aa41c05f13986d2487a158415c086e6f17526cfb6fa2ce3ad47a0f2e214bf078

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
29s
max time network
65s
platform
android-14_x64
resource
android-34-x64-arm64-20260325.1-en
resource tags

arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
submitted
25/08/2026, 21:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload.apk
Size 4.0MB
Sample260825-1nwcsaba32
SHA256 aa41c05f13986d2487a158415c086e6f17526cfb6fa2ce3ad47a0f2e214bf078
MD5 b134f3f41e699c41c78929c4863c7526
SHA1 0588d57b0fe1d62c2e08d6e7b14b7a1aedf6a9f3
SHA512 6982de0de8e689f685b9c50ec6068f1afcc54f31095ed7b44f52504ec878fd4e499f0efc07eafec0f806f9c938382fa0a60416152a2a3b98c4d88602bab3da38
SSDEEP 49152:LOaogyQazKALmi4CPJVIe+hn1I8pKNMjAevDHMubEdFNdAh:LMNQazKALmi7PJVhBCEdFo
TLSH
T15416AE67A6119E61C46E5B3C44B60F55A738AED2FE430307604CB9E86FB35E067CA7C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker discovery execution impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.qiwiwallet293.cardid2878

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qiwiwallet293.cardid2878

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.qiwiwallet293.cardid2878

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.qiwiwallet293.cardid2878

com.qiwiwallet293.cardid2878
1⤵
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4353

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

base.4353.tmp

Path /data/data/com.qiwiwallet293.cardid2878/cache/oat_primary/x86_64/base.4353.tmp
Size 488KB
SHA256 eb05a4b034992918d2409090a36f3836e49af99f83cb1897d383b0ee1c291a6d
MD5 3d4a0b8ea1e35e4cb85346bc68a6e381
SHA1 90a0ecaae4e324d19255993345db64edcefcd682
SHA512 8799b74c174c1afa762427202b261c632e15eb766a70212250486471a3ca188dc1733d1ff9086582bf4251cc74be6e5279a929559770a21e135f0495fa1be337
SSDEEP 6144:QTkDYsd5lLvJ/J9hLB6VCv3LXHPXIXB6M76ig8xMXwK5y4I5CnzuQBB40BaZ19yq:HDYsd5HrSCvLYXUqSXjiH1DQX
TLSH
T1B5B48DBFA622C155C1EFBBF78A8745F9FA36401162532E049462673E6423F14AFB0F64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/com.qiwiwallet293.cardid2878/files/profileInstalled
Size 24B
SHA256 a663bf1d13784a447572e8addfd9623d371385d691b6b0263e4ed71704a0c5ff
MD5 02eb7938326f1c8d71530bba1f50dc28
SHA1 95619931ec79047240d64f5698450c7e417be94e
SHA512 595b677b8b061f0cdc5984946f8e0d66367956dc5bd575d664a3d22fe8ab239b448014f8c7f6cc9e3a96aeb9bcd9bd68f1165ff591d4741db9820186c60e1eb5
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.qiwiwallet293.cardid2878/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 1bee728b4e4eb6c21177d17d380a6503f93d61ddca72319661a20e55f7c78511
MD5 41f0ef9cdc30f65f734b948515fc2228
SHA1 48b22bc844f21196670dd40580a530377ece9809
SHA512 28e5cceef521ee8292e02c94f2bf6c3e357c58d008dbde12ae91c9d690e974e2d0570ea3b39c3cfac9cd36851494b56889f97e07f0c47de1aa16548def9dfbe7
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.qiwiwallet293.cardid2878/no_backup/androidx.work.workdb
Size 104KB
SHA256 250d7ca224b528e7e8a049c7c4ba11644cb1c36caaf241cfdeb9564ae890cee4
MD5 cb20be115d2c95f9d57e9a88c2618583
SHA1 51cb70f297be277ceac8240fa6af0e2ed1153980
SHA512 dc9725b2d877b3d64bff19ae2e264c23ca1b7d5a0291cd22f1a7c2e681d2b1413339468596740d254fd79bb7d87559b4d4258c879b6507f2574e0b661fcdb018
SSDEEP 384:Kn1Z1X1OivtidjnfWzzb83zS9eD86u0ED:K1LlOxfWz03zS9eD86yD
TLSH
T14AA385CE0F071A54E5EB79F0ADE20BE0242F916ED36BE3A22150507A9DE3511CB258F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.qiwiwallet293.cardid2878/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 03d8a101c1ed5ef9b7f296d07723d759ffd0aad57304b1cf0496d62ba3004816
MD5 cb041d3fdfc0e4d0ae8f560d6d6664a2
SHA1 3e2c1ea468fcaecb9e9e8fe8b72662bf934271c8
SHA512 ae5a1210e2de0d587bbb65a453d459fee510eafdf4de16b6bf7f400f29fb68c63e188ec5c6b7a4d17d60f0331a7a2717284900cf23fc92bc0908949022038cd9
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.qiwiwallet293.cardid2878/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.qiwiwallet293.cardid2878/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 e9265d9934a3eaf50d98d611800b006f9761e742cbfac67bceb94288f0f5bd87
MD5 9e63e4a4dd522db041b5606bbb86181f
SHA1 617d2c39eacd833bb19cf24255911ddd3e41316a
SHA512 23163edd57ab97af8a4e24ca71a64e09bcc8fba7710c203332565bd9c921893e7ca5f080c7759b408f192eb1b5a737ab51d6c46f91d76b9887de9c4a1d15b74c
SSDEEP 6:KGcfLnyWg9FZdvtAlOERX4PBX4ogLugMBX4suuK+/ne8s5/l1EZsTOw2:KTf2WqzdIRmBEyPbP/ne8k/MZWOw2
TLSH
T10672C2ACE38A0E62E219B73A49D5C7884E30973D4777CB0F256826217C42789A4D0E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.qiwiwallet293.cardid2878/no_backup/androidx.work.workdb-wal
Size 406KB
SHA256 6479643595bcd4b0ac11c098d283ce20d95c2165cd7d88b826e894103e6f3753
MD5 aaa504bbd6f0a3159aa0128ce0867bf9
SHA1 ec7105ca56b4731071a062091c6fd3914db685f7
SHA512 aca5baf76f3f6263fc15872d6fe50c59695ff82f30ce9eed3080cd7fb156f1f1118885abd7e2636b07c6ba437e9938529ac44cb88c68ac1414e82df990a80af1
SSDEEP 6144:3LpunpdzEVFZ5XX7lXFjXzjvLjvCnPULMTLM2LlR:6
TLSH
T1549414CD2B034DA9FAEE7EF83BE642D9101E5AF5876F55412198B7258DE310082B0DBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.qiwiwallet293.cardid2878/primary.prof
Size 4KB
SHA256 1bfd9f9dfca79d8a49603aae4c17b1c707234c484784891ce9a0fd8875eda77f
MD5 adab2f45373ac36ea9b8744da2fd7ca0
SHA1 92699b02491545fea83bd6e424d902f9c9e3bc50
SHA512 24e5d7c80d7d3917a0322666212332f55c213ad0219df2ae49200815ef21de9b579bb256d405fa9f58a40c08b0a65d9a59db0207836ff9f51500ddba1e16c523
SSDEEP 96:8GN7uvZ7CPn/pVkzTWbQgOC9wc26cL43GKJOpKhj+x:8GNCx7C/nWEQgOC9wc2b2Gp0hu
TLSH
T1C4917F01162FB558CA25103D5600E2636924F8F7EABEFBD2774C6758983F902E3483C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads