678347b552723aa7eb8dbfbcc125821f6fe6ab6cb16cf30ba40bc2a6f2688e24

Resubmissions

05/09/2026, 07:05

260905-hwsmrayfqc6

19/08/2026, 17:40

260819-v8z9kszamd

13/07/2025, 09:15

250713-k793aayzbz6

Sharing

Copy URL Twitter E-mail

General

Target
app-release.apk
Size 5.4MB
Sample260905-hwsmrayfqc
SHA256 678347b552723aa7eb8dbfbcc125821f6fe6ab6cb16cf30ba40bc2a6f2688e24
MD5 628d41021c9d594b28b2c4c368e3010e
SHA1 234dc3f0bb3573230bff833f54f83f008b30e7e5
SHA512 38f512136fb9d50af64e22d7c7790aba40e8381fe13dfbba5260e2e7f2caff74f0f6fee209a5f7d78fd2c5f2a0722877c4c5c7fc3a7b8ad6aa19960bc99ef26b
SSDEEP 98304:/BnQQQa/gZN8M2cytd1sO3TnpxYZEqYPtVhtF3yhK/54G8IQBI+8o/Kry93y:JoaM6M9ytd1JjbYZEqYPtbtFya8IQBIz
TLSH
T16D46F1CAFBD86D2FC8770072C96A56F156974D128A839F836944361C79B72D80F8DBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  app-release.apk
- Size 5.4MB
- SHA256 678347b552723aa7eb8dbfbcc125821f6fe6ab6cb16cf30ba40bc2a6f2688e24
- MD5 628d41021c9d594b28b2c4c368e3010e
- SHA1 234dc3f0bb3573230bff833f54f83f008b30e7e5
- SHA512 38f512136fb9d50af64e22d7c7790aba40e8381fe13dfbba5260e2e7f2caff74f0f6fee209a5f7d78fd2c5f2a0722877c4c5c7fc3a7b8ad6aa19960bc99ef26b
- SSDEEP 98304:/BnQQQa/gZN8M2cytd1sO3TnpxYZEqYPtVhtF3yhK/54G8IQBI+8o/Kry93y:JoaM6M9ytd1JjbYZEqYPtbtFya8IQBIz
- TLSH
  T16D46F1CAFBD86D2FC8770072C96A56F156974D128A839F836944361C79B72D80F8DBC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence ransomware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Changes the wallpaper (common with ransomware activity)
  ransomware
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Makes use of the framework's foreground persistence service

Changes the wallpaper (common with ransomware activity)

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3