854774a198db490a1ae9f06d5da5fe6a1f683bf3d7186e56776516f982d41ad3

Resubmissions

05/09/2026, 10:09

260905-l6z2cssbpd10

04/09/2026, 23:16

260904-29gbesbl2110

04/09/2026, 23:15

260904-28l6aayydx10

Analysis

max time kernel
125s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
05/09/2026, 10:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wifi.apk
Size 2.9MB
Sample260905-l6z2cssbpd
SHA256 854774a198db490a1ae9f06d5da5fe6a1f683bf3d7186e56776516f982d41ad3
MD5 79ba96848428337e685e10b06ccc1c89
SHA1 51b31827c1d961ced142a3c5f3efa2b389f9c5ad
SHA512 ed0e788b735de1508eb387a20bff312094bb9b935c5b2d278391c01edf27550816515e60054b687f14ce04e7ccb7c46f0169a93df571abd623d4ee0b150f1f43
SSDEEP 49152:rlaYuMuLPV74she6ZMKqvoWY9KqUoHLUfgP8csv5oJewBktwFcBVOhOUfFW:r0YhiqshtJqQWY9GEUoP8zv5f0kuFczJ
TLSH
T18AD5338F15B14C4A94A719F7A1B6F2480D6D6BE1740C6342A32C6107B9D2F31AF6FC9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4738	org.xmlpush.v3

Checks Android system properties for emulator presence. 1 TTPs 3 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	org.xmlpush.v3
Accessed system property	key: ro.product.name	org.xmlpush.v3
Accessed system property	key: ro.product.device	org.xmlpush.v3

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery defense_evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	org.xmlpush.v3

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	org.xmlpush.v3

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

org.xmlpush.v3
1⤵
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Requests cell location
- Acquires the wake lock
PID:4738

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e648569b

Path /data/user/0/org.xmlpush.v3/cache/e648569b
Size 148KB
SHA256 d5b50bb7b0bed3964b51c2a3a0361ecfa74af38bc3dd626fee40780e1dd0ac45
MD5 ba76e556409aa7bf4bcb3df464c583dc
SHA1 ad0738ddf836fbbc18684889e3ed52130500fb50
SHA512 be1df1baab15847b692281664da466e9d1afbfc6a0da9cb079351e483e45685d2f0133a369eb2455c573c869866903ea3fff1bd8a7ff19a38d36678d64217151
SSDEEP 3072:s1VqlS0Iq1rV9Qj8PtBHYx58qeZGL/glmxt+:s1Ug0R1rV08jY08L/k2t+
TLSH
T149E35C1CFB7EB529DAC9A5FD6E0801C967AC705BA7A851409334C28BCF0C5D1B9CD6B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16a88065edf8ab1c0df1a

Path /data/user/0/org.xmlpush.v3/files/16a88065edf8ab1c0df1a
Size 2KB
SHA256 b97f0ee705f70524500e3d014e32f51945423881d48360c0873e34868fc4bae7
MD5 bc45c3382c083646c773c441e7cda74a
SHA1 97be85c9270523021e4a23e617fc5e12e3f687f9
SHA512 5363446e68cae69e7bca1bb433c82ef33e86bcb784e73416c767593247c2e54c0db7d52c58f5fe9524668bdaf3c8cf07e65f565bd0df8934ddaf1cd88deecfd9
TLSH
T185414C028296995EEF131BC3D9EF23F7A93E50846F56E3C7901A41D19F9518240D2B3B
MD5 SHA1 SHA512 TLSH

Submit Download

16a88065edf8ab1c0df1a

Path /data/user/0/org.xmlpush.v3/files/16a88065edf8ab1c0df1a
Size 2KB
SHA256 9e5b782b951cde424284a53042215e38cc38e1dac173de753bc5757dfc17b82e
MD5 9d47306932e02f671b56abf7d33e3602
SHA1 b904e70dd03b7a75ec9f365ff3370cd2bf3aaf33
SHA512 4eebfdd095ebd59d3f9852d20d38e1240691a022ed0632f815607b8b2ba3bfad1b0d80093c300bdb74cbaee89cc2c9c6a82df4b3a9e6aeb50635341c4cf48567
TLSH
T11F411A5B031CCAA129C2D3EB6F1114AE12B7D4F538146011EE22F166F2AE9DE6D82E40
MD5 SHA1 SHA512 TLSH

Submit Download

RANDSEED.001

Path /data/user/0/org.xmlpush.v3/files/RANDSEED.001
Size 880KB
SHA256 1ae4e00e38cd82c02cc53efd2d2fadb3132ee3967b4e882c68b90f0024e9a566
MD5 b9dee727e7e4bf8f836111b109c1630b
SHA1 930a9a63eb2b5fa5a84eabfcdd83c6f35e94c432
SHA512 09a1e522a4b85abe7bd9197d12e4b7561b958efe67a022f671c8bb332658077489fc590325316321e5d827ffbc0c89654d3ceed4f540cc8065e4c0d88d3406f1
SSDEEP 24576:3nI3zoojV/mbtJ7wgrsNqYtEunG1Yn2jHq7d:3csox/mX3KqY9G3zq5
TLSH
T1BE1533D6B0ABB574D34B28640ADA2847D5C932F3C134FC229737D967A3514F7268938E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RANDSEED.002

Path /data/user/0/org.xmlpush.v3/files/RANDSEED.002
Size 1.2MB
SHA256 8365469b93a5cea7c86f874121e42c710661142868bd5db92ce28e7cce7efda2
MD5 20bc6f90aba6d964d2812c2bec42ffd2
SHA1 5d2c75c820a41b63ef9716a7018829dda12f7857
SHA512 5a52ea5de746d0939818a9c34932bd919751d58b3d10b6c762e807e9a3bb4c3b603375f18888ac9da7657bb9f9efa79cb44c8452c74fa79b7836bc9748dd31af
SSDEEP 24576:ybgccDncjWepiM6QUWY22+XhmtzZgwYdz6nRFI/AMaGOja1WdFKHbW/:LDcjWepiQUi2+XwZglonRe/0GPIdsHq/
TLSH
T1EC553314498C0639BFF4FC8679E6BA9D497FE844682811046BAF69C74FF470E6318D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads