Analysis
- user interaction
yes - max time kernel
102s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
10/09/2026, 21:13
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
CNT 5G.apk
Resource
android-x86-arm-20260325-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
CNT 5G.apk
Resource
android-x64-20260325-en
4 signatures
150 seconds
General
- Target CNT 5G.apk
- Size 4.6MB
- Sample260910-z2sy5sytdw
- SHA256 34476a8cf1a2d95cb5f34a130b2228df4f8b41459d30f05410c24ac03b4d3df6
- MD5 b0cd3c0a0fcb87e4a5b823cc25da22cc
- SHA1 063cdc348803112c2a637cb805f33fe6d52efbf6
- SHA512 9520f46cfa27ea710ce0f90ef4a2735575865f289c467dde60ab03627beee38db089b6021d29b1314587d5f2b3c02215dccd20a4a179c2f3405838fd6c386e58
- SSDEEP 98304:wY+30H9Ue1fGp3Q5IM6ujHDbtaWxPUUdj5d2XMpfy40Mk3KuFGG+b8n6HZN:uE9udQ5N6IHD8WlU41d64xPb8nEZN
- TLSH T1852633751A6878ECD60657F645E29923C548BCB7C6E035E8B32641E23A806C0F6F8FF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/jayopr.mqodhvq/app_kqe/tmdo.bin 5066 jayopr.mqodhvq /data/user/0/jayopr.mqodhvq/app_kqe/tmdo.bin 5066 jayopr.mqodhvq - Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 47 checkip.amazonaws.com - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground jayopr.mqodhvq - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal jayopr.mqodhvq
Processes
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/jayopr.mqodhvq/app_kqe/tmdo.bin
- Size 50KB
- SHA256 3746b41ac1f4edbec99c3b4e1e7a5f52d9e404de63554e7d576a232fcdb32455
- MD5 1d6426a8e5c260e6c4518d5dcffef646
- SHA1 eb86341de2289d8e5742a3d0ccd5a433aac6f660
- SHA512 c4d9e85458d92718fd0b786dea9c054ad14f9ac852299bc43ae1e2fe9cbc3f26ec1f92149c880a8995454ccf8d869f8ef7c69c61e99b81d99349d3c053a05791
- SSDEEP 768:bjTRU1U/m2DUHkng+YsROsDN1Dypd2V1NrGaHXmjKr1gfTHPPpRrNpY0fW+:bPBIHwg6ksydc1NrG7k1ITJXPu+
- TLSH T1A7335B26E781ADA0D8BD473FD2A717509731EB90863783A71A52617C0DC37E6EF81B42
- MD5 SHA1 SHA512 SSDEEP TLSH