Analysis
- max time kernel
148s - max time network
154s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system - submitted
07/09/2026, 12:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
1win-agent.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1win-agent.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
1win-agent.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target 1win-agent.apk
- Size 9.0MB
- Sample260907-pterfavwbs
- SHA256 d5ad0e81226591eed3db70488553b6c76bf67bc338cb1982c496622e71f3eeb4
- MD5 b89c8292987007bd07bdfcaa1cdaaea5
- SHA1 f0693448ee9f661c89c97dcdb304eaffc8d64d4d
- SHA512 50c88b2a57d79d43f6cd2c9b942ebbd7fa095730305bf373667d41d4e957c4f445da9a777d2076f61eec3fdacf5a0b838be3ebaf4801300bda4c66baf0ed320c
- SSDEEP 196608:tGKwa0WDNc0TgDI7Jqk79a19GOqKuoIuKYv:wKw2jTgDIoD/GO7rIuV
- TLSH T103962341FA98ED1FC433C03309A61776824A9E56CA06D7976518739C7CFBED84E86BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone win.sunpay.lol - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver win.sunpay.lol - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal win.sunpay.lol - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo win.sunpay.lol - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo win.sunpay.lol
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/win.sunpay.lol/cache/debug-logs/app.log
- Size 310B
- SHA256 e4382088282fb98a6923cecf2c5dca2f9f9e02c68e1da00d6e6295d53c50791a
- MD5 7e6477984cf93c40f343d37ac12202e3
- SHA1 4d329fec34e87b4b8fcdd70de7671e9764058cba
- SHA512 dca086947036371825a329856c75d0887dcaca16869933fa2dcd63b0a48dbd5883a460f50f74ab188c2faeabe49a589f010637cbe97fef638c042ffd93c8cc9b
- TLSH T1A0E0A71EA3A69AB3DA975011BC3841ED74503D7C77916764D62BD2440E4D70D02D1911
- MD5 SHA1 SHA512 TLSH
- Path /data/data/win.sunpay.lol/files/profileInstalled
- Size 24B
- SHA256 00cccbdc7a73b0f732a8207e877e33e317bcf6c966f2a35d22b15ac624d199bd
- MD5 4089bc06aee6773ef193d0364274e850
- SHA1 29927fb2a606b1de649b19b3020b0b815c1885be
- SHA512 f05dc797736f5de8600b13dfa81a174fd6d87c9cf6c4e4b19dd0856810a4bf110c91f9bac8d71c81f214c9cdc208f487588406d1fbd490eea95abd44f334c0c5
- MD5 SHA1 SHA512
- Path /data/data/win.sunpay.lol/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- TLSH T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
- MD5 SHA1 SHA512 TLSH
- Path /data/data/win.sunpay.lol/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 fd9010259d392dfc96da233838836ae74327ba433f79993dce74bbc97cdae7f2
- MD5 6380586da4212ae1d82f48edf2b2a903
- SHA1 8e88fd2f96405c85a4be897a0fcb069d1c53c4ba
- SHA512 5c7db45b0b13902d4e926428b119060eaabdd724191b36091ac4a42ab437102a107b435971b6569caa9bb515b49cc9894234947eaa5a287746ae711333d35996
- MD5 SHA1 SHA512
- Path /data/data/win.sunpay.lol/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/win.sunpay.lol/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 c10a96c28c9b3632b68e57843901aabe8d99d61ad7b29ecb9ded52d56caa0ac5
- MD5 33ee38687011d3a3d2631b2d347f1b9e
- SHA1 1e9050b52b8dcf975d35171765ac2d7e0c585ade
- SHA512 9e59750f1e811aef178f126e7cb756bc0189837a77699727fdd33b83f29b7524d20150ee9466641cb3a72eee0afb9f4a64f5b86f0046b2e0df460459a925c5c8
- SSDEEP 6:KktUwbHJo9FZdrlOERX4PBX4ogLugMBX4suuK+/f/jzv4tl15m/+Ow2:KkjbUzdTRmBEyPbP/njzvoxm/+Ow2
- TLSH T1B872C2D4938315D2E738977A4885C3C59D5C6A0D8357D74B6A5216746CA2788A491D0C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/win.sunpay.lol/no_backup/androidx.work.workdb-wal
- Size 116KB
- SHA256 9a168f7ae8ac6577abb46d39ed16a858cd04e39ca5aa2be712849c33b5e4d8c8
- MD5 b445ec189a07fed045ad18917ddbedde
- SHA1 47fe9753be04aba7e26c76493b16a1d69c6aff98
- SHA512 04f8ab4f1e216cd7cce85e7d9bf6c2af4901fb87f00e5004a79c90397cb8e83d90b0c8757b8915f46ae165fbf2513a2f572b0ed63255e486060a2eebe1919616
- SSDEEP 96:xmrmT6+etidjnZRWzzb8/KeKcK+zS0ddKz+ZD86u0ExV:xmrDtidjnfWzzb83zS0de+ZD86u0ED
- TLSH T1D4C322CD0F9A2640C19994B0EDD00FE1F93E812E9793F3D1669101B5ADE2921DE69CFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/win.sunpay.lol/no_backup/androidx.work.workdb-wal
- Size 124KB
- SHA256 fc132818d83a37013f7db9bfb92563c148caeca30d68c979d0ce4af702c48d80
- MD5 5a85ef05b0136618762c56215a2c4ddf
- SHA1 06e53610fed782d171ec5d694f5914683ad671e2
- SHA512 a15901c39e3a0182d39246c11d9bab99393a1e3bebec3cab9fae25399fe414fcf713d2f9c33517d52d82a8aebcaeaa6bd869f1231e2548a29323f1cd07cfcb39
- SSDEEP 3:xRXs9yczwzXtRKVjWvAZxRXsQxfFkc0XllgoqKXtRKVjWn:ec72VaAZlgc0p2Vq
- TLSH T15FC39BF317561C57E150577DED1F55D45D0DDD5440CE7D7555091FB12D612881174040
- MD5 SHA1 SHA512 SSDEEP TLSH