Analysis
- max time kernel
24s - max time network
151s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system - submitted
12/10/2026, 23:36
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
dERlZG.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral3
Sample
dERlZG.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral4
Sample
dERlZG.apk
Resource
android-x64-arm64-20260325-en
General
- Target jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
- Size 1.8MB
- Sample261012-3llfxafd35
- SHA256 d4d48047543dca6798284f3cedfc8bdcda087a667a128bacc8f973d2f46e96ef
- MD5 d8847d80c63174afbfffac825c397f97
- SHA1 e44b50a68d8261a0362ed85276aa9fe1358e966f
- SHA512 c0dc3225e20728ac70ded6123d8dd958b64a33cc874dfd5d825f8cab4f2177b8ddf3679e88a6580c3e11b2d35aab23fe8396ecc1e6edd9aa0fdcae0e4499362a
- SSDEEP 49152:N3KshCeDTlBeOsmHy5QOLKKhDyh+2aQSwSPeNeBOJdDFt5:JJnbvgQGKoOINwfDJ
- TLSH T186951223E789A8D6D4B3A2358E37919290525C705647E3A31D02B17C4EB7EC893E9FCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.burin.orkdn/app_Wyzf_plg/5.0.9.jar 4375 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.burin.orkdn/app_Wyzf_plg/5.0.9.jar --output-vdex-fd=55 --oat-fd=58 --oat-location=/data/user/0/com.burin.orkdn/app_Wyzf_plg/oat/x86/5.0.9.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.burin.orkdn/app_Wyzf_plg/5.0.9.jar 4317 com.burin.orkdn /data/user/0/com.burin.orkdn/files/new_md.jar 4479 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.burin.orkdn/files/new_md.jar --output-vdex-fd=102 --oat-fd=105 --oat-location=/data/user/0/com.burin.orkdn/files/oat/x86/new_md.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.burin.orkdn/files/new_md.jar 4317 com.burin.orkdn - Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://sms/inbox com.burin.orkdn - Reads the content of the SMS messages. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://sms/ com.burin.orkdn - Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.burin.orkdn - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.burin.orkdn - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.burin.orkdn - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.burin.orkdn - Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.burin.orkdn - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.burin.orkdn - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.burin.orkdn - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.burin.orkdn
Processes
-
com.burin.orkdn1⤵
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4317 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.burin.orkdn/app_Wyzf_plg/5.0.9.jar --output-vdex-fd=55 --oat-fd=58 --oat-location=/data/user/0/com.burin.orkdn/app_Wyzf_plg/oat/x86/5.0.9.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4375
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.burin.orkdn/files/new_md.jar --output-vdex-fd=102 --oat-fd=105 --oat-location=/data/user/0/com.burin.orkdn/files/oat/x86/new_md.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4479
-
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.burin.orkdn/app_Wyzf_plg/5.0.9.jar
- Size 50KB
- SHA256 611bbbd83419cac7976482fefa632fbb138332fb1cebc494f114787b66ade248
- MD5 420af8883b28b70fa5698fc2c9bc1ae2
- SHA1 80b2d0868f0c2170f93d2f93c61c8b430936d181
- SHA512 f72fd329d7b9ecc7d6c7c7c117ff638456201d3797821fdd9eb8b6d5f862544507fd62985a3ecffdb33349851f6e65920962fa44f24bef20b042bcf0ca9ec645
- SSDEEP 1536:cQCX8PNdBpV91XMH8h7K50LdxIakqKcUG6:D/PDBpL1ceWQJBvUG6
- TLSH T1F333F1A2F8429A3450250DDAF46C94F000659A1ECBFBDF4D28F548B7D0D7ECE7191B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.burin.orkdn/app_dex/utopay.jar
- Size 30KB
- SHA256 d5c57482245f9caf63cfae312978e8d38d0185cc3161f1f16dc4d3da91b6983b
- MD5 835e546b50b1e9d513f5148f7a1c0faa
- SHA1 4a072863d236f6ed895647c809359ca1e1d25ed6
- SHA512 2cb7076e28464f53bce04efbf1a250294879894423320195af3187aa58e2d6f9fb88b34fec3a347676949dcc1da2ed048bfcb6c4073b0a75db97ce3a00984445
- SSDEEP 768:NgCHAfdzCElRN9KAHzSdVVQzO4W97lDH2U1Go+ik:RAfdznlRN9KAHzS7VQqiCGFx
- TLSH T199E2F1F49749B700F980E0399A4979E9CFB7657F502EEEC976169C3ABE00F1561020CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.burin.orkdn/databases/740410100062013
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- TLSH T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.burin.orkdn/databases/740410100062013-journal
- Size 512B
- SHA256 f7ed968d12a4c02acd5b3baabb07672474dab9553d9ffbf5ce31340cdfbebe0f
- MD5 22ef14a8087f0b57ae5a15dd29268ba0
- SHA1 b72a8e5432655f94affe7b0d11964de9ad9264c0
- SHA512 626088718e10e616b366a24c5f2a2322c7d62ab3a5649e6bca928140b14726dd39040ce379a7e3dc89fef1466890203f5096cd9b29154559c019a443a528fcb3
- MD5 SHA1 SHA512
- Path /data/data/com.burin.orkdn/databases/740410100062013-wal
- Size 160KB
- SHA256 e08769f5b69fe2c503d7abf09e5900c458ae0018f1f75c0293f986df21a3e080
- MD5 4fbe202598573ff5ef2d814666dc8578
- SHA1 dc3d9564370114f03164a2fbbbbd807f486d4379
- SHA512 96768eaca85cae7446085c718500efce4c472f5a2e29c273c855348d09ba8547a328ba5d21a4ed94fbcffad63823d6c2616ba9652ad4989a88a5bbabe3c7a410
- SSDEEP 384:j7yqjMg6xr/jy0wBAxrA8y0wyxr/jy0wRyuxrA8y0wyxr/jy0wixrb8y0w3:CqjMgQnUqVn31qVnVq4
- TLSH T114F3DADB2E250857DF09CBB080054356F415F77E82CB96F7A9B46D381C65802ABA2DBF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.burin.orkdn/databases/cc/cc.db
- Size 36KB
- SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
- MD5 5d7ea1a23af19b4340cc8d90f28297d5
- SHA1 4cfe95b23a9e98378d69c4290af81b51fbe76aea
- SHA512 33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b
- SSDEEP 12:TCFP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQn:Tz7sL7yot3BVrHotGGSgGQQQ
- TLSH T186F29EC397101162C97C51B3FD9592620E74962EC7B71746BEE015066DC5B01F83AEFC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.burin.orkdn/databases/cc/cc.db-journal
- Size 512B
- SHA256 76befa00a5642fbf17205dd0b7312a92b2632416cb03b6445e60b9b3c7f27d02
- MD5 b6d36d4883c32f6e097b94888235d01b
- SHA1 7568799f818d44174901d23d627d0c92e27aea16
- SHA512 9aa17a8bba15d8c944fd3fbb8d425ec4c533fea04d959951b74a2459eb3b5493d83e23df4c353e57d43cf8b24062e39a69358f810d4d7e68247fa691f265d96b
- MD5 SHA1 SHA512
- Path /data/data/com.burin.orkdn/databases/cc/cc.db-wal
- Size 48KB
- SHA256 87603f0eae189cfb1d8fc596846c0189e082fb0ea405e9c60e01ebad18dc7d3a
- MD5 13b5559a99c393a4a5518f713ab1edcb
- SHA1 03f441ec26849ab74000d61347b06074c0ea0b99
- SHA512 f09e6a6e2136c37bbab489c3348568635395d17f3db26ec0dfa4074d3f05f648cad74eeb283dd828f32114be6c26227006c59c79b1afc948789916e23b7da548
- SSDEEP 24:K4tX3zyGSP/CsweaSMz7sL7yot3BVrHotGGSP/CRcHluPBN0R:t3zNSP/BweishBWfSP/
- TLSH T1012390C6D3002562C468A273FE9593520DF6921E83776B86F9A125237CC6709F435EAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.burin.orkdn/databases/flyou
- Size 44KB
- SHA256 d6e4da9d6ef70d6cf7b550a6446a8bce843ef397c1df2f0c6551881853e0403e
- MD5 a072557c13ffe50f617819f08eb8e453
- SHA1 67e36dd1b56ef6a2a6eb4efe039b9de612870697
- SHA512 f176c3cacbf47811c508084ec1df66ddc16ee7abfdabd5a225e2fca8d3b5da9f41a8adb2c7b9ec3f79d972a70f4f65f1bdc07694a85dc35bad94411c3ef68678
- SSDEEP 48:Tt/6nFivnFi8nFiB9aKFaKGIOnJlPILXVS:JMx7aKFaKGIRX8
- TLSH T1F513426179144402EECCC3721A87F2D40AEC413E6EF657416C9F5D1BDABC909E4BE8E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.burin.orkdn/databases/flyou-journal
- Size 512B
- SHA256 679de083d0e191dd16f49c4066a49f3b074e56c99f145595ba7e2c50c786fd72
- MD5 a76d8bf5e4018b4dc13b20d4ebbf3f1a
- SHA1 118b7bd9a1afc6bccc07eff83f881d0d21c4d6c8
- SHA512 9ca0388a4ee03266a1cd7e01820c1d644ac4f8ff27f806f92582bbb28184f051404fa71eb5dd515d4c89dc5abe4079c765b8fd3c3de4a2bc5955db415664acf9
- MD5 SHA1 SHA512
- Path /data/data/com.burin.orkdn/databases/flyou-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.burin.orkdn/databases/flyou-wal
- Size 56KB
- SHA256 559c916a35c133a0bf660ad4ab7a4d3f122956d5ef4e353f3b0d306d2f3df6fc
- MD5 4881a9957132caba63627a9c58a802b1
- SHA1 4579be07b9e1cc1dad1f5cc28be3fbc8b30653bd
- SHA512 266e9f9f9a80d10e9b863f59484339272ff79216e2926ab6f0acd386587773c46bdc98b969bbd8d7bb9f04229e6b3bc5fdf049a3e65683b73de4898be7757e24
- SSDEEP 48:d7rDzNSP/4St/6nFivnFi8nFiB9aKFaKGIOnJlPILXVSP/I4a:d3n0PxMx7aKFaKGIRX8Pw4a
- TLSH T1FD43765179181802EACCD3715A87F2D40AB8413D6EF7470139DA5E1BDEBDD48E4AD8F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.burin.orkdn/files/new_md.jar
- Size 36KB
- SHA256 001c2f29557e000d84b6f586fb54ffc2c501c7d749a89540db796891b3021279
- MD5 fc8e74605c4ce010ffe0f51c14bbb9b3
- SHA1 38f82b7517fdc0d881a80c64e32244ead819b815
- SHA512 f508dde9bfd0d64a5cb6cbcc2fa1ae1caad447502754ad93da0ffcb7603e6b785ad6dace5c65e87ec0b84af82d9b46f93824f0f74289952e25eb412efa17f5ce
- SSDEEP 768:8lssiwpQAHAR8h/nZ5hW1aWoW0QmRJ2ZDLOZ6jANpp30sEXWg:8Os0gDhWiQmiZXOcap1mT
- TLSH T136F2F1C8BC4441E4E31909B7E0E418124E4514979DBE1AA7DAB1DCE3D8957786FF87CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.burin.orkdn/app_Wyzf_plg/5.0.9.jar
- Size 112KB
- SHA256 1cc01275ac67d4f0bb70cc1156d4b199e8a74805a1528fd08dd2918450988718
- MD5 8565d2e2334ff507e2262115e0f26929
- SHA1 b293c7e05e0300f46b52e3ca984e2606469f9c7d
- SHA512 46fc1400f8627adcd27cd825b7474916a20f811dc02a7d9930d6b7ec7a01cde72494130cb1d4eacf2d8e178bada93729cfc9ef96763530043a13192b9ca0770b
- SSDEEP 3072:BqWITuZrgO+oE5AZUfTezDb1kOmcWGQsr4yrgEmKO:BqWIaczr5AZAerQrhEm
- TLSH T1A9B35B13FB819D23DDAD9B3690D263856736F1073F43D393488491B69DCA3C16E6B2A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.burin.orkdn/app_Wyzf_plg/5.0.9.jar
- Size 112KB
- SHA256 02a5ef69d0967cc0310f315c2340fc8b088ab89d0320227a30cb58229319c034
- MD5 b477ed7cd5872f72f6f91bc754738f9a
- SHA1 5ce083e7b964b08c39312bbc725f9fa2c279a612
- SHA512 d41e1fa806551daecaee5bf632667e6288353532dee6996631bba121e50448bacbed8df4da1c0c63012a9421744b3d2877d28fc65872ea1bf215efd21a8f7597
- SSDEEP 3072:BqWITuZrjo5pgTKezDb1kOmcWGQsr4yrgEmKO:BqWIaXfTKerQrhEm
- TLSH T181B36B12FBC18953DDA8973AA0D293416732F50F3F17D3534488D4B69DC67C36E9A2A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.burin.orkdn/files/new_md.jar
- Size 83KB
- SHA256 04bd4f9aafc801876a326b24499c5fc332a74fe6d0247790fada3e9df815702f
- MD5 701111a083e8b31e55ec814cb9c78917
- SHA1 a92514f99a3af011d770a79d3699c0e6ac915813
- SHA512 55ea76b432bf0a26bff5a3db2a629e9240a866de3a2d4d9a5afe0ca7193cc7bda3b5311cfeb2cdd6d2c62e760131611f8aad3dcbcc2e76ad97cd272fa15b667c
- SSDEEP 1536:3Qr+qeW4RW3CYG+EJ8HDjdzF91r0xU8A4o4s+WMS3gEL/LBjIi2IeH/wFO0CcTnX:3QuSnFki2RYFO0CUnabDCyxcxOwsRuU8
- TLSH T1B383D703F6409923F9AD8F32846397C0A332F6526A13D7936508527BEDD67845FAF2D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.burin.orkdn/files/new_md.jar
- Size 83KB
- SHA256 0afa5f48b018da2ed56bbad69011cfb2187944df5489b916d298bd960f4589e3
- MD5 fb585df12147c75e30fb7acc4b1a6aac
- SHA1 c00854e3869901c3a93a87d86bfe2560f0c94dff
- SHA512 fa653c6a1eda7b61bc33db5fc947d8fbf1bc98697b22201f5010627af6c6b2d0d1c619bee08fbd6043ed9e6a3e64238fd177dde82cc9b753b28d3088e50e4353
- SSDEEP 1536:3Qr+qeW4RW3CYG+EJ8HDjdzF91r0xU8A4o4s+WhIMGDBB+CUlHz21mbWCfJ/2xO+:3QvfHXlT212WCcxOwsRuUGdVh
- TLSH T116833A03F680CA52FDB88A3574A7A7807332FE67AA13C3539408D1B75EC27856B971D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /storage/emulated/0/com.burin.orkdn.start.times/com.burin.orkdn
- Size 77B
- SHA256 8d8103c88557bcf6dc06f9e44b45ab3412c333fce6e22380a91de610d3eafd05
- MD5 81501198c971ae16a99f41982142a055
- SHA1 f8487a793c0f13e23510811d3847570a094f9014
- SHA512 9065477b5e426562b422a2698297573e718d37b78c7fb1d4461fb0e30276aa9d5a8308e8c29adfb1a0006456f4573f383cd64b8d7345a9b91a8ac68824246d07
- TLSH T132A00262C69E9A37F29D20333033179001250BB25560E2CD8B5B1A347BC52E757D593E
- MD5 SHA1 SHA512 TLSH