Analysis
- max time kernel
34s - max time network
151s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system - submitted
12/10/2026, 23:24
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
BDTX140.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral3
Sample
BDTX140.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral4
Sample
BDTX140.apk
Resource
android-x64-arm64-20260325-en
General
- Target jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
- Size 2.0MB
- Sample261012-3dphlayw7k
- SHA256 1bf319d9b18025a94f7f0ca8c36a3eaa75fddda4c282a29c517ce091a91397dc
- MD5 96674b4e87dba2d4488b75d4f2dfff6d
- SHA1 1cdf868bfbad9efaa75e0773e1e9701b0d15d863
- SHA512 bdee28e392b71a4f1286e49cfb9c95280d17710e2a2be21e03b533ae3fabcf4ff1f9f81cd7665942ffbc0d47c234b6bf3347bc8af43300ba9a280445c97a7252
- SSDEEP 49152:byDumC0u/h37h4mkZNIg0I1j9yb86uIFjMZ+G:+ShT/x7h4mypbTyym4
- TLSH T10195235BF740D66BC1B3A039B25B21C663358D589766570B1F24F23C2BF76C68B26B80
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
description ioc Process Accessed system property key: ro.hardware com.wcs.bpncuf - Loads dropped Dex/Jar 1 TTPs 6 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.wcs.bpncuf/files/ya/uAcjOZkI.jar 4288 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wcs.bpncuf/files/ya/uAcjOZkI.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.wcs.bpncuf/files/ya/oat/x86/uAcjOZkI.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.wcs.bpncuf/files/ya/uAcjOZkI.jar 4261 com.wcs.bpncuf /data/user/0/com.wcs.bpncuf/files/Plugin2.apk 4382 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wcs.bpncuf/files/Plugin2.apk --output-vdex-fd=58 --oat-fd=59 --oat-location=/data/user/0/com.wcs.bpncuf/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.wcs.bpncuf/files/Plugin2.apk 4261 com.wcs.bpncuf /data/user/0/com.wcs.bpncuf/files/yl_plugin.apk 4422 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wcs.bpncuf/files/yl_plugin.apk --output-vdex-fd=77 --oat-fd=78 --oat-location=/data/user/0/com.wcs.bpncuf/files/oat/x86/yl_plugin.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.wcs.bpncuf/files/yl_plugin.apk 4261 com.wcs.bpncuf - Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://sms/inbox com.wcs.bpncuf - Reads the content of the SMS messages. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://sms/ com.wcs.bpncuf - Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.wcs.bpncuf - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.wcs.bpncuf - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.wcs.bpncuf - Requests dangerous framework permissions 17 IoCs
description ioc Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Required to be able to access the camera device. android.permission.CAMERA Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.wcs.bpncuf - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.wcs.bpncuf
Processes
-
com.wcs.bpncuf1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4261 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wcs.bpncuf/files/ya/uAcjOZkI.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.wcs.bpncuf/files/ya/oat/x86/uAcjOZkI.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4288
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wcs.bpncuf/files/Plugin2.apk --output-vdex-fd=58 --oat-fd=59 --oat-location=/data/user/0/com.wcs.bpncuf/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4382
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wcs.bpncuf/files/yl_plugin.apk --output-vdex-fd=77 --oat-fd=78 --oat-location=/data/user/0/com.wcs.bpncuf/files/oat/x86/yl_plugin.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4422
-
-
getprop ro.product.cpu.abi2⤵PID:4442
-
-
getprop ro.product.cpu.abi22⤵PID:4463
-
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.wcs.bpncuf/databases/wochi_v4.db
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- TLSH T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.wcs.bpncuf/databases/wochi_v4.db-journal
- Size 512B
- SHA256 b153d1a9dd7f60d457e3dfe88bc0d37db2ac4ddb351106cba93843bfba369554
- MD5 41b476c11bceb1e70974d14bf8ed113c
- SHA1 ab13fe50ad79bcb4da746536c4cecfef88ad0cad
- SHA512 66b5146907f318ce54d6c08f9de7f84075f777b5f05c1fd0bd5870af6e04b9e33ead39c5b05dcc3c13f55ccdc93f447abba3740601fd4a13ce81de7624d6e4ec
- MD5 SHA1 SHA512
- Path /data/data/com.wcs.bpncuf/databases/wochi_v4.db-shm
- Size 28KB
- SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
- MD5 cf845a781c107ec1346e849c9dd1b7e8
- SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
- SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.wcs.bpncuf/databases/wochi_v4.db-wal
- Size 20KB
- SHA256 0e19c420d36cf571a6c7800033930483f440873184de09f13f7b716b4232ecde
- MD5 d3427e477d782271ad01af6dad5f8cd9
- SHA1 5d14b0d5151209ea70d986b63a9c18c9788d1ab7
- SHA512 59b2923bf03a7de60ba7f178fdadbbdbe54e495b90a2c7b7da542021e0c89c1eea706ba14261ecf63731dd0f832644937d454cdd2e7762362b12d9d0fc8bc837
- SSDEEP 12:Kr/fzdTRmBEyPbP/YwKb/9rK+OwCldjK5zqDRmBEyPbV:KrHzyGSP/H4BEjIzDGSV
- TLSH T1EE92A74AAB8C0D53C119437354E8C3959DB19F2DA763C75B1A6156657C43BCCA4A0F88
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wcs.bpncuf/files/Plugin2.apk
- Size 99KB
- SHA256 de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c
- MD5 3d216f8fddb9705a6720a285475837f1
- SHA1 f053d23b284bfe2faf6e76d353ff052471e2de2c
- SHA512 38be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb
- SSDEEP 3072:O/hr91fY/9tdWXLqQRClwYJ4sAAq4/IZn8NxQNRmDJS:2B9NMDGLqofsAAbNI8g
- TLSH T130A302021B29DD42D537903648558B26B23AB62BEDF6F32A1E63D36D3083DC8CB33549
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wcs.bpncuf/files/log.dat
- Size 221B
- SHA256 77fc3599be409f7e73e643de843c0ebcfa20662964c498fc59e245c7f5e003a2
- MD5 ff9229f8e7c92d44d48e25206d43b021
- SHA1 be3d75050c16c5b7484652ba292fdd6510f205d3
- SHA512 be7b3aa8d670a2873c6b7bfd4ca93121fd2450723cbbc36d9d06d152fafa3ce90451f0a60ab56bc96bccb81cf5aae0167b404073db14dc17b9513ac73d455c58
- TLSH T152D0976200094CC1A048B30CA835C6E9F060285304090098B21B06086A223F0B2AE909
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.wcs.bpncuf/files/ya/uAcjOZkI.jar
- Size 963KB
- SHA256 b40bd1fbd0ba6983f457d74f896d86c3bf82d00b3ed0c3be430f8b9e628e0e59
- MD5 27cebf12732670efc65db9ae9d87710c
- SHA1 712bf945f6721248ea7b7dc21883fea40a66ccc9
- SHA512 7d98df1debf2da06f55e7ff30d3b83130d3d1607aa3c2d8e2ba7e2a6b854b3bf0f4a78cc31c83df72ac64dc4a2ce937cf897eca48de8bc68c38e72c2230a26a5
- SSDEEP 24576:ywkw/091qkFfMhGnoY5XGLFXpxf3GY/6Qm0AmR3:ybgO7fMhjYJGLFXppGY/6QmLY3
- TLSH T1C32533C424DBD6915461939A4E009CF6823091D19E6B4B8E53AEF747F7F867182E02FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wcs.bpncuf/files/yl_plugin.apk
- Size 58KB
- SHA256 05eb3e1ca331b8c6a1f60f92abb2bddbac54a7b2c229ac07bf26c756297fe72a
- MD5 5a4c666b43ee7f2b6995aaf3527e4a4d
- SHA1 b205bcb022797f3b16635db139c7524c0c388adc
- SHA512 c84fceddbf9928110fc3b85e0989b9cedd06383007ff99dea5a25096d8f892ab52d30ed9b52b72211449041f1274ead85bb42929ec269b58b6b0e616a8545e17
- SSDEEP 1536:D0L/5wazYVM3W7ymXFSRJcL7KIBOWNMunou3faONts:D0z5vcKG7BXsRJcL7gW+ul3a
- TLSH T1984302F14FECB302C166B5391F95E6AFBE9ACD4496B4719B4106A0A8F4D885C42EF02C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.wcs.bpncuf/files/Plugin2.apk
- Size 201KB
- SHA256 1d83642ede6b16a071676e895f547d056543b5b4622bbc9b9b4ab45e47bf9ba0
- MD5 ef019d14367b7346b1ae2419e9d445c8
- SHA1 23d81fcf81f3a9f2a991ba4d0d135fe2a28aa188
- SHA512 ea582f21c6054c37c679c798e93116c9c18c9544c0feb78fb949bed7b2cd3122c8d7bb8ecef329829c2531764abeb6200f0af49ede97c3b0b7448bdb65a34a60
- SSDEEP 3072:1kVF+ursMg5xMFLchcmdbaNiikyqW+q7JDcN6W:1kVVrsMg5x6AhndcfxaV
- TLSH T1D9143C4BA555F877ED6BAB3284E34F40BB32E2952B13674B2048C1B6FCC77858E4D984
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.wcs.bpncuf/files/Plugin2.apk
- Size 201KB
- SHA256 2c61a25f1ad5783bf82eea9faa2536cac4788ed3147bc1864d9ef17ea01be6a7
- MD5 2a425e0fae74f20a2c475da937a619a2
- SHA1 4d701c7e6d828aa96ba8a493720e7282c49ec741
- SHA512 44c8d2a837b606de99055badbd4b5e708424ca9809b1583d13aefadc4d4af974658dc3a3f179fc3047eef7167151c638ff66dd6c8d38121b6ecdfb464d2a5a60
- SSDEEP 3072:1kVF+urNfpK7fagHwanMuBwQS/EdaHgqW+q7JDcN6W:1kVVrNfQ7fHwiBgm3xaV
- TLSH T1CC144A52D9C9B8E6FCBBA23A54E347017F31E659772B57471448C1B2BDC23838E8E984
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.wcs.bpncuf/files/ya/uAcjOZkI.jar
- Size 2.3MB
- SHA256 a05797b6e7a2c201884d764388b4489fa218a17ef936b326772d5f3f6d1dea3d
- MD5 d516a58cc9fab125ab019487e2cf09ec
- SHA1 28e003e2782645d97935e0b4d8a9a2f7159c80c9
- SHA512 9eda54adabe292bfce258de72bcf58e90684b36dc827cb183f9a78d36c907108c1e8da7f5616b0f8f5148ad89070bcabfe0cebf82d2b23ea3a2a220056273610
- SSDEEP 24576:R/DwUymgGe5FGAcut/oaRhjlz7Wk/zz+Xt:tN4MAcubzjlz7WkU
- TLSH T17AB56B17A5120A33C56C5B3380B74BC56737A2012F53CB572508A6B9FDC76CADBAF298
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.wcs.bpncuf/files/ya/uAcjOZkI.jar
- Size 2.3MB
- SHA256 cb6512559e3c4f03a3f06ef61182c000809abb258f84b7735776591f7310c482
- MD5 7c4c662ed59822f6f1b0a5dcb9749374
- SHA1 968d9176e4c671aedf7383ebdec9044dc6614187
- SHA512 91272a3459965d1a8c0516e4fd6a7fe4453fcf98e976c74c957cff4d34be5ca7c20c60750b5d0538493f2039034bae5488fc2b68caf0ca067c71971622bcb2e6
- SSDEEP 24576:R/DwUymgGe5FGOzmkbxKx15J8Qdjlz7Wk/zz+Xt:tN4MOCqxe5Jndjlz7WkU
- TLSH T135B58D1799528D33C5BC533A60FB4780777267046B538B972109E6B8DE432EBDBDE288
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.wcs.bpncuf/files/yl_plugin.apk
- Size 123KB
- SHA256 87751b4f40f3cf03b3e2a1e5eb9ef248ad79a8f47304d2a527939ed634ac8f2c
- MD5 9fc68c74fcdf2ca6c0252ed39de275f0
- SHA1 84438de24f01ade937d2f1a0f70c797e616b7199
- SHA512 10feb413b7a89f92339dd1d1a9538fdb22009279778d985f6649faf0af7cd1d5998adff439cad6b99ec2aade6b235b72385a83d9943e5b5898eb7ecdd7a398e8
- SSDEEP 3072:9z9mTBK0rBe+6zH7roW8IHpPJm8WnDts9WQB:6k0rBe+6zH7roW/pxlZ1B
- TLSH T155C34A03F3955523FAAD4F3248F38BC1E322E8516A939783118497BDFC963E25F5A588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.wcs.bpncuf/files/yl_plugin.apk
- Size 123KB
- SHA256 57d03ac2189851d5069515da6997e12ca307c145aa21679da001477df5f81836
- MD5 918890b3fc5a3dc184a57d027ead24da
- SHA1 c638f375f49bc4731b633bdc001aeeadf9462039
- SHA512 fd9bfe41ce4041dc8c7db17df2a2164a24ea96372c212399c499f94d1fb7d95d430b8a7eb86041b9b2db88dfca0cf39e53cba2dad1e346aebed29e4ca5deb2ef
- SSDEEP 3072:9z9mTBIMIPxpL1FBeznUmushBZWrTmFiYVj5y1zm8WnDts9WQB:6tVj5ylZ1B
- TLSH T1C8C35903F7999A22FDEC893924E29780A331FC15A95797435189D3FEFC467E34D8A488
- MD5 SHA1 SHA512 SSDEEP TLSH