bc84c76747f35566211ead84256cf9d193eb105f7dcf51048d05d31fec04094f

Analysis

max time kernel
34s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
12/10/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Size 2.0MB
Sample261012-3fx8hsfb95
SHA256 bc84c76747f35566211ead84256cf9d193eb105f7dcf51048d05d31fec04094f
MD5 a87e811a8cf34796e72c9936ad8fe769
SHA1 683c3c3dddd510fc174c07ef30c6167c415f4380
SHA512 fc08fdaeedebf01831e7fa6e71384c7ebdc920c2adc88c1945603a0055fdcb2ccd9529c8ed10171153ccd4bfbdc441acec321f1bea6cbcc3f0243ac86e6bb9d5
SSDEEP 24576:84AEkeT8Jn5DlTaEv/jI2xrqPJ3nXKWtQM010ONV+CDj54mCcMr2TJBRXMWp4pNP:FkeTA/G16Gm10ODDumCWRXtWQIFjMZm7
TLSH
T16E95236FEB44E66BC0B7A135A10671C633354D54972A630B4A39F2387BF79C58B26F80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tcy.uezagr/files/gin/MlDue.jar	4285	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tcy.uezagr/files/gin/MlDue.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tcy.uezagr/files/gin/oat/x86/MlDue.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tcy.uezagr/files/gin/MlDue.jar	4260	com.tcy.uezagr
/data/user/0/com.tcy.uezagr/files/Plugin2.apk	4375	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tcy.uezagr/files/Plugin2.apk --output-vdex-fd=58 --oat-fd=59 --oat-location=/data/user/0/com.tcy.uezagr/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tcy.uezagr/files/Plugin2.apk	4260	com.tcy.uezagr

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.tcy.uezagr

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.tcy.uezagr

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery defense_evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.tcy.uezagr

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tcy.uezagr

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tcy.uezagr

Requests dangerous framework permissions 17 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.tcy.uezagr

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tcy.uezagr

com.tcy.uezagr
1⤵
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4260
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tcy.uezagr/files/gin/MlDue.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tcy.uezagr/files/gin/oat/x86/MlDue.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4285
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tcy.uezagr/files/Plugin2.apk --output-vdex-fd=58 --oat-fd=59 --oat-location=/data/user/0/com.tcy.uezagr/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4375

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

wochi_v4.db

Path /data/data/com.tcy.uezagr/databases/wochi_v4.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

wochi_v4.db-journal

Path /data/data/com.tcy.uezagr/databases/wochi_v4.db-journal
Size 512B
SHA256 117b012ddb821c377e473daab590d7509f534493173b402f7b1562769d32039d
MD5 53512a26f8236f888cc3f0d32f936af4
SHA1 e5d7137f00ffa97ad6c221b90a680f879da48819
SHA512 c924454d22bd57685a4793ff28be7e49f78ab98183feb0eb17cada99a0e91d5f49ad32eb5f89927b86c1420b79a579608d3647723a3f77f3c406be98f39b85e5
MD5 SHA1 SHA512

Submit Download

wochi_v4.db-wal

Path /data/data/com.tcy.uezagr/databases/wochi_v4.db-wal
Size 20KB
SHA256 0d52f74384139f06f5786ba0a4e1079cc869ca33368aca53627a8458e0642099
MD5 03e36d5a00072807b3eefa849a6d45c8
SHA1 0800f811b5f798fcb590ba23cc94f00ccad125d6
SHA512 76a61dc72fda731df6496f048c3bc6762e978111aa59b1cb58c3d459d17e4ab44903b807c976a4e7b59c60faa8ce1fc8c13ed0c7af65dc0c30a9593231eb40a7
SSDEEP 12:KEY+CzdTRmBEyPbP/vLuUa+OwCld+zqDRmBEyPbV:KQCzyGSP/v/DE+zDGSV
TLSH
T19C922754EB802953D009437A78C5C3460D61A7194322DB5BB96104E47D8ABCCE8E6D0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Plugin2.apk

Path /data/data/com.tcy.uezagr/files/Plugin2.apk
Size 99KB
SHA256 de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c
MD5 3d216f8fddb9705a6720a285475837f1
SHA1 f053d23b284bfe2faf6e76d353ff052471e2de2c
SHA512 38be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb
SSDEEP 3072:O/hr91fY/9tdWXLqQRClwYJ4sAAq4/IZn8NxQNRmDJS:2B9NMDGLqofsAAbNI8g
TLSH
T130A302021B29DD42D537903648558B26B23AB62BEDF6F32A1E63D36D3083DC8CB33549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MlDue.jar

Path /data/data/com.tcy.uezagr/files/gin/MlDue.jar
Size 962KB
SHA256 a0c5236fbfdccfead3ce85195abdf0379a5083adce171f7c8ce5f0d6f18faada
MD5 6e2c59061e4ddd2433cef5e53dfe362d
SHA1 6a48ac35080c9a3b2443a67f9136c941d8b031d5
SHA512 49400a892b6998c9abe9af81af3da3d17e09f462c4d79841c66b0df221fcd3a16d6c2817dd3a71b994c11c2fa8a4093c18568b932715f39643d61c3acac378a7
SSDEEP 24576:E+oCh7QJCkLP327UY2ySwnJRRWENZVlVmzIoOH+:E+7KJCkLXjDwJrWATmzIoOe
TLSH
T1A825338C807E86DD11AEC6B0824A3FD416A8AC07769D67636F6D040518B9F6CF6FE743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yl_plugin.apk

Path /data/data/com.tcy.uezagr/files/yl_plugin.apk
Size 58KB
SHA256 05eb3e1ca331b8c6a1f60f92abb2bddbac54a7b2c229ac07bf26c756297fe72a
MD5 5a4c666b43ee7f2b6995aaf3527e4a4d
SHA1 b205bcb022797f3b16635db139c7524c0c388adc
SHA512 c84fceddbf9928110fc3b85e0989b9cedd06383007ff99dea5a25096d8f892ab52d30ed9b52b72211449041f1274ead85bb42929ec269b58b6b0e616a8545e17
SSDEEP 1536:D0L/5wazYVM3W7ymXFSRJcL7KIBOWNMunou3faONts:D0z5vcKG7BXsRJcL7gW+ul3a
TLSH
T1984302F14FECB302C166B5391F95E6AFBE9ACD4496B4719B4106A0A8F4D885C42EF02C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Plugin2.apk

Path /data/user/0/com.tcy.uezagr/files/Plugin2.apk
Size 201KB
SHA256 1d83642ede6b16a071676e895f547d056543b5b4622bbc9b9b4ab45e47bf9ba0
MD5 ef019d14367b7346b1ae2419e9d445c8
SHA1 23d81fcf81f3a9f2a991ba4d0d135fe2a28aa188
SHA512 ea582f21c6054c37c679c798e93116c9c18c9544c0feb78fb949bed7b2cd3122c8d7bb8ecef329829c2531764abeb6200f0af49ede97c3b0b7448bdb65a34a60
SSDEEP 3072:1kVF+ursMg5xMFLchcmdbaNiikyqW+q7JDcN6W:1kVVrsMg5x6AhndcfxaV
TLSH
T1D9143C4BA555F877ED6BAB3284E34F40BB32E2952B13674B2048C1B6FCC77858E4D984
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Plugin2.apk

Path /data/user/0/com.tcy.uezagr/files/Plugin2.apk
Size 201KB
SHA256 2c61a25f1ad5783bf82eea9faa2536cac4788ed3147bc1864d9ef17ea01be6a7
MD5 2a425e0fae74f20a2c475da937a619a2
SHA1 4d701c7e6d828aa96ba8a493720e7282c49ec741
SHA512 44c8d2a837b606de99055badbd4b5e708424ca9809b1583d13aefadc4d4af974658dc3a3f179fc3047eef7167151c638ff66dd6c8d38121b6ecdfb464d2a5a60
SSDEEP 3072:1kVF+urNfpK7fagHwanMuBwQS/EdaHgqW+q7JDcN6W:1kVVrNfQ7fHwiBgm3xaV
TLSH
T1CC144A52D9C9B8E6FCBBA23A54E347017F31E659772B57471448C1B2BDC23838E8E984
MD5 SHA1 SHA512 SSDEEP TLSH

Download

MlDue.jar

Path /data/user/0/com.tcy.uezagr/files/gin/MlDue.jar
Size 2.3MB
SHA256 d2b139a74763cb5c014c536548eea305b082c830177ac3c2b9aded656518bf4f
MD5 e2306c9e10e5eb9acaa0afab1720b5de
SHA1 d3951d194b2f5b258511194248ef3aa5922af72d
SHA512 820346808ab55733888949a113bbedc8204c8304bf13a128b4116aad0a8e518d8ba34aa495d4b09d8783c666938cefed066db79f17686f0a05daa2c36a53a9e4
SSDEEP 24576:g1o3NWpiV3UpGr20g/CmKAzQLTLzPSeact:73NoihrbsKAzQLTp/
TLSH
T18AB57D16AA125A33C57D5B3380B74BC1A73762023F43CB5724449279FCD76CA9BAF298
MD5 SHA1 SHA512 SSDEEP TLSH

Download

MlDue.jar

Path /data/user/0/com.tcy.uezagr/files/gin/MlDue.jar
Size 2.3MB
SHA256 919a48ad95edf42cedc8d1b8b14bfb5719a8d3b557828370693e6aeae3b9ce67
MD5 ee735559a3063161a9d28162913c62ec
SHA1 3bb484986359584d91f9ebd6d3d72bca6e478fe2
SHA512 9bc9d44d28a085f3f61ff96b4943f4b5e4f659c2970a7f6dc22249e0a2a94a0a3b7b6da2c0e2d4637389cdd6d5de97a71268231c264c0415f928047bb2e4af22
SSDEEP 24576:g1o3NWpiV3UpoOEMtlwNQvTLs+KAzQLTLzPSeact:73Noih8tuNQfs+KAzQLTp/
TLSH
T123B5AF1699528D33C9BC933E54BF4780777266013B838B972045E6B9ED433EBDBDA248
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads