Analysis

  • max time kernel
    136s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    03/09/2026, 10:15

General

  • Target
    VIDEO.apk
  • Size 1.4MB
  • Sample260903-mac3dsvbkg
  • SHA256 72ecf19512cb15286a410a2b6ccf6b9e5609a87febffdc7f08d9f6ba12a16b0e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 2 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • mq0bt5.jv6ar0.gimh45ww7
    1⤵
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Schedules tasks to execute at a specified time
    PID:4731
  • mq0bt5.jv6ar0.gimh45ww7:w
    1⤵
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Schedules tasks to execute at a specified time
    PID:4806

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        payload.dex

        • Path /data/data/mq0bt5.jv6ar0.gimh45ww7/files/app_data/payload.dex
        • Size 62KB
        • SHA256 4f41b17ef38d995bb3a346e158cd9d64caa1e393d3faed0348b3aae43e359adb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        payload.dex.hash

        • Path /data/data/mq0bt5.jv6ar0.gimh45ww7/files/app_data/payload.dex.hash
        • Size 8B
        • SHA256 2a5373149fe3f2b31df9feb94172d69f598e108fff08a61a3c903e4676412099
        • MD5 SHA1 SHA512

        .lz_di (deleted)

        • Path /storage/emulated/0/Android/data/mq0bt5.jv6ar0.gimh45ww7/files/.lz_di (deleted)
        • Size 221B
        • SHA256 ba09ae55ec543133eab4136b3160430155b13ae42d4d4db41cda74aac3f03993
        • MD5 SHA1 SHA512 TLSH