918183bccb47ffec5289c6b465d4eaf6d633e283eef98773b9f5b0ec3448c84a

Resubmissions

25/08/2026, 16:13

260825-tpjl2sssex6

25/08/2026, 16:13

260825-tn61yssset7

Analysis

max time kernel
6s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
25/08/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NextGen_mParivahan.apk
Size 3.1MB
Sample260825-tn61yssset
SHA256 918183bccb47ffec5289c6b465d4eaf6d633e283eef98773b9f5b0ec3448c84a
MD5 a15c27c89bac75a25a86afc40e36740f
SHA1 148e67bb4066b9160fff18b16e5e3ed44596aba7
SHA512 75236293a55a072578252150e29f17311fbdcb5b56bfb7765f9cef9f9acb8db12f7e319d3d12ce6cbb3aab361f37d1e73d498a66154b435689bc8f5b51834f4d
SSDEEP 98304:EAmzjRP9FSt4p8Hqn0zaZhRtBH1FXIXO9n:EDFFSt4ec6aHB2En
TLSH
T189E53306E9E5043AE892FBBC00A853D718AE127C946311DE15BDAC4FDD97743BBACB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/wpeess.ayggxco/app_jat/olge.bin	4333	wpeess.ayggxco
/data/user/0/wpeess.ayggxco/app_jat/olge.bin	4359	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/wpeess.ayggxco/app_jat/olge.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/wpeess.ayggxco/app_jat/oat/x86/olge.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/wpeess.ayggxco/app_jat/olge.bin	4333	wpeess.ayggxco

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	wpeess.ayggxco

wpeess.ayggxco
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4333
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/wpeess.ayggxco/app_jat/olge.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/wpeess.ayggxco/app_jat/oat/x86/olge.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4359

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

olge.bin

Path /data/data/wpeess.ayggxco/app_jat/olge.bin
Size 43KB
SHA256 10c5141ee40b20d8318ea8c5c4287c6e7dadc29434f751cc8a5e9ccb6f1771ed
MD5 ec80c9731170aae802207a66b85b2370
SHA1 5c2d55225ef4eef9fa79f13ae059e31f3727a3e1
SHA512 ebdc1bbab77c5b04f8bee14b74ce7822e0bc2fb835446ca1262b2da5e3d41f4ae7bb4b57a6d60a4e2f98884fa2dc4b80096f440c6627b0a79ad9171b179437f0
SSDEEP 768:v/fMLXxsvWsvOda0BMxo2U+LopGh503jM+Y8+U+hnfH:v/07xxsGdNMlbQMRRfH
TLSH
T1A0132822E7171865EE7C7F3F55EB0B00A731E3D0976793971940A93E2EEABC44D82285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download