Analysis

  • max time kernel
    24s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260325-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
  • submitted
    12/10/2026, 23:36

General

  • Target
    jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
  • Size 1.8MB
  • Sample261012-3llfxafd35
  • SHA256 d4d48047543dca6798284f3cedfc8bdcda087a667a128bacc8f973d2f46e96ef
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
  • Reads the content of the SMS messages. 1 TTPs 1 IoCs
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.burin.orkdn
    1⤵
    • Loads dropped Dex/Jar
    • Reads the content of SMS inbox messages.
    • Reads the content of the SMS messages.
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4317
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.burin.orkdn/app_Wyzf_plg/5.0.9.jar --output-vdex-fd=55 --oat-fd=58 --oat-location=/data/user/0/com.burin.orkdn/app_Wyzf_plg/oat/x86/5.0.9.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4375
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.burin.orkdn/files/new_md.jar --output-vdex-fd=102 --oat-fd=105 --oat-location=/data/user/0/com.burin.orkdn/files/oat/x86/new_md.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4479

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        5.0.9.jar

        • Path /data/data/com.burin.orkdn/app_Wyzf_plg/5.0.9.jar
        • Size 50KB
        • SHA256 611bbbd83419cac7976482fefa632fbb138332fb1cebc494f114787b66ade248
        • MD5 SHA1 SHA512 SSDEEP TLSH

        utopay.jar

        • Path /data/data/com.burin.orkdn/app_dex/utopay.jar
        • Size 30KB
        • SHA256 d5c57482245f9caf63cfae312978e8d38d0185cc3161f1f16dc4d3da91b6983b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        740410100062013

        • Path /data/data/com.burin.orkdn/databases/740410100062013
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        740410100062013-journal

        • Path /data/data/com.burin.orkdn/databases/740410100062013-journal
        • Size 512B
        • SHA256 f7ed968d12a4c02acd5b3baabb07672474dab9553d9ffbf5ce31340cdfbebe0f
        • MD5 SHA1 SHA512

        740410100062013-wal

        • Path /data/data/com.burin.orkdn/databases/740410100062013-wal
        • Size 160KB
        • SHA256 e08769f5b69fe2c503d7abf09e5900c458ae0018f1f75c0293f986df21a3e080
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cc.db

        • Path /data/data/com.burin.orkdn/databases/cc/cc.db
        • Size 36KB
        • SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cc.db-journal

        • Path /data/data/com.burin.orkdn/databases/cc/cc.db-journal
        • Size 512B
        • SHA256 76befa00a5642fbf17205dd0b7312a92b2632416cb03b6445e60b9b3c7f27d02
        • MD5 SHA1 SHA512

        cc.db-wal

        • Path /data/data/com.burin.orkdn/databases/cc/cc.db-wal
        • Size 48KB
        • SHA256 87603f0eae189cfb1d8fc596846c0189e082fb0ea405e9c60e01ebad18dc7d3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        flyou

        • Path /data/data/com.burin.orkdn/databases/flyou
        • Size 44KB
        • SHA256 d6e4da9d6ef70d6cf7b550a6446a8bce843ef397c1df2f0c6551881853e0403e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        flyou-journal

        • Path /data/data/com.burin.orkdn/databases/flyou-journal
        • Size 512B
        • SHA256 679de083d0e191dd16f49c4066a49f3b074e56c99f145595ba7e2c50c786fd72
        • MD5 SHA1 SHA512

        flyou-shm

        • Path /data/data/com.burin.orkdn/databases/flyou-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        flyou-wal

        • Path /data/data/com.burin.orkdn/databases/flyou-wal
        • Size 56KB
        • SHA256 559c916a35c133a0bf660ad4ab7a4d3f122956d5ef4e353f3b0d306d2f3df6fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        new_md.jar

        • Path /data/data/com.burin.orkdn/files/new_md.jar
        • Size 36KB
        • SHA256 001c2f29557e000d84b6f586fb54ffc2c501c7d749a89540db796891b3021279
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5.0.9.jar

        • Path /data/user/0/com.burin.orkdn/app_Wyzf_plg/5.0.9.jar
        • Size 112KB
        • SHA256 1cc01275ac67d4f0bb70cc1156d4b199e8a74805a1528fd08dd2918450988718
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5.0.9.jar

        • Path /data/user/0/com.burin.orkdn/app_Wyzf_plg/5.0.9.jar
        • Size 112KB
        • SHA256 02a5ef69d0967cc0310f315c2340fc8b088ab89d0320227a30cb58229319c034
        • MD5 SHA1 SHA512 SSDEEP TLSH

        new_md.jar

        • Path /data/user/0/com.burin.orkdn/files/new_md.jar
        • Size 83KB
        • SHA256 04bd4f9aafc801876a326b24499c5fc332a74fe6d0247790fada3e9df815702f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        new_md.jar

        • Path /data/user/0/com.burin.orkdn/files/new_md.jar
        • Size 83KB
        • SHA256 0afa5f48b018da2ed56bbad69011cfb2187944df5489b916d298bd960f4589e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.burin.orkdn

        • Path /storage/emulated/0/com.burin.orkdn.start.times/com.burin.orkdn
        • Size 77B
        • SHA256 8d8103c88557bcf6dc06f9e44b45ab3412c333fce6e22380a91de610d3eafd05
        • MD5 SHA1 SHA512 TLSH