Overview

overview

7

Static

static

6

5fa9f3e07b...0c.apk

android-15-x64

1

update.apk

android-15-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    31s
  • max time network
    54s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    05/10/2026, 12:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    update.apk
  • Size 31.6MB
  • Sample261005-ppd94ssfjd
  • SHA256 923de6e7f5cba83122c38553c55c53d700425faf3ae483fc52855773c2204e9c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
collectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
    defense_evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Acquires the wake lock 4 IoCs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    defense_evasion
  • Enumerates files in the device's shared storage. 1 TTPs 1 IoCs

    Queries the system media store to list files across shared storage, letting the app discover what documents and media are present without opening them.

    discovery
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.mercedes.pack36
    1⤵
    • Checks Android system properties for emulator presence.
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries account information for other applications stored on the device
    • Acquires the wake lock
    • Performs UI accessibility actions on behalf of the user
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Enumerates files in the device's shared storage.
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:3270
  • com.mercedes.pack36:hermes.assist2
    1⤵
    • Acquires the wake lock
    PID:3309
  • com.mercedes.pack36:hermes.assist1
    1⤵
    • Acquires the wake lock
    PID:3302
  • com.mercedes.pack36:hermes.guard
    1⤵
    • Acquires the wake lock
    PID:3358
  • com.mercedes.pack36:hermes.vpn
    1⤵
      PID:4046

    Network

          MITRE ATT&CK Mobile v16

          Initial Access

          Execution

          Scheduled Task/Job

          1
          T1603

          Persistence

          Scheduled Task/Job

          1
          T1603

          Privilege Escalation

          Defense Evasion

          Hide Artifacts

          1
          T1628

          User Evasion

          1
          T1628.002

          Impair Defenses

          1
          T1629

          Prevent Application Removal

          1
          T1629.001

          Input Injection

          1
          T1516

          Virtualization/Sandbox Evasion

          2
          T1633

          System Checks

          2
          T1633.001

          Credential Access

          Clipboard Data

          1
          T1414

          Input Capture

          2
          T1417

          GUI Input Capture

          1
          T1417.002

          Keylogging

          1
          T1417.001

          Discovery

          File and Directory Discovery

          1
          T1420

          System Information Discovery

          1
          T1426

          System Network Configuration Discovery

          1
          T1422

          Lateral Movement

          Collection

          Clipboard Data

          1
          T1414

          Input Capture

          2
          T1417

          GUI Input Capture

          1
          T1417.002

          Keylogging

          1
          T1417.001

          Screen Capture

          1
          T1513

          Stored Application Data

          1
          T1409

          Command and Control

          Exfiltration

          Impact

          Data Encrypted for Impact

          1
          T1471

          Data Manipulation

          1
          T1641

          Transmitted Data Manipulation

          1
          T1641.001

          Input Injection

          1
          T1516

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          base.3270.tmp
          • Path /data/data/com.mercedes.pack36/cache/oat_primary/x86_64/base.3270.tmp
          • Size 245KB
          • SHA256 b4206cbd9a0f542e1b8392db2ca8cb9df0bdb826a5fd3b59000dd6bed2fe17a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base.3309.tmp
          • Path /data/data/com.mercedes.pack36/cache/oat_primary/x86_64/base.3309.tmp
          • Size 16KB
          • SHA256 35993dc84fa016775aa89a15901b6cca661709b9cd3f97b57a54e011a63b82cc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          keepalive_5s_new.mp3.tmp
          • Path /data/data/com.mercedes.pack36/cache/resource_pack/34d22047255adbe39f82313bd27f3b69a7f70774eb4e7c3655cea4f3d582ea9b/keepalive_5s_new.mp3.tmp
          • Size 79KB
          • SHA256 7ee8daf72a567f0f673d6fe8515a2efdc7e21413c1df804f4d836f7255ac75c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          profileInstalled
          • Path /data/data/com.mercedes.pack36/files/profileInstalled
          • Size 24B
          • SHA256 676ce2a6091d364fef5b5447d60b7ca084f1934928ade79a80b68084742f1b6d
          • MD5 SHA1 SHA512
          Submit Download

          androidx.work.workdb
          • Path /data/data/com.mercedes.pack36/no_backup/androidx.work.workdb
          • Size 4KB
          • SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          androidx.work.workdb-journal
          • Path /data/data/com.mercedes.pack36/no_backup/androidx.work.workdb-journal
          • Size 512B
          • SHA256 0585c2da8b5d453c1be672e856219842de4b2106ef3fa55aa93ced6d434e9e1a
          • MD5 SHA1 SHA512
          Submit Download

          androidx.work.workdb-shm
          • Path /data/data/com.mercedes.pack36/no_backup/androidx.work.workdb-shm
          • Size 32KB
          • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          androidx.work.workdb-wal
          • Path /data/data/com.mercedes.pack36/no_backup/androidx.work.workdb-wal
          • Size 16KB
          • SHA256 a51c6c2ed03ac3cf80dfd243f22a56194dffa62659ad4cf2cb04ba2e72216210
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          androidx.work.workdb-wal
          • Path /data/data/com.mercedes.pack36/no_backup/androidx.work.workdb-wal
          • Size 116KB
          • SHA256 57132736203a39f0d6f56fff278be6f97bdac61c5a539627340fe0efe659c66d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          androidx.work.workdb-wal
          • Path /data/data/com.mercedes.pack36/no_backup/androidx.work.workdb-wal
          • Size 205KB
          • SHA256 949f0595a877c6a7e437018708d11a9b08f1f7205a9b571723b7782db7ae7dc5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download