b0f69bdc7ea0cf62171d9875a1b11948cbec9d8921caa64fbb30918dd1f91796

Analysis

max time kernel
6s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
31/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MOVISTAR-RED-5G.apk
Size 3.8MB
Sample260831-wpthcszybz
SHA256 b0f69bdc7ea0cf62171d9875a1b11948cbec9d8921caa64fbb30918dd1f91796
MD5 5c68133b8c052b7fdaff31fa9244a969
SHA1 c5d3db5455796d284b0e387c350e28460e56fd14
SHA512 f244925dbf90c62ffd6e2a6ef60d7bab79c6ef788290c93a1e01cd8c882bad1873cd9efc74719a2762f0e17d85ecd346f41374268e0ed1745282e373267acb51
SSDEEP 98304:Xcos9FReH2hUHTux2x2NUqIN3eDxrxpAisOSqou:18ReaUzux2MKqIorXSc
TLSH
T1C306338B37C58D71C42712FA6402B12A712309C6D258EF1B262FD79D8D6AAC5111FFEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/tdywrm.yjkhvza/app_wnw/entg.bin	4340	tdywrm.yjkhvza
/data/user/0/tdywrm.yjkhvza/app_wnw/entg.bin	4365	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/tdywrm.yjkhvza/app_wnw/entg.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/tdywrm.yjkhvza/app_wnw/oat/x86/entg.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/tdywrm.yjkhvza/app_wnw/entg.bin	4340	tdywrm.yjkhvza

Checks the presence of a debugger
defense_evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	tdywrm.yjkhvza

tdywrm.yjkhvza
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4340
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/tdywrm.yjkhvza/app_wnw/entg.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/tdywrm.yjkhvza/app_wnw/oat/x86/entg.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4365

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

entg.bin

Path /data/data/tdywrm.yjkhvza/app_wnw/entg.bin
Size 48KB
SHA256 f22ffd640676522c562ea4772cd400628896ae9d5721aad8bd1ce36ca0af2441
MD5 4423148849a1a49490baea9f72e6dd15
SHA1 c53fd657b7db758afab94fa6544e88b9ab2b975f
SHA512 cc14500a8da7ef8bc5738ec073f52f1abf3eba3a12f4887a86e2e076d45ef2b41cbf8f04b1fe864fe57703912ef1536949570d750ead912049417f8af51fca90
SSDEEP 768:oiyH/xUg9ivq09sWPas8hiG0ZtAd3ql361oboeiBYJlnxl6pkvtzQd0+U+NaeWED:hyf+vq09nys6iBQE+nUlSpRb
TLSH
T141234913E7621816E4BE4B3F91FB03115733E3926373C387A541A47D6CEA3E5AA85386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download