Analysis
- max time kernel
149s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
11/09/2026, 21:09
Behavioral task
behavioral1
Sample
jaffacakes118_61f2738d1f37de84204a1f914c92a7d0f70acc8138146cd9f614cd8845791248.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_61f2738d1f37de84204a1f914c92a7d0f70acc8138146cd9f614cd8845791248.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
jaffacakes118_61f2738d1f37de84204a1f914c92a7d0f70acc8138146cd9f614cd8845791248.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target jaffacakes118_61f2738d1f37de84204a1f914c92a7d0f70acc8138146cd9f614cd8845791248.apk
- Size 15.7MB
- Sample260911-zzfk2adf89
- SHA256 61f2738d1f37de84204a1f914c92a7d0f70acc8138146cd9f614cd8845791248
- MD5 8cd06a6a8a43086f3619fab880aaf0ba
- SHA1 3e9b2f27380e43b410c95e4d682bc52cdd38ea7a
- SHA512 27f0c159608405575004071fc3929cb25e7856546ea1ec58e2da933a2888bc8aeab050e3bfa11e6828d631a86a298cffaefafaa505f005261182542643f263e1
- SSDEEP 12288:PsZOBkzs/HtNzfN/E3p9/s4Noltpk9ktoipOxp0UOv3VcPtSTLYC:/Nzq/s4ulfk9kex0U6KC
- TLSH T1DDF6BF03F34A9CBBD8F252318D61BB29671A8CA9DB6741C38C9D3B7C5CB60C14675AE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
pid Process 5044 knowledge.focus.recognize - Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId knowledge.focus.recognize Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId knowledge.focus.recognize - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock knowledge.focus.recognize - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver knowledge.focus.recognize - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule knowledge.focus.recognize
Processes
-
knowledge.focus.recognize1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:5044
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-09-12.txt
- Size 45B
- SHA256 a196e815b2de1dd08ac2af8d528b253354d123fe7e71d97d4064293130ea8f94
- MD5 8c4c3280084e48f81906bf835191e2e9
- SHA1 6a7237101fe86bca811974a49b2094647ecba2a2
- SHA512 afa927de977ca2565aaa749767b99efc8e2f0d2e7f623e08eb68bc4081e3858a4a26c3688096f8a06ea6693f1e0d967941e84731972e6c7c6797a88fdbbcbb0d
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-09-12.txt
- Size 25B
- SHA256 2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
- MD5 ba30336bf53d54ed3c0ea69dd545de8c
- SHA1 ce99c6724c75b93b7448e2d9fac16ca702a5711f
- SHA512 eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-09-12.txt
- Size 296B
- SHA256 dfff4a003547fd9f1956b73ec15efba13c2b1942fe7a87969c905eb72891006e
- MD5 0a6f1fb8071f4784f57eb92e01c96543
- SHA1 c28b3a4e952019df5ac7e6be760093ff3e2f813a
- SHA512 a4e66764ce4195c3dc5ef7eda82617309e521f2adf6a28a0618b9d6f8ff506c8e198e5448763c29f5d6dc07fc80e8d90e573c6e0fc5bbec158c144b1c13722d4
- TLSH T18EE07D501B4528D7A438C195178D2901DE32611074DB612052139E03F23D76AFE58D4E
- MD5 SHA1 SHA512 TLSH
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-09-12.txt
- Size 29B
- SHA256 5a290151305de1ec4f790cd8ada8bd68c076a2c4ed497c40a519509659b65150
- MD5 b9b530e2448252311640bbecb69b796a
- SHA1 215ede46fb42a68a7ae84c3019acb3019668a46c
- SHA512 5834499307946d130887067b2f837ddfef7fdfe3a7e5ed8977eb14c2dc1ab328334da35ed4c978e20b3e6b28ff30dbd12f0430f4b7c831481f339d360c260919
- MD5 SHA1 SHA512