Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260325-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
  • submitted
    10/09/2026, 06:15

General

  • Target
    1_b24a19fba4.apk
  • Size 16.5MB
  • Sample260910-gzyshassct
  • SHA256 b141cbaa1ee609ef7c7bb8368703a0e413dc1418804a6931a4025ff868046227
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 9 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.wndthksbj.szlxthnse
    1⤵
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4385
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wndthksbj.szlxthnse/app_dex/classes3.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.wndthksbj.szlxthnse/app_dex/oat/x86/classes3.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4413
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wndthksbj.szlxthnse/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.wndthksbj.szlxthnse/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4471
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wndthksbj.szlxthnse/app_dex/classes2.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.wndthksbj.szlxthnse/app_dex/oat/x86/classes2.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4495

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        classes.dex

        • Path /data/data/com.wndthksbj.szlxthnse/app_dex/classes.dex
        • Size 5.1MB
        • SHA256 b636598448085962f56061efbe31b88a24eda3c5b422fe55fa19bd21257db2c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        classes2.dex

        • Path /data/data/com.wndthksbj.szlxthnse/app_dex/classes2.dex
        • Size 5.0MB
        • SHA256 851ba2de5a8601540bcd3f0ea27b4a5c6fe790516b303210730b3513ff47c67e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        classes3.dex

        • Path /data/data/com.wndthksbj.szlxthnse/app_dex/classes3.dex
        • Size 2.1MB
        • SHA256 cbb52146a3d8640bd76d5e64b7a4c37f66ef6037cb2a49a311882c49c8db31c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        classes.dex

        • Path /data/data/com.wndthksbj.szlxthnse/cache/classes.dex
        • Size 2.0MB
        • SHA256 f0c16e83d7bd5b7c333b762c324342c1a6f4c8a0fe77ddbe52381423f3944f52
        • MD5 SHA1 SHA512 SSDEEP TLSH

        classes.zip

        • Path /data/data/com.wndthksbj.szlxthnse/cache/classes.zip
        • Size 4.7MB
        • SHA256 77ca9b3811fc7f568a3bd8bbda0543d2a18176f6f8c9de545ff8c71356cb6850
        • MD5 SHA1 SHA512 SSDEEP TLSH

        classes2.dex

        • Path /data/data/com.wndthksbj.szlxthnse/cache/classes2.dex
        • Size 1.9MB
        • SHA256 1511764b59c37fddb5550f31847636599547c4440ce92acaa7f9c3f1f13c0004
        • MD5 SHA1 SHA512 SSDEEP TLSH

        classes3.dex

        • Path /data/data/com.wndthksbj.szlxthnse/cache/classes3.dex
        • Size 812KB
        • SHA256 cf46db17e5ad0b6c81b1da6a0fe36cbf2e4c83b151102a2e5f4de06e72bf8925
        • MD5 SHA1 SHA512 SSDEEP TLSH

        profileInstalled

        • Path /data/data/com.wndthksbj.szlxthnse/files/profileInstalled
        • Size 24B
        • SHA256 4ef8e14e5cb13153444fa11f7d4e16e7d3accefe03f18596c517732d990db7e1
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.wndthksbj.szlxthnse/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.wndthksbj.szlxthnse/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 56bc0dd7328f55d6003c14ecac638985881e760c12e139071dcbe567bbc0f6c6
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.wndthksbj.szlxthnse/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.wndthksbj.szlxthnse/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 765f938d9ef70d2c104de001ff67f99dc8293a14a25c1b332b8c42b092624621
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.wndthksbj.szlxthnse/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 d71eb4c7a7a36ea0274b4efb2891f3438d35cb7262f1bfe4ec17411fb1da81fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.wndthksbj.szlxthnse/no_backup/androidx.work.workdb-wal
        • Size 124KB
        • SHA256 491b61266866b0dc7f3caa3cbc9da3ac92456dfe9e02cfc3a86f19fe65db00cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        classes.dex

        • Path /data/user/0/com.wndthksbj.szlxthnse/app_dex/classes.dex
        • Size 5.1MB
        • SHA256 09a4d6d0238ea2cf11d22985efa60e602d1470cddb52eb2759abe270a9d61554
        • MD5 SHA1 SHA512 SSDEEP TLSH

        classes2.dex

        • Path /data/user/0/com.wndthksbj.szlxthnse/app_dex/classes2.dex
        • Size 5.0MB
        • SHA256 519e37b6cb653249c84abc407f6febfe67f4b67866d5a60aca9ba41906dd5e15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        classes3.dex

        • Path /data/user/0/com.wndthksbj.szlxthnse/app_dex/classes3.dex
        • Size 2.1MB
        • SHA256 c2bdfd36b2c948bdecf96bbd3063a1db4d97da5554059ff6ce2632866742a4ea
        • MD5 SHA1 SHA512 SSDEEP TLSH