Overview

overview

7

Static

static

6

VINCheck.apk

android-9-x86

7

VINCheck.apk

android-10-x64

7

VINCheck.apk

android-11-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-10_x64
  • resource
    android-x64-20260325-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
  • submitted
    30/09/2026, 18:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VINCheck.apk
  • Size 1.9MB
  • Sample260930-w3dztsybpg
  • SHA256 30f10a84684c66706bf4039adbb3093afdf34a504f6df2712d899338f81f5372
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
    collection
  • Reads the content of outgoing SMS messages. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Checks the presence of a debugger
    defense_evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • net.blS2y4.nsUCqdL6du.caBy9A20Zd
    1⤵
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Reads the content of SMS inbox messages.
    • Reads the content of outgoing SMS messages.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5019

Network

        MITRE ATT&CK Mobile v16

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1603

        Persistence

        Event Triggered Execution

        1
        T1624

        Broadcast Receivers

        1
        T1624.001

        Foreground Persistence

        1
        T1541

        Scheduled Task/Job

        1
        T1603

        Privilege Escalation

        Defense Evasion

        Download New Code at Runtime

        1
        T1407

        Foreground Persistence

        1
        T1541

        Virtualization/Sandbox Evasion

        2
        T1633

        System Checks

        2
        T1633.001

        Credential Access

        Clipboard Data

        1
        T1414

        Discovery

        Software Discovery

        1
        T1418

        Security Software Discovery

        1
        T1418.001

        System Information Discovery

        2
        T1426

        System Network Configuration Discovery

        1
        T1422

        System Network Connections Discovery

        1
        T1421

        Lateral Movement

        Collection

        Clipboard Data

        1
        T1414

        Protected User Data

        2
        T1636

        SMS Messages

        2
        T1636.004

        Command and Control

        Exfiltration

        Impact

        Data Encrypted for Impact

        1
        T1471

        Data Manipulation

        1
        T1641

        Transmitted Data Manipulation

        1
        T1641.001

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        silent_fallback.wav
        • Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/cache/silent_fallback.wav
        • Size 86KB
        • SHA256 3fa20276d8a4131431490ed129d0b05fafa4e9c82d4339b5cf635512103d6615
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb
        • Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 6c386b51e83904a5ca838a81dc43ce0b0c7af661419231cb3d51457c374b9e8b
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 a7732cfbbe3fa1c4d60044f1f7aa40fcebe48cb5585dfa05ca389ec219d82dd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 3500cb109243e8591f28ac616b954153ab5374dcc0d8ff428754d94b414af1c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/no_backup/androidx.work.workdb-wal
        • Size 213KB
        • SHA256 8b520dc9210168366aaaf278d7bc93d24071352f4a438c14be2e3ff2ec254cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        [email protected]
        • Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/oat/x86_64/[email protected]
        • Size 351B
        • SHA256 e24e70b08c4509d9b4bb1f6443c269aa56273f32671c8a3a12037bff430c5fef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        [email protected]
        • Path /data/user/0/net.blS2y4.nsUCqdL6du.caBy9A20Zd/[email protected]
        • Size 2.7MB
        • SHA256 283b0ca53d5f7a5fb661c5e30c198686b7c976af6ea8df4bb2747bbae9728243
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        com.google.android.maps.jar
        • Path /product/framework/com.google.android.maps.jar
        • Size 315KB
        • SHA256 67a651acd867e046fb4463b31ea584c1468f7243a9d1e2efd34059e8ee2f130f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download