30f10a84684c66706bf4039adbb3093afdf34a504f6df2712d899338f81f5372

Analysis

max time kernel
149s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260721-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260721-enlocale:en-usos:android-11-x64system
submitted
30/09/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VINCheck.apk
Size 1.9MB
Sample260930-w3dztsybpg
SHA256 30f10a84684c66706bf4039adbb3093afdf34a504f6df2712d899338f81f5372
MD5 2814d55bd02e9cfec11cc6aaf18ec97b
SHA1 35c6429dac370267c931798cdaccb296f3cb6b4c
SHA512 0283088e5a55cfebfecba8ebbbc3694b28c60ec53d306d8784379942dc3520116a609c86a3d166bcd854df04d52da79a0d909ff8712783979f96185da985ff7c
SSDEEP 49152:19f6Rj1uEqTLDgSR8jZV0JkIpNPGmWLzdB+UU351dJV:Hf81TqTLg/0P3a3dgj51dJV
TLSH
T1B0950106F7D9942EFCF3D3361B362AB580029D168B47D7879975B23C19BB8C08E46AC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4724	net.blS2y4.nsUCqdL6du.caBy9A20Zd
/system_ext/framework/androidx.window.sidecar.jar	4724	net.blS2y4.nsUCqdL6du.caBy9A20Zd
/data/user/0/net.blS2y4.nsUCqdL6du.caBy9A20Zd/[email protected]	4724	net.blS2y4.nsUCqdL6du.caBy9A20Zd

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	net.blS2y4.nsUCqdL6du.caBy9A20Zd

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	net.blS2y4.nsUCqdL6du.caBy9A20Zd

Reads the content of outgoing SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/sent	net.blS2y4.nsUCqdL6du.caBy9A20Zd

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	net.blS2y4.nsUCqdL6du.caBy9A20Zd

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	net.blS2y4.nsUCqdL6du.caBy9A20Zd

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	net.blS2y4.nsUCqdL6du.caBy9A20Zd

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	net.blS2y4.nsUCqdL6du.caBy9A20Zd

Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	net.blS2y4.nsUCqdL6du.caBy9A20Zd

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	net.blS2y4.nsUCqdL6du.caBy9A20Zd

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	net.blS2y4.nsUCqdL6du.caBy9A20Zd

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	net.blS2y4.nsUCqdL6du.caBy9A20Zd

net.blS2y4.nsUCqdL6du.caBy9A20Zd
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Reads the content of SMS inbox messages.
- Reads the content of outgoing SMS messages.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4724

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

silent_fallback.wav

Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/cache/silent_fallback.wav
Size 86KB
SHA256 3fa20276d8a4131431490ed129d0b05fafa4e9c82d4339b5cf635512103d6615
MD5 2d6aa5b46fafaee0bf8a1f5d2e00061f
SHA1 77738fa94d29e92e2db75fced78120d6f8ac7485
SHA512 ac2d4f0bebd8b86d8b802c25e254e229db1e41c098aa4f2763b12bf4b66fffee012de9f1e942449e3635f2906c6f91679c66849451c224f6091d3f9113f20ae0
SSDEEP 3:/y6g41tlNmbEREP:/y6g8RE
TLSH
T1D08302F515245410E0158A36153C1E104765642293164240045460143C30C997A5601A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 1278a10bf3b781de1eaa1ea138354ceb02f373ae1dcdcb638f574a8f1bbc9610
MD5 eea71f7a94b1b333648a3934bc9c3e53
SHA1 4c0ef893f06522a63eaea886285662045facfa7c
SHA512 fdcdc459f16f73c6cb55d8f0f3c20c23ff26b14eb1ee125253dc44f5a7009f36191dd20f0c0c2b795da165fa72825739e76338f7cf224bebc7ecb12a3ae3a096
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 d3135587dda7b74ccafe7f79c0ea25be7245af4480d6266cd56a00271386410d
MD5 bce4a19d4ee59fdbd5c2ee9e1a302b65
SHA1 2296d0cf686c6d8fd9c62f5e30461082998eba6c
SHA512 baefd1840af78a6d40f753b99966ef733ec08e5a300dfac99c8e6c4a90f91e59cc9cb9bfff283fa4d63f335c297583fd2136a71b1e5b05317380fe6f5e48bce6
SSDEEP 12:KEsNA1XzdeWRmBEyPbP/pm2v3JiSBgOw2:KozKGSP/pmu3Ta2
TLSH
T186722B54B3C15D13C914233E90C9C3045D3B632D5352C76B135918B56D4B3CCA3A3D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 24a55f21cd9484ad3c95be46d42154c3aeeacb44ea95a0d4cb228ccc871f3b1c
MD5 eca92c99dba9e12a68a736ed02dba3ec
SHA1 5ef2bb5f2743a7ef972826e88d6b72e9213dbb59
SHA512 94e059d272f7ac4585b66181c006a3a8f5e204e6a8f91f949b51806a4e703d28098e164700026bd06d29e88f1cf474e36578b6c7bb41ad759f28cb0ac7150214
SSDEEP 96:L0qY6+etidjnZRWzzb8/KeKcK+zS4ddKz+ZD86u0ExV:gqptidjnfWzzb83zS4de+ZD86u0ED
TLSH
T14DC3238D0F596A00C09954B4E5D00FA17D3F812E9793E3E2669100B5ADD7921DF2ACFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/no_backup/androidx.work.workdb-wal
Size 205KB
SHA256 65f45846b4b8b3302ab1273c31e9a8f07d6b17e31214059d2dea0cd3aac509c1
MD5 8217b11e5d0c16af6ea1afd5540d0047
SHA1 6444947e0669b59aa6a69819103d7285a8679d5a
SHA512 3cf81dba3a5e970d379116198715d8f617b248b1b3562f850e2e674857cf54656fff3c71d0425b0f473494fec74f1a33d92e2e4010ff7dfb3646068d2f1938ff
SSDEEP 24:KlF32jqtYqS3RbP3ZP3wo3o3Fr36cJ3d32jqtYWgZf3R39SJ32jqtYWS32jqtYRd:Kl/tYeRT9tYiLtYXtYERtYoIn
TLSH
T1ED24DF96E250C9CEE49A003EF0CA93BF06A70C784209DCEB1E757376396B62D51B6164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path /data/data/net.blS2y4.nsUCqdL6du.caBy9A20Zd/oat/x86_64/[email protected]
Size 509B
SHA256 5edba662e7efe7cf94904cf3e2e3976eff408001b7b439ae36d4291c38fa0ead
MD5 ae17e3f0b5d8e896387814aa653038e3
SHA1 1e101f5d3dedce6b38c7991e378e7ebf494fd95c
SHA512 3591040b7a812a3d342a7ee3dd65d8aa828eae82c5f739854862fdb9e2bb57132e3d2bb8da6f7d7fe585bdc1b0f598cc8b8058516f98e59ab09323ccdac7c5d5
TLSH
T1C6F00EA0E20A8100CFE1193AEBD16A5A33C83193BC6644631EC2428069A6C783C41613
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path /data/user/0/net.blS2y4.nsUCqdL6du.caBy9A20Zd/[email protected]
Size 2.7MB
SHA256 283b0ca53d5f7a5fb661c5e30c198686b7c976af6ea8df4bb2747bbae9728243
MD5 fab8a0eb398fccd7c2c48426b18e6ef1
SHA1 6c74ccea82030fc4dee1b7fe95fd9a4fdaf99ac9
SHA512 1cf4f95517c2125db590d9107cd2282bc65720a16181c84e42068439e5f58014897a873673c103341cdced73673491c8ef0b4e22ce2554298b771b0b7bff81d6
SSDEEP 49152:cI74d4fvOj5z98pByag1WWvFeMc9CfVQHQ:cI70jNy4b
TLSH
T1C8D5A2E5B3515661D4D83279B8FE8B60F73D2C8DD6CE3B022809A770BD522F47AA1247
MD5 SHA1 SHA512 SSDEEP TLSH

Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads