Analysis

  • max time kernel
    107s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260325-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
  • submitted
    12/10/2026, 23:08

General

  • Target
    jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
  • Size 1.8MB
  • Sample261012-243bpsyt4q
  • SHA256 91a50aacc28bba0f631f4611a7a455a903dc378b96473b47cacceb73d658406c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks Android system properties for emulator presence. 1 TTPs 6 IoCs
  • Checks Qemu related system properties. 1 TTPs 5 IoCs

    Checks for Android system properties related to Qemu for Emulator detection.

  • Loads dropped Dex/Jar 1 TTPs 11 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
  • Reads the content of the SMS messages. 1 TTPs 1 IoCs
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests dangerous framework permissions 25 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.hssd.sbvoa
    1⤵
    • Loads dropped Dex/Jar
    • Reads the content of SMS inbox messages.
    • Reads the content of the SMS messages.
    • Requests cell location
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4292
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hssd.sbvoa/app_Wyzf_plg/5.0.9.jar --output-vdex-fd=49 --oat-fd=52 --oat-location=/data/user/0/com.hssd.sbvoa/app_Wyzf_plg/oat/x86/5.0.9.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4343
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hssd.sbvoa/files/new_md.jar --output-vdex-fd=103 --oat-fd=104 --oat-location=/data/user/0/com.hssd.sbvoa/files/oat/x86/new_md.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4446
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hssd.sbvoa/app_dex/utopay.jar --output-vdex-fd=107 --oat-fd=109 --oat-location=/data/user/0/com.hssd.sbvoa/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4484
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hssd.sbvoa/files/Plugin2.apk --output-vdex-fd=107 --oat-fd=109 --oat-location=/data/user/0/com.hssd.sbvoa/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4508
    • service list
      2⤵
        PID:4532
      • getprop
        2⤵
        • Checks Android system properties for emulator presence.
        • Checks Qemu related system properties.
        PID:4552
      • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hssd.sbvoa/files/yf.apk --output-vdex-fd=112 --oat-fd=113 --oat-location=/data/user/0/com.hssd.sbvoa/files/oat/x86/yf.odex --compiler-filter=quicken --class-loader-context=&
        2⤵
        • Loads dropped Dex/Jar
        PID:4577

    Network

          MITRE ATT&CK Mobile v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          5.0.9.jar

          • Path /data/data/com.hssd.sbvoa/app_Wyzf_plg/5.0.9.jar
          • Size 50KB
          • SHA256 611bbbd83419cac7976482fefa632fbb138332fb1cebc494f114787b66ade248
          • MD5 SHA1 SHA512 SSDEEP TLSH

          utopay.jar

          • Path /data/data/com.hssd.sbvoa/app_dex/utopay.jar
          • Size 30KB
          • SHA256 d5c57482245f9caf63cfae312978e8d38d0185cc3161f1f16dc4d3da91b6983b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          740410100062013

          • Path /data/data/com.hssd.sbvoa/databases/740410100062013
          • Size 4KB
          • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
          • MD5 SHA1 SHA512 TLSH

          740410100062013-journal

          • Path /data/data/com.hssd.sbvoa/databases/740410100062013-journal
          • Size 512B
          • SHA256 14faf9ee91c1f021369b6f6e6c45485b01c6734557e1ffdc5ce8aa116252f920
          • MD5 SHA1 SHA512

          740410100062013-wal

          • Path /data/data/com.hssd.sbvoa/databases/740410100062013-wal
          • Size 160KB
          • SHA256 af588d929942d95ee9eb11c1edf6624d85063641de5681d4fcf083ec2837641b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          DD.db

          • Path /data/data/com.hssd.sbvoa/databases/DD.db
          • Size 20KB
          • SHA256 10975dcca48744c40859197d891a3a33493d00f866c317ce7ee818b7c74ede12
          • MD5 SHA1 SHA512 SSDEEP TLSH

          DD.db-journal

          • Path /data/data/com.hssd.sbvoa/databases/DD.db-journal
          • Size 512B
          • SHA256 bd3bd27e733767f723660e664d05a3d17e520ede59a9de51069282d642626e98
          • MD5 SHA1 SHA512

          DD.db-wal

          • Path /data/data/com.hssd.sbvoa/databases/DD.db-wal
          • Size 40KB
          • SHA256 678ae7d788f4c49de567213278b78ad1296705e0d3ee2d3446bb03327d8d8872
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cc.db

          • Path /data/data/com.hssd.sbvoa/databases/cc/cc.db
          • Size 36KB
          • SHA256 7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
          • MD5 SHA1 SHA512 SSDEEP

          cc.db

          • Path /data/data/com.hssd.sbvoa/databases/cc/cc.db
          • Size 36KB
          • SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cc.db-journal

          • Path /data/data/com.hssd.sbvoa/databases/cc/cc.db-journal
          • Size 512B
          • SHA256 14c1ad74c230488eca52e98a17aedac9fc45626084f1233c31d2af7729ccf4de
          • MD5 SHA1 SHA512

          cc.db-wal

          • Path /data/data/com.hssd.sbvoa/databases/cc/cc.db-wal
          • Size 16KB
          • SHA256 e2afb2ac6640c02b530d26ff558d8e8e719578c1431b3efd95ce063c6b0e0da7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cc.db-wal

          • Path /data/data/com.hssd.sbvoa/databases/cc/cc.db-wal
          • Size 48KB
          • SHA256 30437aa6ee6f108f725a3228c29884cb5eda2078aa813af107fbd49b2b65e1b8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          flyou

          • Path /data/data/com.hssd.sbvoa/databases/flyou
          • Size 44KB
          • SHA256 d6e4da9d6ef70d6cf7b550a6446a8bce843ef397c1df2f0c6551881853e0403e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          flyou-journal

          • Path /data/data/com.hssd.sbvoa/databases/flyou-journal
          • Size 512B
          • SHA256 d5ae088e5ac7e998ef723217ca80b9b6417d41444696a7e7db14339a6615fbfb
          • MD5 SHA1 SHA512

          flyou-shm

          • Path /data/data/com.hssd.sbvoa/databases/flyou-shm
          • Size 32KB
          • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
          • MD5 SHA1 SHA512 SSDEEP

          flyou-wal

          • Path /data/data/com.hssd.sbvoa/databases/flyou-wal
          • Size 56KB
          • SHA256 edffbe3692b524e320eee440bcead9994339887c5e82e08a7bc5a7b0ee1d376a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mhzb.db-journal

          • Path /data/data/com.hssd.sbvoa/databases/mhzb.db-journal
          • Size 512B
          • SHA256 92a2272efcf8255f9b9c4054fc64ab3334d49b7fc86c479c3280267db2c0a47d
          • MD5 SHA1 SHA512

          mhzb.db-wal

          • Path /data/data/com.hssd.sbvoa/databases/mhzb.db-wal
          • Size 20KB
          • SHA256 3b2d23307e6fceb7dad0d638da5deb9532559707844b04cc2a1f660798c2393f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          utopay.db

          • Path /data/data/com.hssd.sbvoa/databases/utopay.db
          • Size 20KB
          • SHA256 bd2d3cf4e172b0edeb01e5606df3b2e7300215ea39414a1cc3a7b67c9a41bda3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          utopay.db-journal

          • Path /data/data/com.hssd.sbvoa/databases/utopay.db-journal
          • Size 512B
          • SHA256 300433177988e6535b0242f662a688291b1c31e279172c0e40c126ab9b4ae64c
          • MD5 SHA1 SHA512

          utopay.db-wal

          • Path /data/data/com.hssd.sbvoa/databases/utopay.db-wal
          • Size 32KB
          • SHA256 8a900219954dac34445b25273a32c3cd014cadec7f10c12dde339f5b9682b2aa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          .imprint

          • Path /data/data/com.hssd.sbvoa/files/.imprint
          • Size 1003B
          • SHA256 1f7603a46d0d6b278cd7d76886a8e232b9e989ddd33d729f1f720557ec35c43e
          • MD5 SHA1 SHA512 TLSH

          exchangeIdentity.json

          • Path /data/data/com.hssd.sbvoa/files/.umeng/exchangeIdentity.json
          • Size 162B
          • SHA256 7698c12b2ed059af0a993bfbd60a9022c61bdcd5189e2330639456c6de1344e7
          • MD5 SHA1 SHA512 TLSH

          Plugin2.apk

          • Path /data/data/com.hssd.sbvoa/files/Plugin2.apk
          • Size 96KB
          • SHA256 77ff63fc4125b3c1bf970feb1722e02cf43c9c4d6abeff4b2cccb6a9e55a51ef
          • MD5 SHA1 SHA512 SSDEEP TLSH

          exid.dat

          • Path /data/data/com.hssd.sbvoa/files/exid.dat
          • Size 59B
          • SHA256 23a1f83fd48bad935cad36e8ba4b5d6a3e4a20462d27968a4517b5ccded161b1
          • MD5 SHA1 SHA512 TLSH

          log.dat

          • Path /data/data/com.hssd.sbvoa/files/log.dat
          • Size 161B
          • SHA256 ad98139da19a5223a55fcc9af3169a3931ca9a735d43167d764097864520f651
          • MD5 SHA1 SHA512 TLSH

          new_md.jar

          • Path /data/data/com.hssd.sbvoa/files/new_md.jar
          • Size 36KB
          • SHA256 001c2f29557e000d84b6f586fb54ffc2c501c7d749a89540db796891b3021279
          • MD5 SHA1 SHA512 SSDEEP TLSH

          umeng_it.cache

          • Path /data/data/com.hssd.sbvoa/files/umeng_it.cache
          • Size 415B
          • SHA256 b2555354e089a60d991b02144f0055d2ec59b04372c27164b93201281f854044
          • MD5 SHA1 SHA512 TLSH

          umeng_it.cache

          • Path /data/data/com.hssd.sbvoa/files/umeng_it.cache
          • Size 211B
          • SHA256 219f6630645923674e2a6d552be098364c1ff1424832a4d9231c374b1ef51a8d
          • MD5 SHA1 SHA512 TLSH

          yf.apk

          • Path /data/data/com.hssd.sbvoa/files/yf.apk
          • Size 59KB
          • SHA256 57133431ec20e515d72a3905c8618e31d6a132ac74f7841380b946bdef586f52
          • MD5 SHA1 SHA512 SSDEEP TLSH

          5.0.9.jar

          • Path /data/user/0/com.hssd.sbvoa/app_Wyzf_plg/5.0.9.jar
          • Size 112KB
          • SHA256 1cc01275ac67d4f0bb70cc1156d4b199e8a74805a1528fd08dd2918450988718
          • MD5 SHA1 SHA512 SSDEEP TLSH

          5.0.9.jar

          • Path /data/user/0/com.hssd.sbvoa/app_Wyzf_plg/5.0.9.jar
          • Size 112KB
          • SHA256 02a5ef69d0967cc0310f315c2340fc8b088ab89d0320227a30cb58229319c034
          • MD5 SHA1 SHA512 SSDEEP TLSH

          utopay.jar

          • Path /data/user/0/com.hssd.sbvoa/app_dex/utopay.jar
          • Size 66KB
          • SHA256 3b00f99e69a9b0cc2a58faf52e8169f99fdf15330d810c484ef81d6e0a8ec17b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          utopay.jar

          • Path /data/user/0/com.hssd.sbvoa/app_dex/utopay.jar
          • Size 66KB
          • SHA256 c9dda4e71a7152be8edc8fab7489894d976faab37f63f93490e8adc2062d5d3f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Plugin2.apk

          • Path /data/user/0/com.hssd.sbvoa/files/Plugin2.apk
          • Size 206KB
          • SHA256 2e80dd205ff415e530a217310fb52a9f97cdcf5db3c9f0b1e0401663cd00011f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Plugin2.apk

          • Path /data/user/0/com.hssd.sbvoa/files/Plugin2.apk
          • Size 206KB
          • SHA256 1f60ae0f7ca558ee9b0a6745881b7123925e603afbb4ec0ea1c973c38e659901
          • MD5 SHA1 SHA512 SSDEEP TLSH

          new_md.jar

          • Path /data/user/0/com.hssd.sbvoa/files/new_md.jar
          • Size 83KB
          • SHA256 04bd4f9aafc801876a326b24499c5fc332a74fe6d0247790fada3e9df815702f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          new_md.jar

          • Path /data/user/0/com.hssd.sbvoa/files/new_md.jar
          • Size 83KB
          • SHA256 0afa5f48b018da2ed56bbad69011cfb2187944df5489b916d298bd960f4589e3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          yf.apk

          • Path /data/user/0/com.hssd.sbvoa/files/yf.apk
          • Size 137KB
          • SHA256 01afa31859896fb68696a3a872705133c171bf6b65c66d7a21f2a4afca76a2d5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          yf.apk

          • Path /data/user/0/com.hssd.sbvoa/files/yf.apk
          • Size 137KB
          • SHA256 75e56e086b477dba5e717e2a40a0045e9893b2a320416ab1d4110cd47d48a512
          • MD5 SHA1 SHA512 SSDEEP TLSH

          com.hssd.sbvoa

          • Path /storage/emulated/0/com.hssd.sbvoa.start.times/com.hssd.sbvoa
          • Size 77B
          • SHA256 8d8103c88557bcf6dc06f9e44b45ab3412c333fce6e22380a91de610d3eafd05
          • MD5 SHA1 SHA512 TLSH