Analysis

  • geolocation tags

    asiadelhiinindia
  • max time kernel
    7s
  • max time network
    46s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    30/09/2026, 15:22

General

  • Target
    免費獎勵.apk
  • Size 6.1MB
  • Sample260930-sr7k8abd58
  • SHA256 8f34edb8a37408952ac8086030ab39c0215aeb9fd64755c310166e818c577fc7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Hides multimedia files using a .nomedia file 1 TTPs

    Android's media scanner ignores any directory that contains a .nomedia file. This hides your photos, videos, and audio from the gallery and other apps.

Processes

  • com.hacker.locker
    1⤵
    • Makes use of the framework's foreground persistence service
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4957
    • logcat
      2⤵
        PID:5012
      • logcat -c
        2⤵
          PID:4996

      Network

            MITRE ATT&CK Mobile v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            .database_uuid

            • Path /storage/emulated/0/Movies/.thumbnails/.database_uuid
            • Size 48B
            • SHA256 e561215cee3b264541d9325dcfc45388a3be1b6afdb9c94b46bfa0394f94688e
            • MD5 SHA1 SHA512

            .nomedia

            • Path /storage/emulated/0/Movies/.thumbnails/.nomedia
            • Size 16B
            • SHA256 67b08b9e4b1993145b653e2fc8f73c786de13c2b91d6cb0dbb073e5442fa3182
            • MD5 SHA1 SHA512

            RANSOM_NOTE.txt

            • Path /storage/emulated/0/RANSOM_NOTE.txt
            • Size 65B
            • SHA256 d2632f3f142681ff41b76076b1ab3bd22eb56cb369011733fbe2cc5f98696677
            • MD5 SHA1 SHA512 TLSH