Analysis
- max time kernel
136s - max time network
151s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
03/09/2026, 10:15
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
VIDEO.apk
Resource
android-x86-arm-20260325-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
VIDEO.apk
Resource
android-x64-20260325-en
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
VIDEO.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target VIDEO.apk
- Size 1.4MB
- Sample260903-mac3dsvbkg
- SHA256 72ecf19512cb15286a410a2b6ccf6b9e5609a87febffdc7f08d9f6ba12a16b0e
- MD5 cb4548fe72f49789bc1f996b6089cbc3
- SHA1 2c460624d6065f0d9f4a664726af05c0024b2bfb
- SHA512 0feb5a334a578396c0d8e16c1b6d0b769566919a7c3ea470fc46496729a8456d6fef3839bdfa0289829c79b04c324aa7490406e84c326c251cdfea4b8009ae09
- SSDEEP 24576:RGS9Xh9W9i9U959A9F9m9W9+neL9HOt1uJE7ujlDedQ0sK9iOzD+Od57FY1FRLls:RGST0YiT6TQkUnGMmlD0SOzqOd57WlLq
- TLSH T15065236ABA8A7E90CC8C5135A59607A163297B604707C70FAC05CE3CBFC75A6067F6DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/mq0bt5.jv6ar0.gimh45ww7/files/app_data/payload.dex 4731 mq0bt5.jv6ar0.gimh45ww7 /data/user/0/mq0bt5.jv6ar0.gimh45ww7/files/app_data/payload.dex 4731 mq0bt5.jv6ar0.gimh45ww7 /data/user/0/mq0bt5.jv6ar0.gimh45ww7/files/app_data/payload.dex 4806 mq0bt5.jv6ar0.gimh45ww7:w /data/user/0/mq0bt5.jv6ar0.gimh45ww7/files/app_data/payload.dex 4806 mq0bt5.jv6ar0.gimh45ww7:w - Acquires the wake lock 2 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock mq0bt5.jv6ar0.gimh45ww7 Framework service call android.os.IPowerManager.acquireWakeLock mq0bt5.jv6ar0.gimh45ww7:w - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground mq0bt5.jv6ar0.gimh45ww7 - Schedules tasks to execute at a specified time 1 TTPs 2 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule mq0bt5.jv6ar0.gimh45ww7:w Framework service call android.app.job.IJobScheduler.schedule mq0bt5.jv6ar0.gimh45ww7
Processes
-
mq0bt5.jv6ar0.gimh45ww71⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Schedules tasks to execute at a specified time
PID:4731
-
mq0bt5.jv6ar0.gimh45ww7:w1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Schedules tasks to execute at a specified time
PID:4806
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/mq0bt5.jv6ar0.gimh45ww7/files/app_data/payload.dex
- Size 62KB
- SHA256 4f41b17ef38d995bb3a346e158cd9d64caa1e393d3faed0348b3aae43e359adb
- MD5 5f50194e7d1da035680b10f2e23b39ce
- SHA1 829779cfc666fb40576f0bedc83f8938bea5e640
- SHA512 10c722297abacea705ec1be572ccfc100eb9b8ef993f6300c8503b01e5dd49e7cd148e0e6e8889718af8b2361bb4ee02d75a8997cc0957ad0c8282fc90dfc60a
- SSDEEP 1536:FWsf2luur9A3EMbvs4yQv6URwq+vl/RcOeeKMmN0:sqeK3fbvs4XuVKM1
- TLSH T18D531892B3C1C909DE69C33D68E74301A3A6B151DA67D3132B94D3FEADC27C79AC2185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/mq0bt5.jv6ar0.gimh45ww7/files/app_data/payload.dex.hash
- Size 8B
- SHA256 2a5373149fe3f2b31df9feb94172d69f598e108fff08a61a3c903e4676412099
- MD5 58a40133734a5ea36599fa6107798f1f
- SHA1 400a0ad6cd8ec1ad0ef31da858fa25e07b270e00
- SHA512 2c75eb6d4172ea2254f99496b0f31067ed68d4df370ae8719f0a3b72df3175d5f9a19e70962900526ebbc92306013cec2d5da164ad69ff5bf17e7dce5511e84c
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Android/data/mq0bt5.jv6ar0.gimh45ww7/files/.lz_di (deleted)
- Size 221B
- SHA256 ba09ae55ec543133eab4136b3160430155b13ae42d4d4db41cda74aac3f03993
- MD5 ec772c023c12ad497b450871536bd5b6
- SHA1 8d31ad5e8d08074986b1c1a7692311e55c77e3c7
- SHA512 eba855771985249dcba785d93922a9f71021531a5fe5f7821b22d5d073972077dc6e3e94d30e4b9e835f97c0d7dde53ff93e5a3c6ada5adb07e7718e4a634131
- TLSH T111D02269C8F37582C048CA40BB0E4B3812EF0843218C280CD32203E8B23B28C80E03F2
- MD5 SHA1 SHA512 TLSH