58d092f7395a5ecf2603c40f2a238de27efb07b3db8e8b4af5e7aa810102fcb7

Analysis

max time kernel
119s
max time network
128s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
24/09/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ArtWorkout.apk
Size 109.9MB
Sample260924-pvsppa115m
SHA256 58d092f7395a5ecf2603c40f2a238de27efb07b3db8e8b4af5e7aa810102fcb7
MD5 58734f4b66aa36c20b3bc7fcc62aff3c
SHA1 698b53f89a792afa89dd2435802fc17d39ce7939
SHA512 c67c9a1b583bb1f05089b4225e50a42eb346e16e3c670d678a3cdc2822db9ead07e14d98d00e767f239d8a7349bbd2b143c056e82480e6dae122da2f51b1ed4e
SSDEEP 1572864:sh7o5spZJLQO9oSbtr9uon3BYS/jsJUXlnVlUoLX9IHzZyIiAIbjA8oGcA:sh7fLQHS5QonxTh
TLSH
T16548D013F7825D32C96E973658FB4740BB319A99B7474B432404E6B8BCE32C19FA92D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	app.artworkout.learn.how.to.draw
/system/xbin/su	app.artworkout.learn.how.to.draw

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/app.artworkout.learn.how.to.draw/[email protected]	4825	app.artworkout.learn.how.to.draw

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	app.artworkout.learn.how.to.draw

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	app.artworkout.learn.how.to.draw

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	app.artworkout.learn.how.to.draw

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	app.artworkout.learn.how.to.draw

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	app.artworkout.learn.how.to.draw

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	app.artworkout.learn.how.to.draw

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	app.artworkout.learn.how.to.draw

app.artworkout.learn.how.to.draw
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4825

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

prod.shB2jvJzud-0.tmp

Path /data/data/app.artworkout.learn.how.to.draw/app_segment-disk-queue/prod.shB2jvJzud-0.tmp
Size 1KB
SHA256 4df3b50c80c89fe767928a9248c6c307436e4756428bc61e347af026d2f979d8
MD5 8e985f247f195e614f1f208548ac4a58
SHA1 00edb9ffd5dc6bd65e75b22111239c96f0e7f907
SHA512 e08ffa9be22e98f90bc1c6b87e30c477d6be39bdab955a49489a74070e4434caa13c23dd40fa6bb38b4023b4c3990e921720ad26ecb1e292c66b3131fbb68396
TLSH
T1EC41864FA331BDB7275A0B9A280D3FAAAA251036808ACD1DC5CD5B0059AA5EC35B9523
MD5 SHA1 SHA512 TLSH

Submit Download

prod.shB2jvJzud-1.tmp

Path /data/data/app.artworkout.learn.how.to.draw/app_segment-disk-queue/prod.shB2jvJzud-1.tmp
Size 997B
SHA256 2b5e143dd1cd8471d3a418755e493e66dd3cde62734f63ba2bced65cfae0bf6f
MD5 b304e2eb1f86eb510005c47427ab71f0
SHA1 224e8356a647f5967a7e2b8fdbe6beeb3f56f640
SHA512 3f6009c14fb9befb46f4f6e4c2931bc11210ddb3229ce5c6ebe71b56901e3cd2a2582abd3536887601a51f66ac6c0b57415f0b1d049c1c63bb1727d9be5e874b
TLSH
T16011654AD331B97712550F9B180D3EE7A6255036808AC919C58C5B0459DA5EC3099513
MD5 SHA1 SHA512 TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/app.artworkout.learn.how.to.draw/databases/com.google.android.datatransport.events
Size 56KB
SHA256 f3d007aeaf6943bd76696982c186666c3b6bf8e6eb80b0fc7122e7a4171cf84a
MD5 f8fde7c9afd0780f00baf2c85544fe7e
SHA1 fbd5b57334dab1ecceb16f0dd6456f53a14fef96
SHA512 79f7a3e19ef1189c5ece9afe83f7058cfc56e31142aaf580cb4207c47e9bb2a33fbf4014aba356289a6705c6e781df340b98d71e254adae44f235dc65e3c6d3a
SSDEEP 48:TG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSuV1fFXfb7tFXfbk:WMEqzAiwIyNjaubFb7jbk
TLSH
T1B243649D5A3C2221C66DE83DD7E243A32B7C83CF972292213A949DE6CDC20657C254B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download