Resubmissions

10/10/2026, 15:24

261010-std2paev6p7

10/10/2026, 15:23

261010-ssza8sev4p8

Analysis

  • user interaction
    yes
  • max time kernel
    73s
  • max time network
    65s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    10/10/2026, 15:24

General

  • Target
    config_service_core_v0.4.43.apk
  • Size 4.8MB
  • Sample261010-std2paev6p
  • SHA256 00ad39e539d63dc56073d8970925fc8fffc6cc0f45849b73430a569f14266e04
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
  • Reads the content of the SMS messages. 1 TTPs 1 IoCs
  • Reads the content of the call log. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Makes a phone call. 1 TTPs 1 IoCs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.sec.android.app.sysupdate:system_core
    1⤵
    • Makes use of the framework's Accessibility service
    • Reads the contacts stored on the device.
    • Reads the content of the SMS messages.
    • Reads the content of the call log.
    • Acquires the wake lock
    • Makes a phone call.
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:3348
  • com.sec.android.app.sysupdate:remote
    1⤵
      PID:3575

    Network

          MITRE ATT&CK Mobile v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          base.3348.tmp

          • Path /data/data/com.sec.android.app.sysupdate/cache/oat_primary/x86_64/base.3348.tmp
          • Size 148KB
          • SHA256 81290b01b73c13403e075ae588b821f9fa8b471ce96f9212d5168eb0596baf1d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cache_video.mp4

          • Path /data/data/com.sec.android.app.sysupdate/files/cache_video.mp4
          • Size 80KB
          • SHA256 1258cc4c1bcb54f0212551f9782b1747dff827215ee312c4cd04c26403f7072d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cache_video.mp4

          • Path /data/data/com.sec.android.app.sysupdate/files/cache_video.mp4
          • Size 23KB
          • SHA256 7d5873d5424ae31139a2c80028ecd2bd27f9356c060bf43f19cb2307d01c356c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cache_video.mp4

          • Path /data/data/com.sec.android.app.sysupdate/files/cache_video.mp4
          • Size 12KB
          • SHA256 6d94ba2d9401a0d220158c25f031be8ab7ea5ee89c56268f857dea6a0883d255
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cache_video.mp4

          • Path /data/data/com.sec.android.app.sysupdate/files/cache_video.mp4
          • Size 2.3MB
          • SHA256 2c43b9f6314e70089019eb39b17866590f3513b8bbbf9cb7c2578aabc52a5f84
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cache_video.mp4

          • Path /data/data/com.sec.android.app.sysupdate/files/cache_video.mp4
          • Size 2.0MB
          • SHA256 32e132038c56d4c39ec31b0a585c4ea4ae1cde0d751723be3529a1d82361c61d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          profileInstalled

          • Path /data/data/com.sec.android.app.sysupdate/files/profileInstalled
          • Size 24B
          • SHA256 f3dec31983973dc5b392044e1b0470fc82199111cf2f4287e3c47144f9b069e2
          • MD5 SHA1 SHA512

          profileinstaller_profileWrittenFor_lastUpdateTime.dat

          • Path /data/data/com.sec.android.app.sysupdate/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
          • Size 8B
          • SHA256 621a50d042e295a1985a01848fecd30ca3d85776cbc7795e960c5c426dc4ec92
          • MD5 SHA1 SHA512

          androidx.work.workdb

          • Path /data/data/com.sec.android.app.sysupdate/no_backup/androidx.work.workdb
          • Size 4KB
          • SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
          • MD5 SHA1 SHA512 TLSH

          androidx.work.workdb-journal

          • Path /data/data/com.sec.android.app.sysupdate/no_backup/androidx.work.workdb-journal
          • Size 512B
          • SHA256 94ca3d8267843d8b25048ab6194fe04983ab2a4ad3838b9655946f484c608f09
          • MD5 SHA1 SHA512

          androidx.work.workdb-shm

          • Path /data/data/com.sec.android.app.sysupdate/no_backup/androidx.work.workdb-shm
          • Size 32KB
          • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
          • MD5 SHA1 SHA512 SSDEEP

          androidx.work.workdb-wal

          • Path /data/data/com.sec.android.app.sysupdate/no_backup/androidx.work.workdb-wal
          • Size 16KB
          • SHA256 8cd0218a4241f8272c8fd75418d32d8399884c93e5fb31206cb8b80dbd692b07
          • MD5 SHA1 SHA512 SSDEEP TLSH

          androidx.work.workdb-wal

          • Path /data/data/com.sec.android.app.sysupdate/no_backup/androidx.work.workdb-wal
          • Size 116KB
          • SHA256 9d4640d78a91c8a2c679dfa3bff312e44c97e7e1ba7cb38d90bb72aa011eaf27
          • MD5 SHA1 SHA512 SSDEEP TLSH

          primary.prof

          • Path /data/misc/profiles/cur/0/com.sec.android.app.sysupdate/primary.prof
          • Size 1KB
          • SHA256 06f6417c17801da76d8e689c8d29099b4b3d8b13c42b77c8483966ca07295226
          • MD5 SHA1 SHA512 TLSH

          primary.prof.b8GvvJ.tmp

          • Path /data/misc/profiles/cur/0/com.sec.android.app.sysupdate/primary.prof.b8GvvJ.tmp
          • Size 2KB
          • SHA256 5a8ee10b409b0e8d486ce3e837fc2a93ee2427a2095f02dd57781390ee906105
          • MD5 SHA1 SHA512 TLSH

          z1

          • Path /data/user_de/0/com.sec.android.app.sysupdate/databases/z1
          • Size 72KB
          • SHA256 199f996be2a506eccf89a862380531d5aeb2603fffe12e2dc24bfce27ef37bb8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          z1-journal

          • Path /data/user_de/0/com.sec.android.app.sysupdate/databases/z1-journal
          • Size 512B
          • SHA256 0d1d25bb4d7e6f493bee1945d4fed9d9c5991bd885e4f0b6bae5338daf215676
          • MD5 SHA1 SHA512

          z1-journal

          • Path /data/user_de/0/com.sec.android.app.sysupdate/databases/z1-journal
          • Size 8KB
          • SHA256 c0cabd2dabd8fa5d4b066b6dbb7643502bc3cdf42931b1ff4dae7a5e17a4e246
          • MD5 SHA1 SHA512 SSDEEP TLSH

          z1-journal

          • Path /data/user_de/0/com.sec.android.app.sysupdate/databases/z1-journal
          • Size 8KB
          • SHA256 c8599fda4c45a4d121c898f084eaa76b7b2f4d32d569b813178f268333817607
          • MD5 SHA1 SHA512 SSDEEP TLSH

          z1-journal

          • Path /data/user_de/0/com.sec.android.app.sysupdate/databases/z1-journal
          • Size 4KB
          • SHA256 672d1943bc90f460cf8d36d29330005f32a2fd3692c5228a71d0ecb61e2c1487
          • MD5 SHA1 SHA512 SSDEEP TLSH

          z1-journal

          • Path /data/user_de/0/com.sec.android.app.sysupdate/databases/z1-journal
          • Size 4KB
          • SHA256 d03db444e927f8af64314af9f64a637c53cfd8c630002ed35c23dc63ffe6323e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          z1-journal

          • Path /data/user_de/0/com.sec.android.app.sysupdate/databases/z1-journal
          • Size 12KB
          • SHA256 431b9184f2c7bb1cd9e9ee195cd972e7765dcd76db9c176df4f0f6d6ce295515
          • MD5 SHA1 SHA512 SSDEEP TLSH

          z3

          • Path /data/user_de/0/com.sec.android.app.sysupdate/databases/z3
          • Size 20KB
          • SHA256 6e96964af0d29fdfd976086b1f9509c9231f47c2373ccdae826ccd46137990ed
          • MD5 SHA1 SHA512 SSDEEP TLSH

          z3-journal

          • Path /data/user_de/0/com.sec.android.app.sysupdate/databases/z3-journal
          • Size 8KB
          • SHA256 8adc9c9aeb1633601b6b6c037b35848b10b1f434babc7508493a3d5b0d643782
          • MD5 SHA1 SHA512 SSDEEP TLSH

          z3-journal

          • Path /data/user_de/0/com.sec.android.app.sysupdate/databases/z3-journal
          • Size 4KB
          • SHA256 5bedb0f48cc37881bf632b2e60d68940ad3a7a239252d835bbbec43eb46e06c1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          z3-journal

          • Path /data/user_de/0/com.sec.android.app.sysupdate/databases/z3-journal
          • Size 4KB
          • SHA256 706d224bc46fc616d6f6e08839ab63aa21cb8ba9600b8412ffe842acac62ade5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          z3-journal

          • Path /data/user_de/0/com.sec.android.app.sysupdate/databases/z3-journal
          • Size 512B
          • SHA256 7251fed2529e8fb24afd66e5d7954baccec37c052853a66bb4e73d980a562fd5
          • MD5 SHA1 SHA512

          z3-journal

          • Path /data/user_de/0/com.sec.android.app.sysupdate/databases/z3-journal
          • Size 8KB
          • SHA256 34fba19dfb5d35056bcb324fb66b9d23ef98b5f651c1d6de5058cae123315064
          • MD5 SHA1 SHA512 SSDEEP TLSH