cdc92aed986b9c7d9e7df27546c0d7c984621601c1e52fba82
- SSDEEP 6:nS2Lilv6DE/jHrksgp90VtQ/EolvzxxdkhrmzbdJ+xCol8HNPgAt:nrdDv06/Bl1TaKuplu5T
- TLSH T1E6C2CD2D2FE9C39DEB3FD23C926214444CA4E97D9298E711158455851822D705FD8CA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.tw.jar1/files/.mm/.d/.px.tmp
- Size 57KB
- SHA256 2318cb7db721d2465acc94d1708b353529d984f5b1f97298eb56ec3b8f537aab
- MD5 7560557e72a59e89b68c2a51a957c107
- SHA1 bb46e10091017738360a2ea307328f580750b7f8
- SHA512 5270410eff1f8ec296c73c72a34ecdb6f27e4259de14f5ffb1ee965e097c634e839606d9707d67707a0c7f76c361187c780cc4491f42295bd02214f99a70fe02
- SSDEEP 1536:4c0OxzetrPegT3cFVdzY7rTt4tgzl5Qc9XdEAiX:qy6trPNT3cFVe+il5Q2XdETX
- TLSH T1B243017EFD84946A4093CBFC8EC192206B0DC8D90F951F74925FA01F1BA2A51DC2F2DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.tw.jar1/files/.mm/.d/.ver
- Size 4B
- SHA256 a0c26f389e99b61080679e5d80ded4076a6dd07fdb5acbb4b727e804a718f0f8
- MD5 b2c73269bf392067fdf6234381c802fe
- SHA1 b0af5df7e88230fe52712d3abbb55c8f4e0992df
- SHA512 7ea1ff8f4766f5d97c478fad9c6a351ba270226f62d1d0dbb1b81410ca4ced741f35c0fc5580d62f7d93c0c8cc0e39cb6a0542520ff36abf3beb7e8c1ee6f3fc
- MD5 SHA1 SHA512
- Path /data/data/com.tw.jar1/files/.mm/.d/oat/sdk.jar.cur.prof
- Size 243B
- SHA256 5f32cbe62a670c4916c527e21973c6d78d0dc1e4b12cf111fa04ec7e5c22a6e4
- MD5 457a464f62b33ce0e85446d6fbdad00e
- SHA1 dcdfd0c579cb62a633d6fa501d9523d384ecb5af
- SHA512 a73ea08d370a9df672beac47b8728d4d40cb2e485889c6620ff96edf5027487372737e1dc5342890fca9fdf8591cb74265f72163d343fe86bce03d756f7062ac
- TLSH T121D097E08D0D187076DB3113E2988B9B21CB844318B12BFA002C1E21136FA38E62F032
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.tw.jar1/files/.mm/.d/sdk.jar
- Size 57KB
- SHA256 79e01a591c81554b57e0baaf877ca0a1a1f86f39d38973faa1580089b675838d
- MD5 67dc78e544ebce16b85dc7c195dfbc58
- SHA1 51e0ecd21fd71f2682a90c1a19ca0ff30e93fc7d
- SHA512 5959e96c65921c0c8291c95f50700652f2eee185df23a8bda88a5ae58a3a0de688868e929fa4b477cfcda271fa22288badb6dbbed3bb0e37bc8cda198af199b1
- SSDEEP 1536:Qf2DIksSBP8veFdPgd+kT2kISX1TK9rkVj8:PDf8CBgd5hBFO9rQ4
- TLSH T10B4302E08FF68AAAF907753F787E4304EF50EFE36A4DA155A204C011FD8558BAB5806D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.tw.jar1/files/.mm/.h.jar
- Size 14KB
- SHA256 cf5c8c624967775230573a5a552e2e4e2b3653f2362e8c9b66a801e3b251f37c
- MD5 e9f3a0dab6949ce2cddab9e0aa80ae1a
- SHA1 e50ef2d636aa6c8cf65131013350dce56bae3cf9
- SHA512 49ab11c5a9f024ba3dede0a0676d647a60760feafda97ba173cf0ff482069b5fda391f15336f4efedf2b3febf5493a5a2127edaeb4749623464d5428980b8c97
- SSDEEP 384:Ms9DThMyc/Yavz9wr9n8llF0S4Z6zVJ17OgXU5N:M8DT0waLG6YSJ16gk5N
- TLSH T1D162C0F7AD4499A6CA41F2F0C8207CAF4DB47DE24ABA57C85878090A0B6D8107FD4E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.tw.jar1/files/.mm/oat/.h.jar.cur.prof
- Size 158B
- SHA256 ea8fbfdd1e5bf14ccd583da5a4c946e82a69a95bba256d1eb3cafc0f63e07578
- MD5 41a4f39ab0d3ce007151241c746d5322
- SHA1 002721b5a7c73bf351e713d893688b66fbee578e
- SHA512 5c6c5436eeb6dd3de4600d482f5c41ea20a475643b34258e3ff4cf03f78465b1178a40d5a25a988f9187992ba3c2be254583375f16f634d1dcc20a60d966fc54
- TLSH T168C08CC7BA486628E4A3EC25880543991AA9826CBF94674E146C0003A046EB45A48AE3
- MD5 SHA1 SHA512 TLSH
- Path /data/user/0/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320.jar
- Size 51KB
- SHA256 f841d46db15f1e68c5718668042bc9ed64d0fe600fbae32f1980624cbc0a3fa9
- MD5 181efe34ef683cbd741883d39088396b
- SHA1 95150e870f4b3a3925e2462e74f9f595f7e94e00
- SHA512 b9641f26c15bd6241f2e19f17e1a76366a12fa015358977c8c0651bdff56beedc40fc82c6615395545c965bcb90f47841e5521a6896ca8d4a0b16e4a54d9481d
- SSDEEP 768:c/9ji6q4ChlNOMCCLReadBI8NNIUlmQMGuch4IZYxunvq50xYe4J/vSva4/RstMk:Bhb1DcW81QMe4IZYxpeCi/gMk
- TLSH T1CD33E792A645C933E229DB3345A397D39233F201DF139B671204967EFDD22846F9B2C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.tw.jar1/files/.a/.io/.71ab5517f71866279d0d87d37f2ae320.jar
- Size 51KB
- SHA256 ae9f2394db2f954c30cf4f084b9ad32c34c0ff3bbcac63e83cff69bc28b08cbd
- MD5 ba3916bd9385af265e87a366e3933c23
- SHA1 a730b9a17f1e7d69480d2854ddb876bdbc2e85f1
- SHA512 f0e0c4565368cd870e3afe0d485ab2873b858e9b83617dbdba4e80681e789f52a212439625238d44fd1a0684d63dd718823c31c7c776367490d0c3bba1a87db4
- SSDEEP 768:c/9ji6q4ChlNOMyNq5lkCr09gRiczv3b4zWTCZnFW0xYe4J/vSva4/RstMk:Bhb1yNxQ09gRiID4zWTC7Ci/gMk
- TLSH T1CA33FA52B2C4C9B2F96CD33A55E383D2A331F704DB334F171644D6AAEED1AC55E86288
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.tw.jar1/files/.mm/.d/sdk.jar
- Size 129KB
- SHA256 eb3d45bb9f5b3c3f722ade4e44acaa6d58ebb1e1648f62c74b6ce9fb1564ddaf
- MD5 9f76c645e4e53234ffae1add75e0c21e
- SHA1 95652bf7ecbe438b33701d8037fb64059c821bf2
- SHA512 2f6b6abdbe8af8443017342d6c559bd1a28d24d07b7f246b1b0e047ac1f8c2f10e258a609a6d8c1b142ca35198c3d38cd1c64953ef14087b3499fbe1811be159
- SSDEEP 1536:llc/JmzNDZ/sK+npNXsxGMz1Pv1FC7r0U6BmLqdsEwa/8mAUG9QeYeYnzdkfnlBt:laJEKj2DEEw7hUGGeRYnGfnTN
- TLSH T17BD38245F645DF2AF51D463580E399D0D33890120A5383BB80D4BFB969EE6CCABBA7D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.tw.jar1/files/.mm/.d/sdk.jar
- Size 129KB
- SHA256 dfaad8174222b82fdc26e4041a8bb47fc55109533b14cd0938543272c3ca663d
- MD5 da43da504837304a9191f6fc005d1211
- SHA1 925195a8f98b5dfaf70811cf4485c29e292bcb57
- SHA512 23bfe53aea2e1e5ea71238049e0417de117b8cc6bfd7a0392fa32ad1addb1ddc7d399b1063873f36fabea77061ace3a4470065c4ddbff6305c74b8064d229f54
- SSDEEP 1536:llc/JmzNDZ/sK+npNXsxGMz1Pv6+7r0U65ggO5FZx8mAUG9QeYeYnzdkfnlBK8sA:laJEKjm6pRO/whUGGeRYnGfnTN
- TLSH T16CD3A245F644DF29F91D513890E3E9C0E334A5214A5383BB80E5BFA91AED2CDABB17D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.tw.jar1/files/.mm/.h.jar
- Size 27KB
- SHA256 d92a64adec6135724d75791a3799cf744039c298fb87b5b000e83b45d65e34b9
- MD5 ba109fa745f545497fccf8c1eb8a03c5
- SHA1 77f0bc245acef1b23fbbd5da0eb18c1bec46c343
- SHA512 232132f114426f8a6bb9985f8079ee8690e6a7d8f725c668b88a7a100d32a5bb92c27966e2c7e25cace6c992c7b29247a34f97a877f9ff5b820e6102f0604097
- SSDEEP 384:4Ml/3lIM6x/UsIrHudeVESOc+r+Yz+hk06K/jWSemBYetUe6WT29886:4M92x/UsYUOTABz4k06K/jymBYeeeFuy
- TLSH T1E4C22A82F3068A33E55DAF398963C7C01321F1213E4BAB434910D6BAFDDA2C96E5D5E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.tw.jar1/files/.mm/.h.jar
- Size 27KB
- SHA256 13aebea08ffca833c2a55e7230c26955c56fb61dc6bffbeebb40b131c92d316f
- MD5 41b8a88dcb68a633f5e985dbaee50b23
- SHA1 226cc97eba32b4f1febba76710b4a77ccc7dc80d
- SHA512 0184892897925a04adc98f1d2fb7229c2b278d1c59b3d096ea7e76f2d51c8349975b175296142640436c4a10839df946994156dca830ec68b11579f85179f588
- SSDEEP 768:4M92x/Usq8FrOmTDEVMK8p5GtlTppGR+vxVmBYeeeFuy:r9essBoWKpTppGR+vxVmceF9
- TLSH T115C23A83F303CDB2D86DEE3D5963C3C06320E5216D0B5B035954DAE6BEC92DA6E5A1D1
- MD5 SHA1 SHA512 SSDEEP TLSH