b738bcc9d4f7d96cc2b0b64046faa60c2c5605ffbd38e413528f519f80e2247a

Analysis

max time kernel
6s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
08/09/2026, 18:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MovistarRed5G.apk
Size 7.3MB
Sample260908-wxyr2swtcs
SHA256 b738bcc9d4f7d96cc2b0b64046faa60c2c5605ffbd38e413528f519f80e2247a
MD5 ac1636a23b528e1531d7adceaa5b0cca
SHA1 03ee299e7d5cc6d183cace6c81b21198e0173f75
SHA512 02a27c7e3e39a87b5806a0d41701f151343cea278624212680bd476d02cebccc49b8b2f4bb7c8d0f900eb4bec3c0d279e135207fcbabc4db8a6a404916cd9678
SSDEEP 196608:BYraa40DAQktw/KoBPM8JGhIVWdvapOMcGC:mrl3DXkm/VBE82QWxapFcL
TLSH
T1B1762396B784592EC87790324DBE037122A34D418DA3AB47B454770C69B7BC84FEEBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
31	api.ipify.org
32	api.ipify.org

Checks the presence of a debugger
defense_evasion

com.sec.android.app.update.jlxlf31
1⤵
PID:4714

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.sec.android.app.update.jlxlf31/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 f6a4ecda1ceab94f9b5d5c9b30d31430ebc8ed2d3d091839c7f1a0f75284f0cd
MD5 87e8855997777cf607621412af8ea9b9
SHA1 60702a3a2df74de004ccc0a6c27d2c3237efa8a7
SHA512 4d0accd5f127f2a83adba2be42f2c93aba05e3d3994af9d0eec323d67a7afd085ff0b2e1efccb90d16fe9ea5b731fa503c9c3e652951fdf5630bbc6f9f7ffd48
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.sec.android.app.update.jlxlf31/primary.prof
Size 1KB
SHA256 0e03b64379156bb51a9bf386f84522c59eca5d26dae283f5cdbc193a3e67289c
MD5 bf9b6af9e09e4d8e9d0ebe7cbb765f0d
SHA1 2a4fb710a56ab1e2ebe7f5c5b9ad8307d9d37f85
SHA512 75a5182f57c0230c71b118d088b24641391ae7a1937ea8abd7561c749a3245dec3d566992084953fb76d49b14854543ae60a9e229281084a28304fe3e331d456
TLSH
T11C21E70A19FA07DC38902F5A0C7D7275FAAFF270D735E5660A16F48B68280B15F158A2
MD5 SHA1 SHA512 TLSH