Analysis
- max time kernel
126s - max time network
153s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
- submitted
21/08/2026, 12:18
General
- Target bd80bd3c3d0e4bf6b5b4a825650d01f5.apk
- Size 37KB
- Sample260821-pgwt7abd46
- SHA256 8e48cca62de5d69f29da5326827e2b0635630c99536e42399b62ff69755a1c4c
Score
7/10
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
- Looks up external IP address via web service 1 TTPs 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
- GoLang User-Agent 3 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes
-
com.tw.jar11⤵
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
.71ab5517f71866279d0d87d37f2ae320
.71ab5517f71866279d0d87d37f2ae320
.71ab5517f71866279d0d87d37f2ae320.jar
.px.tmp
.ver
sdk.jar.cur.prof
sdk.jar
.h.jar
.h.jar.cur.prof
.71ab5517f71866279d0d87d37f2ae320.jar
sdk.jar
.h.jar