5c42c4a59cbd381df5a2ec35ea1e3bf8434db3dc68a01acb4144a39a78af208f

Analysis

max time kernel
60s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
06/10/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
orion.apk
Size 87.0MB
Sample261006-tljsmsfe53
SHA256 5c42c4a59cbd381df5a2ec35ea1e3bf8434db3dc68a01acb4144a39a78af208f
MD5 7d60b4da3dd1cfad2d301e3f3a97270f
SHA1 bc3bd48a5f3c196e9a4c949f97f10ec19eccb976
SHA512 241002febaa3d7e2db78886c3e7ed0fd9cf0b2882d1e780107ac065a0d9a7330ec5267a2e9076d2931159830718fb80d886e8f4f76a074d914f8184f19e0038f
SSDEEP 1572864:h6afJhBNtaGeXfjJEnDxfcx85Dx28g+jjQmDduEGO:h6IRNta2fcaZpAED
TLSH
T13918CF06F74988AAECD674B8D50F5271AA203C4453A250DFBE06D7847E6B2E66F7D3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker defense_evasion discovery impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
40	raw.githubusercontent.com
41	raw.githubusercontent.com

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	org.orion.free

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	org.orion.free

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	org.orion.free

org.orion.free
1⤵
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4699
- getprop ro.build.selinux
  2⤵
  PID:4762
- getenforce
  2⤵
  PID:4787
- getprop ro.boot.selinux
  2⤵
  PID:4807
- getprop ro.build.flavor
  2⤵
  PID:4839
- getprop ro.board.platform
  2⤵
  PID:4861
- getprop init.svc.gce_fs_monitor
  2⤵
  PID:4882
- getprop init.svc.dempeventlog
  2⤵
  PID:4903
- getprop init.svc.dumpipclog
  2⤵
  PID:4965
- getprop init.svc.dumplogcat
  2⤵
  PID:4989

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

2c62cc1b66ceddce9494a5059d3f01ac.0.tmp

Path /data/data/org.orion.free/cache/http-cache/2c62cc1b66ceddce9494a5059d3f01ac.0.tmp
Size 8KB
SHA256 6ca5c662ab43954b9fd2f0495edcbf007ab95ebc4d2319152045851922ed01a1
MD5 f05a33a62bf8bc328127533c72470113
SHA1 cc8f59793428713f415cc9e4d62933585a38a9fb
SHA512 a1ea1beb0d4776e9e46539229c99c0f56df47a99acf3089f4f9d4887294e336ac02c201bc48a2af79e4f2afd07a866c77aff045302db1cdfcc3030a2a9b1a1db
SSDEEP 192:AvYbSbOJbikMwfYM1wqsv6TAF1kd92lrdH1RaGO1e0lpBNDIIX:iK3xfh1wdvOd9KVRaI0lpDIIX
TLSH
T1D9027B7C9F1239DD25C0F6E6CAAE97842854B24CF282D4DC0E203504D9972E9F8E9A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c62cc1b66ceddce9494a5059d3f01ac.1.tmp

Path /data/data/org.orion.free/cache/http-cache/2c62cc1b66ceddce9494a5059d3f01ac.1.tmp
Size 1KB
SHA256 e159f2a553a3bdb1089339babd41d1c10c7ec145f4a74fdf33f19f26a3dd0f75
MD5 23d6b3a926abd7d5c52c106b2d4e8ab5
SHA1 ed6e2d6a47c97f98e4b5b55973878ee2101adafb
SHA512 83f99f426b4836826e9e08c868f10b123c7e4738715ecd5c244bd78e300142c81207c947291f3486cd5ce53f3fffccc39b4b1c2fc3ab19c8bcf5a2a2a5b90bcf
TLSH
T168312A91C4222F60F7E63824CD1023838AAF06A10636B06E6A14898FF7F2E33170A038
MD5 SHA1 SHA512 TLSH

Submit Download

de9f2be108b70417f58fcbb419051eb8.0.tmp

Path /data/data/org.orion.free/cache/http-cache/de9f2be108b70417f58fcbb419051eb8.0.tmp
Size 6KB
SHA256 4be0d73de89fcde2b7a6019fe39d9aca67489f0fd0301499756a96db62619a74
MD5 0e34f22cb21d901ddfbd074897ddd774
SHA1 54c491bd6907ce37d159e778f00cf218b3c0894b
SHA512 2bb6dde68214a158414c66b428de854be1d7f5ffe4e0269a8a25e822cc9f6fe68d573a030e8a3ed199ebadc178fdd52da5d7a3b7eb2b48a41555b627c2e904df
SSDEEP 192:RdaPEhdt7iZ1fLUPUOZlozcr1e0lpBNDIIX:7Nhdt7UUPZloJ0lpDIIX
TLSH
T187D15BB58E101A1F2593C4ABCECB915529157B0BEEDAF6FE1E603001D4423B9B9E07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de9f2be108b70417f58fcbb419051eb8.1.tmp

Path /data/data/org.orion.free/cache/http-cache/de9f2be108b70417f58fcbb419051eb8.1.tmp
Size 1KB
SHA256 d4ded5351e207232a2fe09f9bc3f1cdf6ea5dbef399026bdba1d39152a2db706
MD5 07f7ff058724b52c9421eea77ea04fd4
SHA1 be4b0c93d40cfd3e350f9ad3a78930054ee0b369
SHA512 ddce99517e5c05487c5ba9bf26236b11be279e9dc30918d9fbb9c7898b29e9742ac804831cbefddf011c2cafdcad27a3d8965088b0352ddc010939c5191cdfe0
TLSH
T14331FF204BCE51AAC384B2C3CD182E0C759B10FFABA767061D959CBA25F3168C439A5A
MD5 SHA1 SHA512 TLSH

Submit Download

journal

Path /data/data/org.orion.free/cache/http-cache/journal
Size 250B
SHA256 689163f0828c4c82392c81a2eed38982e0ae1ab5576d2e63aaac1e42d074399d
MD5 8e98d1411430a40bbb8850c658b18b5f
SHA1 b6f754d6a1256d41010cd6ae4fd48830dcb9ab73
SHA512 8126cefd8b51858aed2e2e411da08c94e4e131412daa5e7275e2a3217049dc399f0970356dc92ecad4238a4340a13b215389c4ea32fe008081a416554a0fb68f
TLSH
T1D5D0A74E549C3CB2E994F1359AFC4A0E74FEA0BF28CDA082CCA4221920E604504496F4
MD5 SHA1 SHA512 TLSH

Submit Download

journal.tmp

Path /data/data/org.orion.free/cache/http-cache/journal.tmp
Size 36B
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
MD5 SHA1 SHA512

Submit Download

iZTgHNJ15oF-TqO7GPzNBi__Mao.2246573069159945569.tmp

Path /data/data/org.orion.free/cache/image_cache/v2.ols100.1/60/iZTgHNJ15oF-TqO7GPzNBi__Mao.2246573069159945569.tmp
Size 57KB
SHA256 fdf8ed15360d60a90befc611ea5179da619949c1f209a34b799972596f8c5518
MD5 22143b47faf345eedc9ed831a4eaa069
SHA1 37125672927c466bebc4503d0b3da7d342f7143a
SHA512 3987da98517f1445b4d316c9acefb59ed76e0baa37d491353472daf74b9e7506a691ec36d31d95b7c6aa57955c8cc15a546ca44042dede24fe3ecfa8377f92de
SSDEEP 1536:H1CLebnAm8YMPh8U68VxDEo5xiPAEYWhDwBksFsitLA:VyYAmIP2Ul7E7PIODfSa
TLSH
T1FE43F121EE02C991407DCA2EACFD81C5E3526F70D745A9E6EF8487169BD08F878583D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o8Hpqbft07KOIN5k4y33NZr_ANQ.785294080054629427.tmp

Path /data/data/org.orion.free/cache/image_cache/v2.ols100.1/84/o8Hpqbft07KOIN5k4y33NZr_ANQ.785294080054629427.tmp
Size 2.2MB
SHA256 0c5261803fd1fecec3e25c507977b21cfb259e1f721d921ff446b6e722bae738
MD5 fe48748e5f693966481a474b9dbd2d56
SHA1 020c04ccef2e30de6f4f1726a2bc6e9be806cd8f
SHA512 e85a1452f3865bf0cbfce63ea54c48743a0694ec8b31551d3a56dc03bbe6b9ccd96b913bcde21072901c19de636286e74b0215774f7e2063977597a87732316a
SSDEEP 49152:QVKN5nu+83YT/IUrEW05U0GiWunOL9xlrgiQw7mDyiWqB:QMN5uF3YTQo0xKowRiFB
TLSH
T189B5338C09CDF4790A65DDD6C34ACC911CD9217B8F792BF03215E5C562228E60AB7F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-storage

Path /data/data/org.orion.free/files/mmkv/app-storage
Size 256KB
SHA256 8a39d2abd3999ab73c34db2476849cddf303ce389b35826850f9a700589b4a90
MD5 ec87a838931d4d5d2e94a04644788a55
SHA1 2e000fa7e85759c7f4c254d4d9c33ef481e459a7
SHA512 9dd0c30167fbeaf68dfbbad8e1af552a7a1fcae120b6e04f1b41fa76c76d5a78922ff828f5cffd8c02965cde57d63dcbfb4c479b3cb49c9d8107a7d5244e9d03
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

app-storage.crc

Path /data/data/org.orion.free/files/mmkv/app-storage.crc
Size 4KB
SHA256 ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
MD5 620f0b67a91f7f74151bc5be745b7110
SHA1 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
SHA512 2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
MD5 SHA1 SHA512

Submit Download

tcb

Path /data/data/org.orion.free/files/tcb
Size 225KB
SHA256 7af5d3341bba8d605e92a7126b61663a111e269040760c9fa65bfb337fd7570b
MD5 28f0e67b63f5d95b774f94008c21ee4e
SHA1 89b2893210b75671f33f6fb2f75def5ff3cf6e48
SHA512 dcd4e8af9a39f612a659fe04aca89da08d688cc896d076952cbeecab810620aa92285d90fb4969a5ffb60aa821c52c99101629b7bbe6fcd55df0dc5299c4d1a9
SSDEEP 6144:4cRqlx9NFqI6FdZL52dTOgSQh1hV1A9W2Tp:4cCnd6fZL5mO41hXA9W6p
TLSH
T19A34AEEACF953D4A28F3E094C8AB027ED9198362DDDAB0B31D493845C78972D65FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/org.orion.free/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/org.orion.free/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 39eb1dda3053ecf3376cdddb07f6aabb6555de136f96d8b0efeff5d0a761d8fa
MD5 0a8bbdb76b4ea10ae3ba4b7a8eea3c28
SHA1 12d9f26731905e339a2314e165ff81df6ca1c892
SHA512 b1e27b844fe2f9b81e41ef75cac052a3a93ee07e7829ac206aaa794f1f8eb236dad411731b343b59ed2b603c4e82bbd3e38d73a7a084df9b8274a70dd0295590
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/org.orion.free/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/org.orion.free/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 8ecbd499bd5100014e77bf834f4f80658961523faee973d7bcbfacbcb2e52919
MD5 6e7fd231b2f4cd27f3b4a12476e25feb
SHA1 90c2b2c215be37c5ccf551f0cc37fc1c776e91b2
SHA512 d5781c9ff155200515fedfc59e83685bfbb4d522dae3f536e6e20ade340916e69fd1fcceb9c245e80c680dd3f867c4bb26aeb96275770ccf7ab4c161c7117b93
SSDEEP 6:KOdmpZ3mWWsi6l9FZde/kPlOERX4PBX4ogLugMBX4suuK+/cme//U+ySLiOw2:Ky+ZCxQzdeWRmBEyPbP/cZ//U9SWOw2
TLSH
T10972C28497CC2652C19AC33370CC83F50DE9AA1D6F53C74B7B911C60AC01BC89450D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/org.orion.free/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 6506bea1d523f0ca3b9f3d72306afca5fd54f6cab8f0a404c923725060bb825e
MD5 56bfa93063298f86ef1f1e42d5273d72
SHA1 364a1b9835bf2efd2e25c123f43a87f839309033
SHA512 0726cbceebd5af4923f1958a10b0c51e393c9ad519eb3cb46fbf23a460bb2f19aaebe81cec2b83e9fba7982fce995d6c2ab81028dad213942990b95051cf402d
SSDEEP 96:H396CWSDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:t6CXndjnHt9S/f8JzSV+6D86T0ED
TLSH
T19DB3028E0F9D3600C0EAA4B0A5900FF1797E452E9B93E3D17A914475EDC2E21DE25CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads