f3198bdf3bfbe47ac9765357d0a396073e294c2bc42d7899194ac71118d8b57c

Analysis

max time kernel
6s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
25/09/2026, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
matrix_app.apk
Size 1.6MB
Sample260925-w6vrraxtcx
SHA256 f3198bdf3bfbe47ac9765357d0a396073e294c2bc42d7899194ac71118d8b57c
MD5 b0e02785e92486ec82dfadf976781aa7
SHA1 a3d526d64ab4393bd1da8163b9bb53a054be6516
SHA512 392ab3b3fce6be177ce8675aff9f5be521670a6f3ca5a3fa198e3f1d5452972f912ddb232f418f043c5dcd05559fa5f1b4b2aa28e73ea26febb0fe4453f813d0
SSDEEP 24576:07KCBZXDhQbhQ3seV/seVIskRZcXoSo3eEjc2jNUa802J9TOLNDsWO:aKCBZXFS7eKe2nZDSTEjTBvEOhC
TLSH
T10E751303674918D9C0FBC17A89AB07A16235DFB0DA0383CF9A14B2B824FB7D55F59786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/zcii8nfs6n.v84nv1lm.l0l66kg/[email protected]	4716	zcii8nfs6n.v84nv1lm.l0l66kg

Attempts to obfuscate APK file format 1 TTPs
Applies obfuscation techniques to the APK format in order to hinder analysis

Obfuscated Files or Information
T1406

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 12 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS

Checks the presence of a debugger
defense_evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	zcii8nfs6n.v84nv1lm.l0l66kg

zcii8nfs6n.v84nv1lm.l0l66kg
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4716

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Obfuscated Files or Information

T1406

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

temp_implant.apk

Path /data/data/zcii8nfs6n.v84nv1lm.l0l66kg/cache/temp_implant.apk
Size 894KB
SHA256 9aad52467b43403f08b9fc148a6c3809793f0fef79e973461392fe4a56d26230
MD5 ee8c090757bacc38be3d0018e4a6126c
SHA1 690d1cfac1e0f4707587ef2e5b5dc357dd3ee394
SHA512 218eda03d096d6af604b24db35139ba8ee57c1a02e7de5504f89966c651f8ff7e3832eacea1ca4513de836ec6b922529a3d9ebe6bb530c1acb8cc8ac49af1b7e
SSDEEP 12288:sskeYMefhf+CsCOeC1TdeC1Tq3Szb4pObA1acXTQjEjNgj2jHqpwoFEdJ38kXYhQ:sskRZcXoSo3eEjc2jNUa802C
TLSH
T179151203934D19DDC0FBC53B8C970662212ADEB0960347CF8E14B2B864FB7DA5799B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path /data/data/zcii8nfs6n.v84nv1lm.l0l66kg/oat/x86_64/[email protected]
Size 239B
SHA256 ed94d43f11716574052c25f403fb4d8118fc66ec9a829a7a6fa6b55c024a962e
MD5 15e27dbb81353ec2abaa189622b4bd36
SHA1 848518cf04d8b682cba2d850038e5c9d607a8fbf
SHA512 de7e203c5d6ad5406d9dabf5520c906836d5ae25d7d389fe21c0c91ca79dc3ae1c43ac0d408ec2d6242fe14c69c50690c58ef4efc77517fb71d69e43843570b4
TLSH
T1FCD097F1A6098000CD11223863A91502338432933C82097329D60781B886CA83C0412F
MD5 SHA1 SHA512 TLSH