e9404f5f9500b88755b84d196397692c783be2e3ebe679a943182f822a8c3abf

Resubmissions

03/10/2026, 05:47

261003-gg4wsstsfs7

03/10/2026, 05:44

261003-gfnhestsdv7

Analysis

user interaction
yes
max time kernel
86s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
03/10/2026, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PhoneSlut_0.9.02.apk
Size 33.5MB
Sample261003-gg4wsstsfs
SHA256 e9404f5f9500b88755b84d196397692c783be2e3ebe679a943182f822a8c3abf
MD5 aeb617c6dd72412826148799ad74d94c
SHA1 9ec21916e5227cfc16bfb797aeb056f66b837d1e
SHA512 5cc3c4a1193b31378a1d3b514753cc9d43e81beb4e24b4af89cdaaf3c950369bb698b39409e7f169325642f3a7f8467dec194720b462835d32bfc2427e2e4474
SSDEEP 786432:PvekzSgmZBjxGzVU4kTsZBPp/AsLgkz2+iSex1:Pvekz/dRkTIPp/AsLm7
TLSH
T168773322EBA4A91DE47F413F48A7023D9016CD3ED65186C3B6DDB724AB332E40F856D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4788	com.censored
/system_ext/framework/androidx.window.sidecar.jar	4788	com.censored

Locks the device screen 2 TTPs 1 IoCs

Application may abuse the framework's APIs to lock the legitimate user out of the device.

defense_evasion impact

Device Lockout

T1629.002

Endpoint Denial of Service

T1642

description	ioc	Process
Framework service call	android.app.admin.IDevicePolicyManager.lockNow	com.censored

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.censored

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.censored

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.censored

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.censored

Requests modifying system settings. 1 IoCs

defense_evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.censored

Changes the wallpaper (common with ransomware activity) 1 IoCs

ransomware

description	ioc	Process
Framework service call	android.app.IWallpaperManager.setWallpaper	com.censored

Enumerates files in the device's shared storage. 1 TTPs 1 IoCs

Queries the system media store to list files across shared storage, letting the app discover what documents and media are present without opening them.

discovery

File and Directory Discovery

T1420

description	ioc	Process
URI accessed for read	content://media/external/file	com.censored

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.censored

com.censored
1⤵
- Loads dropped Dex/Jar
- Locks the device screen
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Requests modifying system settings.
- Changes the wallpaper (common with ransomware activity)
- Enumerates files in the device's shared storage.
- Schedules tasks to execute at a specified time
PID:4788

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Device Lockout

T1629.002

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

File and Directory Discovery

T1420

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Endpoint Denial of Service

T1642

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

link.zip

Path /data/data/com.censored/files/link.zip
Size 275B
SHA256 8263c8bd7d00bc7230f85313678de8f91f4d180e20d3dacc86f30848e44af373
MD5 dc7c40d52868d86c10bc56029f20dba8
SHA1 36124588fcdf3c03810d6b93036da97cf94ff145
SHA512 3433c7d14d3e8c1f53e3dab3a2ecb13bbc97ee6fba05e4a4972dcbe6df567c7b7b926dd2f53b7f7f98e9b6a8a5451241f379235ac52d8535f4941a9710a500a9
TLSH
T168D0231145187813C4D0437FE336111DC300C64662CC5E5B750111EC1C0294A6A952EC
MD5 SHA1 SHA512 TLSH

Submit Download

rubberslut.mp3

Path /data/data/com.censored/files/rubberslut.mp3
Size 12.2MB
SHA256 268415b7c100b52843aba84bcae1c515cb8953d03e84227b9a8e69201c349815
MD5 6ac5616ef7c40db6a97533488d3fa26c
SHA1 ed53c5f3706835db4fe7678fb42dad2cd9179e5c
SHA512 c2b7223e84b2cb37918485835412e6f61b75beb009532c99b10597c72492915ec884ce442ecdd8a63099487f74e4fc44dd7195df1fce7f03d7ca72377718076c
SSDEEP 196608:OQcCZmCMqvayLXbhL8p6Biwf5TTr+D50qzHX6h2V2mhg:7ZmCNNLXbFG6HTiVbdBhg
TLSH
T158D633B3541D3218C49E867C896A83DCA8B7CEBEFF39AED4A4D5B452CA303556F04817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

testfile.zip

Path /data/data/com.censored/files/testfile.zip
Size 879KB
SHA256 b92732766b3f1c64f20c6c1965f73207af53789f0853d84234224952f117266d
MD5 097816d57cd1f367cd5d8e5fb5dc6498
SHA1 9f679760493eb145484359494e6070ca37404cc4
SHA512 2ca77f7de9385b951277b25af6ddcd5a77f42d15b0661e098572bb38a6c0fc6041f7dd9bb80b76462958cfae7a93172f1b12b59261397e1fc407e84920ea27ba
SSDEEP 24576:Ru7fJmUIb3vN0WPHlikoM78WDQimMglzTlZwsatR:cVlE3vN9lnoM782HcAZj
TLSH
T1C915239B2FC44B0FC6595D752D1927A96C10FC868FFB755B4A0C9E0A3F43169E4BAE00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

video.zip

Path /data/data/com.censored/files/video.zip
Size 118B
SHA256 1002c965c5f67e5df87728e3539f3adcf94b35a1e54b3991835dbc7e7dccb6a2
MD5 65ba6ef63580c903738fb503c258276a
SHA1 2ab3a9a5e17373f0dae22610f699b7e6ac7c83c3
SHA512 d6ad4e541c919dcb0ccb5aac1e4472a1d99893255f5bea1512505fb394f9871a5d868b76d3c9399c4350924cfbd0883c765fcc988a60999007490c9acdd54e21
TLSH
T146B0019192E92B3AC493567F90121B05E304D8A16488AB872F06AA86AE138899D1978A
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.censored/no_backup/androidx.work.workdb
Size 104KB
SHA256 07f866b45703425663cc8c7a30fc3275850b9c816e3590f06f670dd22f27ca1c
MD5 b36fa2bfa8a1ece5c12cbf0c79a51070
SHA1 bbd6cbd529d8252007617848bfab6ac3673c298a
SHA512 ecdaff4a6a052c9ffbc285808a8b604589a866ccbf1228e45ee25c99177935a46e7c0967530f2dc48ac961aea28527553b7b0f3271e9344b193672a9b2ce18ab
SSDEEP 768:yDtYwDUDxDtY+1DtYAGPDGnR+dhefWz03zS0ZD86yD:yhYwDUDxhYuhYPRSzS0ZDg
TLSH
T108A3938E1F461505D19A51B0DCA40AE37D7FCA69D753E7CA7A6311A1ECC2412EC288F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.censored/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 95bc1749039cdc917155c33e1fb0f363585fb1ddf3d91d84c4d6e9a01ba655a6
MD5 bad0d5a95f77289ad903aecf84461991
SHA1 d4cb22bddb613acbc7166a5e63336057128a661e
SHA512 ae1cc283e80d16dc1f73822946a5e9baff7b726404923edc924be6952bb45fa94775bf1eaf0ef5a06719d64da0eef89b5aa66127d9cb995ff5e752f94a5f51fe
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.censored/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.censored/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 af6b7af5e57ca0e9b7817ec3d9d46a9c08fa9a4effd0a6aea9ca6968e8303349
MD5 a3e32d11487cd436606ac0a4678b5d89
SHA1 b882f1c7faddcaa49c47552c1533d1bfa4de3832
SHA512 36261868171c93fd117579766d232d2335e7daa2a7a7cf49e250d69be96c874d159bae96c0b3d590a8e710ef24da1940fa352e4ef76446b2a704fe68e8cb0439
SSDEEP 6:KiWU9FZde/kPlOERX4PBX4ogLugMBX4suuK+/V1TslYTOw2:KrOzdeWRmBEyPbP/V1TslCOw2
TLSH
T15872C284A3C02982C119033255E6A3011F627A2F5362CB4F67A22D226CC2ACC9468D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.censored/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 e6a9ae83770f22da29246c981bd1c0dc0e182bd09cf24575c3cb5dcda019f51e
MD5 dd7ff3cfd695f10daed9f51b3d070c69
SHA1 5f25e57fbe1bd96f2e00b576c864c2a2ec0f77e4
SHA512 e739ed465ec5b4e871da6dfa9b0a1c40149e89c98355d5305039f7cc8c478a7a4c19a0c9f73cc309753ce1c697400759f6ff2bab5796892d59b00f2d79dda6e2
SSDEEP 96:vGN1rkBD6+etidjnZRWzzb8/KeKcK+zS5ddKz+ZD86u0ExV:vYJkB4tidjnfWzzb83zS5de+ZD86u0ED
TLSH
T12AC3518D1F082600C0A964B0E6E10BE17E3F752E9793E3D725A101B5EDD2925DE2DCFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.censored/no_backup/androidx.work.workdb-wal
Size 410KB
SHA256 6d9d78a60b9122f0c7316ecc7f596305ed489445c65f9179e53a0f038dd0238a
MD5 4ead926b8eef35e1e4f9d921c387ed9a
SHA1 b735eae5bf916bd949cb947633d3e09fc245566f
SHA512 bad8239edc1f05821ce9b98b6a730b9362c45fdf0cfba4a16a9ba4111c234fe995b7fdeefe25721844d8bf07bda16dadb6f61071bed5ee26673055fa9cecfba3
SSDEEP 6144:FAfrb6Afzb6AfsD5AfgCXYMPJbCLbg0bFY0b3F0bf6F0bgxF0b9xj0bdrj0bpgvW:y
TLSH
T1049433867742C42AF31E1374ACFE10AF5663FFF08512658E66233751ECE346768E85A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallpaper_orig

Path /data/system/users/0/wallpaper_orig
Size 198KB
SHA256 13bb62e541416dfc3cb70dcb3282b61fa2d3d12cbe5347fa15c4f0ec5b3abb57
MD5 d960189ea462fc69a02b8ad69d86ee18
SHA1 cc823762af8188d77890b0e43d4f080bff868907
SHA512 2c54980af638eef964eaea901893ea98786ab084849c3a75823c10bc0c82279544fbffc4563f3f1621b25048f8237b56ea9ec9c415fc6b3f1d8011925f204bab
SSDEEP 6144:Run10HHoD6lXoypPtC350pC3EoiAIW+bl/ebPZ:wWHi69zI3GFoiTejZ
TLSH
T17A14131CCFFE8C747263F441FA5486B8D065AC5CD25DA23CAEB285A2C15EEAE8053349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ringtone_cache

Path /data/system_de/0/ringtones/ringtone_cache
Size 12.7MB
SHA256 8190ce84efb917ca3bbb7b1e519a650b05d7995cd8547e4b43dbb987bdd42a05
MD5 c70620cf9e1f58a0da2cc390a51706f6
SHA1 4415186bd833f48e3bba2227ef6ec033aa96671f
SHA512 51319417966ee4f0faf862b18373a0445e3025a1f141a5a2c29d82ca92f1dc82feb4637c3311896b9aca17e478a460f9ad8df097ae6fefc7cd2728f7be96865c
SSDEEP 196608:OQcCZmCMqvayLXbhL8p6Biwf5TTr+D50qzHX6h2V2mh:7ZmCNNLXbFG6HTiVbdBh
TLSH
T126D633B3541D3218C49E867C896A83DCA8B7CEBEFF39AED4A4D5B452CA303556F04817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsfsdfsdfdsfdasfdasfdsafdasfzxcvzxvzx.jpg (deleted)

Path /storage/emulated/0/Pictures/Censored/dsfsdfsdfdsfdasfdasfdsafdasfzxcvzxvzx.jpg (deleted)
Size 879KB
SHA256 a6ae04a384886a988020153375e5d931bc93629c75338257509d960d29204ccc
MD5 d211e80d9389610a695f90831ec3b165
SHA1 ee4995264168d0aeccba027c196bd45fe633fc58
SHA512 1da808adfd06f4e5d7b245894bfa364f36c647ccff4c30cbfb59bcb1e46e661615eaf1ba5e1973adf1515d6941caffbe2a3bbc1ee238f08bbdbcb17c16433141
SSDEEP 24576:7u7fJmUIb3vN0WPHlikoM78WDQimMglzTlZwsatC:CVlE3vN9lnoM782HcAZ8
TLSH
T1AD15239B2FC44B0FC6595D752E1927A96C10FC4A8FFB755B4A0C9E0A3F43169E4BAE00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads