52133279daecaa74400b36cde12368885ecf64e31305e770fc28e0601afdc357

Resubmissions

24/08/2026, 05:06

260824-frrtjsytas8

24/08/2026, 04:31

260824-e5mlbacp4x6

Sharing

Copy URL Twitter E-mail

General

Target
Pixel1.zip
Size 623.5MB
Sample260824-frrtjsytas
SHA256 52133279daecaa74400b36cde12368885ecf64e31305e770fc28e0601afdc357
MD5 fefbeb5997256d80173f9f947c2932c9
SHA1 e2207ac0641d4ec565d71666bf0e25b6d946579e
SHA512 8f700bef378a9f68e7d86be6e2d0dd7758de99677aecfd608a68023a34153f1020715b2b99e0bd2f137cfac11468a7f06a6e8c26facd47933917a487dce42fb5
SSDEEP 12582912:nTM59kF78wQKwvxL/IanuVqOvuXXnN9NNOlvciNm/Md1C12B6cSF94G9QML0RBpi:UkFv0xrIanuLuX3NUx/NXd1/ST46QFBs
TLSH
T1E969334BF064945BD59D40734FB568C2EB8E80D8D3E4DD1ABA8B73D80AE7DCA63B1901
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  base.apk
- Size 8.9MB
- SHA256 2110bf8acb1fde87249ed78289f713777e56278a29e26453dccf533d7f4919a7
- MD5 a699e1747289148420d694905732922b
- SHA1 c34e8e7760608e10c4f3dd3378978331047fa21e
- SHA512 c169c8999753bd3385314ee83b8112494bc47f577a152352fa2f2966f79cb5b5188310351f83005c0c366847e09f8d7bbfcc397d24503f0b3839104698c83a1d
- SSDEEP 98304:qlwWkQeksj2A2oI9hzE7YMeZ8ehNeLoajf6luaQdRS40E25rvarRr:dWkQekTA2oMhQ0LZ8e4oajf6G4M
- TLSH
  T136968C02F6875E6BD1AE56381C72871277319D4867835B1B216CFAB8BF732C45F8A1C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3
- Target
  split_config.arm64_v8a.apk
- Size 1.4MB
- SHA256 5cd2ea2b91dd293269a1c68aa46c90be48e7c1ad45c2cd339fba3200f9fb4508
- MD5 ace55c4c682c9ba0980db5735160dc4a
- SHA1 b1827972bb51d72e1e6481634c1c2bc6b45682a2
- SHA512 fba0e5c741f14f5cd091d45fbac42ae06548842008289b36c740dcd85e610217c1f4613e9e5aa14a0430420b79fb4c5a9befec6cd2dd3f3172c76ee4fffb1830
- SSDEEP 12288:8pumE6pXP6k2cFgCbWrFzqRSPrPOXr5vtNU+OM0m0yxkJ4DlGdEfS4INWa6888BB:8pumE6pXPkeg6WrF2RI7OFgAU2lLWU3M
- TLSH
  T114653A59D90D9D31DAC9F0FD8D9E0162B527381C17A1C1992D23F22EF6835E47A32FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5 behavioral6
- Target
  split_config.en.apk
- Size 60KB
- SHA256 65f9b037a188fc80b3d89bc13a4cd5cc9e460fe54cacb799166b28801d26c861
- MD5 8166ebe0fdc5bee1d3b35b5787ab7829
- SHA1 7bc6375449f7bdc4f379a8ee5d2cdf6a99e18eb9
- SHA512 8c35a39da00c5de14e1c0640cc1afa183d5632a6f901e7de016094ede02e836611977e686f56e395a7621ae7821123b674a9407a8c2a6bfb9ccfb11f476cecc9
- SSDEEP 1536:tSqNja2rCPD8vGFSP1oU9mvTBHBK4IniIkpmwNDWiFy1qIshnGrxaKw52IMZHw+L:tSqNja2rCPD8vGFSP1oU9mvTBHBK4Inl
- TLSH
  T1CD53C31BAB509A1ECDB700326D5B9085563ABE17CE405503E978760C32B3BE4AF5B3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8 behavioral9
- Target
  split_config.xxhdpi.apk
- Size 63KB
- SHA256 33f87fd75b6fac1716389f2aef8e159ae05e2422cd5c55c375f8d1283710cac3
- MD5 477ed6523fb9bd7961b761bc62608f8a
- SHA1 eaac36d1dc4a1b3fd49149f55729b67ef1418cfd
- SHA512 3ee09f8542144f27a0cd0bb134d159e36156f77ac38733432faa73a000350e417fb21f3dd0cca2c73758373d179436ea39bb8fe87e33f6558ab60ed6cc640045
- SSDEEP 768:M/pLcDJ2pC1nl8KGxwleJDyskOo/2EdkGrpo4lCKaOrBJBJKnBMKF+KhfN4szL:+pLc4DxwleJ7o/2Ezooh9LJIM1YV4sn
- TLSH
  T181539DF3F3245D3AEE6B0236826CD43A6D395FA497A277072504BA3978B33854D483D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12
- Target
  base.apk
- Size 75.5MB
- SHA256 8d379ffd91556ff45eae439ea74d096224d4c9077b42cdde893d5e5bedd1a4eb
- MD5 f893eeb05f6dcb995fa5694b2289eb87
- SHA1 350927bef19f5e6b35f10653a212832e0a4f62e6
- SHA512 9d6e6174845a63082182e369f0dd2a39dbebe11647331459bd38ccb86669a5fd1f0b06c78a505ff7cf3fed82649a56730a413b4a4d088792f31d0be4e5e3648b
- SSDEEP 786432:tOgAyaNOTCuBZQt7Ye4nEEQHpDqC4kWHfNY5yML8p:tOgiNsLnC4kW/em
- TLSH
  T1E808AD97E6628C33D57E6B3658B693007B31AD4577434B872448B2BCBE732C1AF492C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence evasion
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Queries information about active data network
  discovery
- Checks the presence of a debugger
  defense_evasion
behavioral13 behavioral14 behavioral15
- Target
  split_config.arm64_v8a.apk
- Size 31.7MB
- SHA256 f9250c14ee52c3edeff0d428120e1ed2c271b782c4619c578c558efffb3a459f
- MD5 a0006d42d75a4de400d2a8fee512c660
- SHA1 e03d265e596bd2342b5a7a5f924349d45a669a24
- SHA512 27350bf49c156cb762bbab6b9f424638d22ff08c746ad6df62a0fe1609c575c4d4ccbc75a1427f645df5f941641b920b829f023cf570f71e01a7243fabce29fd
- SSDEEP 786432:V8hV5+kW7DgDc/moCJcEBl+6VOno/crsmfRA:Tk
- TLSH
  T17E77AE49F50EE922EDCAF0BC8D4E0693F1137C5456A5D0983826C20DFEC7BE54A65BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17 behavioral18
- Target
  split_config.en.apk
- Size 800KB
- SHA256 4bca1b376f29fc7f4deac1253cfb129720f6c901e67189daec87f9c95e0a594c
- MD5 214c3e73edce6f2f56fa96ccc61b4e24
- SHA1 d8fd555ac745f8a96bfd077ea4f7d63d811c3a92
- SHA512 06a461d3150033bd15e75029c6309b9524dd39b98a2829d2bc44343a0a7fd9b1c02c886dcaf3e2212897aeff4dde583233232ace6e24ab77e704306d964983cf
- SSDEEP 384:NM+ecD6+YUzMl5VndFj+tL1rtsh1oiOP1zmvybDZhLSw7zLSoz/ggmLSTmLStLvT:e+TDpYz5notsh1oiOP1zmv8N7Lvi6CY
- TLSH
  T15005C905AB429B1FCD7B40382C879254152ABD57DE464607EAB0321C39BF6F15FEA2F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20 behavioral21
- Target
  split_config.xxhdpi.apk
- Size 14.8MB
- SHA256 52e3354c19986ff65a9202d81443f71069caaf9cb7f73e8ce2f0933557eca0d4
- MD5 c1ab872f8dd687b66d5f4288e1fee1da
- SHA1 68cde5dc793efe0de6b49c237b56d74da4ecd4de
- SHA512 874264108073882a9bb296c58d137e7ed14409fd9900d7cd3cd695e398aa7a94cf0da70fa7853cf9c2d6035557dff9a5bbf7f995f6fc339e67300cfe762dbb5f
- SSDEEP 393216:l+82AgccrTVQMW/0vMkp5dOkIs932XNJJXqdE24GGe4CudO:88aQZGMkp/Ojs94J1Gt4XO
- TLSH
  T139F62367C3B9F80EED72D63442B417A798D40D80A918EB38DA46F5199EF3D81BA50FC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23 behavioral24
- Target
  base.apk
- Size 128.7MB
- SHA256 0c12e77ea83f3ad85caa3681eaca474278f430aed42ebd4d27bd6b610656cb1e
- MD5 a4eecd26ff04c6cc6ad5be0225cb7bd8
- SHA1 397fd0fb5a2375934e655e37bdfbb6fd08f4e0a7
- SHA512 0104945fa63cf5e91e0283dfea59c8dc5d1f08b05d619a933b56f345c62fa2e30a7b2b16f5d9905a9f1238eb69f6f26192e4c59ea438a624b169561ebb6d93a2
- SSDEEP 3145728:LEnkov73k0Nn2/M7C7jK55koW4M8Dcr3RSNdKT0L1ZCHYQ6Xv4Kmc9RLHohBVaxU:9kFYM7C7jK55koW4M8Dcr3RSNdKT0L1G
- TLSH
  T12E58D063AB214E31C9FF533618F587247B305E94A70397831458F92DBCB7AD49BA42CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

banker discovery execution impact persistence evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Queries information about active data network
  discovery
behavioral25 behavioral26 behavioral27
- Target
  split_config.arm64_v8a.apk
- Size 58.8MB
- SHA256 de2a0102f8f3a466de128103945fae895066fc411d20db9a21adedd21fd69cc5
- MD5 0a871cc12ee60b78bd75499f36a2e07e
- SHA1 b68fe3cc679d1b6c6258c654c4bba77f72f95048
- SHA512 10649d0eb1b507016d4dec58bb04de71b2ff6f8a0d0c9cb575752f0b5cba8fcbaa014ac7c25438f3b069669afac87f650708cb83f29235c07744f2c5fba1f0eb
- SSDEEP 786432:0oBvsAFv2jxvWbqPU61AER4j8GWqELZb2xR50Xv/UG/kJ8ntChWM:Zh29vWbpMFntChWM
- TLSH
  T144D7AE19FA0CA927EDC5F0BC9E4602E2B52379455224C19A3833C60DFDC7BD58B667B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29 behavioral30
- Target
  split_config.xxhdpi.apk
- Size 2.6MB
- SHA256 590a62b2ff84caff0bb67936ea070154e9a85cbf1e4df84f315b15de380339db
- MD5 a101531a85cb8c734311ba1c069fc59a
- SHA1 7c41aa7b9b2d1f7ab663c42b453c7bd09942ff9a
- SHA512 c55455a3f1a18504a1c4497e7af4c6aeab71ab9a5d1350b65802e064662604006ec1c0eef05fb46dc34c264e15e6b230f06cd99f6096959f34c432361761e578
- SSDEEP 49152:H3NBK5e7o1KjhR1N6wRhG1oJd3RRY2b+gt:H3G5ooaoyYolRvbLt
- TLSH
  T159C5F1A3E37EF41DE973C63993B8029B88D00D40A956E729960AF16D9EF7D80E544FC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Obfuscated Files or Information

T1406

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks if the Android device is rooted.

Loads dropped Dex/Jar

Queries information about running processes on the device

Acquires the wake lock

Queries information about active data network

Checks the presence of a debugger

Loads dropped Dex/Jar

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Acquires the wake lock

Queries information about active data network

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32