38ce0877ce8ed603cb45769b8635e18f45c20d2b725c03cffb10d7a6a36d778a

Analysis

max time kernel
34s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
12/10/2026, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Size 2.0MB
Sample261012-3lnahafd46
SHA256 38ce0877ce8ed603cb45769b8635e18f45c20d2b725c03cffb10d7a6a36d778a
MD5 d885fa96f38c9d6351ac8ebe966bc214
SHA1 b0cbe5502cd526a9935b2bbd50d938cb59a10a14
SHA512 d84ad7dcea35ffaaa71ef10e7022dbc7025ed6c7e014395d8222d69800dfd06a1826eba3f5bbc5454b2d1db921ddfbac07db0d07ff3f8e974f0d8b55098139c8
SSDEEP 49152:vnVBBsWWYCneD2PzSY8oRDumC0ulgIFATZbz:2WWYC22T8oRShT6mAF
TLSH
T15995239BEB04E6ABC1B35135D55661CB33318D58932D6B0A0E38F2782BF7AC59F15B80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.hardware	com.dhm.bxdggc

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dhm.bxdggc/files/ya/ThReOGWks.jar	4315	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dhm.bxdggc/files/ya/ThReOGWks.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.dhm.bxdggc/files/ya/oat/x86/ThReOGWks.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.dhm.bxdggc/files/ya/ThReOGWks.jar	4289	com.dhm.bxdggc
/data/user/0/com.dhm.bxdggc/files/Plugin2.apk	4410	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dhm.bxdggc/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=64 --oat-location=/data/user/0/com.dhm.bxdggc/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.dhm.bxdggc/files/Plugin2.apk	4289	com.dhm.bxdggc

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.dhm.bxdggc

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.dhm.bxdggc

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery defense_evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.dhm.bxdggc

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dhm.bxdggc

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dhm.bxdggc

Requests dangerous framework permissions 17 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dhm.bxdggc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.dhm.bxdggc

com.dhm.bxdggc
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4289
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dhm.bxdggc/files/ya/ThReOGWks.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.dhm.bxdggc/files/ya/oat/x86/ThReOGWks.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4315
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dhm.bxdggc/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=64 --oat-location=/data/user/0/com.dhm.bxdggc/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4410
- getprop ro.product.cpu.abi
  2⤵
  PID:4456
- getprop ro.product.cpu.abi2
  2⤵
  PID:4478

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

wochi_v4.db

Path /data/data/com.dhm.bxdggc/databases/wochi_v4.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

wochi_v4.db-journal

Path /data/data/com.dhm.bxdggc/databases/wochi_v4.db-journal
Size 512B
SHA256 94fb633566aa8cbc78c3c631e2903ec6e62ea5a334254f9e3b8943535710086f
MD5 91d0d1ae59996c1312d96885f77a1553
SHA1 caee0e7c66a9ffbcb178c580d82fd418235405d2
SHA512 db73df6bc57931c0cdc34fb8851fde514a63693d0112e83d8bf7a447423be9279d832ba2ccc519fb465bbd27286eb9ed281c1e1548f0b858c58fa910c4f3440f
MD5 SHA1 SHA512

Submit Download

wochi_v4.db-shm

Path /data/data/com.dhm.bxdggc/databases/wochi_v4.db-shm
Size 28KB
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

wochi_v4.db-wal

Path /data/data/com.dhm.bxdggc/databases/wochi_v4.db-wal
Size 20KB
SHA256 fba0829e964881d8b135b164be96d9a29221aa42378cef50018710f56a0408e6
MD5 435bd23a53e7e62d8bd5ea8c119663b9
SHA1 c7c9954cccab064c7457829b232c1d76ca61a9cc
SHA512 5415feafc90e052663d8c3896639fc7548c1faa6821d177ac31b291b5c50290a7a839d090985fca8b9dde20b5dc5f4091373f2cc8d740b33f4d509db607631fa
SSDEEP 12:KybhdzdTRmBEyPbP/sb3uymBEiOwCldudqzqDRmBEyPbV:KybhdzyGSP/+3uliwEudqzDGSV
TLSH
T1E19227D4E3401963D04A33B7D4C8C3050DA1A6295723CF0B1B6A1C6C7C036CCAC91E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Plugin2.apk

Path /data/data/com.dhm.bxdggc/files/Plugin2.apk
Size 99KB
SHA256 de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c
MD5 3d216f8fddb9705a6720a285475837f1
SHA1 f053d23b284bfe2faf6e76d353ff052471e2de2c
SHA512 38be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb
SSDEEP 3072:O/hr91fY/9tdWXLqQRClwYJ4sAAq4/IZn8NxQNRmDJS:2B9NMDGLqofsAAbNI8g
TLSH
T130A302021B29DD42D537903648558B26B23AB62BEDF6F32A1E63D36D3083DC8CB33549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.dat

Path /data/data/com.dhm.bxdggc/files/log.dat
Size 221B
SHA256 77fc3599be409f7e73e643de843c0ebcfa20662964c498fc59e245c7f5e003a2
MD5 ff9229f8e7c92d44d48e25206d43b021
SHA1 be3d75050c16c5b7484652ba292fdd6510f205d3
SHA512 be7b3aa8d670a2873c6b7bfd4ca93121fd2450723cbbc36d9d06d152fafa3ce90451f0a60ab56bc96bccb81cf5aae0167b404073db14dc17b9513ac73d455c58
TLSH
T152D0976200094CC1A048B30CA835C6E9F060285304090098B21B06086A223F0B2AE909
MD5 SHA1 SHA512 TLSH

Submit Download

ThReOGWks.jar

Path /data/data/com.dhm.bxdggc/files/ya/ThReOGWks.jar
Size 963KB
SHA256 c54f03423b80b62becd78cddc6b287bd94ea939623b947f58ebacfab47ea2ea7
MD5 ce6eb07f5536cddd5c256a3f90cc25f3
SHA1 d16db90c530b397831d35901609e790551d37df6
SHA512 2d689ab6afa5d3a6bbb641ee0c976a935e958a7308ffbfd8e0a40bb534fb40e1e222cf74c9d2710646aa172c06a28ed9912adc7821bd6c37b4fed01f42466dde
SSDEEP 24576:Ywkw/091qkFfMhGnoY5XGLFXpxf3GY/6Qm0AmRx:YbgO7fMhjYJGLFXppGY/6QmLYx
TLSH
T1DB2533C424DBD6915461939A4E009CF6823091D19E6B4B8E53AEF787F7F867182E02FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yl_plugin.apk

Path /data/data/com.dhm.bxdggc/files/yl_plugin.apk
Size 58KB
SHA256 05eb3e1ca331b8c6a1f60f92abb2bddbac54a7b2c229ac07bf26c756297fe72a
MD5 5a4c666b43ee7f2b6995aaf3527e4a4d
SHA1 b205bcb022797f3b16635db139c7524c0c388adc
SHA512 c84fceddbf9928110fc3b85e0989b9cedd06383007ff99dea5a25096d8f892ab52d30ed9b52b72211449041f1274ead85bb42929ec269b58b6b0e616a8545e17
SSDEEP 1536:D0L/5wazYVM3W7ymXFSRJcL7KIBOWNMunou3faONts:D0z5vcKG7BXsRJcL7gW+ul3a
TLSH
T1984302F14FECB302C166B5391F95E6AFBE9ACD4496B4719B4106A0A8F4D885C42EF02C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Plugin2.apk

Path /data/user/0/com.dhm.bxdggc/files/Plugin2.apk
Size 201KB
SHA256 1d83642ede6b16a071676e895f547d056543b5b4622bbc9b9b4ab45e47bf9ba0
MD5 ef019d14367b7346b1ae2419e9d445c8
SHA1 23d81fcf81f3a9f2a991ba4d0d135fe2a28aa188
SHA512 ea582f21c6054c37c679c798e93116c9c18c9544c0feb78fb949bed7b2cd3122c8d7bb8ecef329829c2531764abeb6200f0af49ede97c3b0b7448bdb65a34a60
SSDEEP 3072:1kVF+ursMg5xMFLchcmdbaNiikyqW+q7JDcN6W:1kVVrsMg5x6AhndcfxaV
TLSH
T1D9143C4BA555F877ED6BAB3284E34F40BB32E2952B13674B2048C1B6FCC77858E4D984
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Plugin2.apk

Path /data/user/0/com.dhm.bxdggc/files/Plugin2.apk
Size 201KB
SHA256 2c61a25f1ad5783bf82eea9faa2536cac4788ed3147bc1864d9ef17ea01be6a7
MD5 2a425e0fae74f20a2c475da937a619a2
SHA1 4d701c7e6d828aa96ba8a493720e7282c49ec741
SHA512 44c8d2a837b606de99055badbd4b5e708424ca9809b1583d13aefadc4d4af974658dc3a3f179fc3047eef7167151c638ff66dd6c8d38121b6ecdfb464d2a5a60
SSDEEP 3072:1kVF+urNfpK7fagHwanMuBwQS/EdaHgqW+q7JDcN6W:1kVVrNfQ7fHwiBgm3xaV
TLSH
T1CC144A52D9C9B8E6FCBBA23A54E347017F31E659772B57471448C1B2BDC23838E8E984
MD5 SHA1 SHA512 SSDEEP TLSH

Download

ThReOGWks.jar

Path /data/user/0/com.dhm.bxdggc/files/ya/ThReOGWks.jar
Size 2.3MB
SHA256 a05797b6e7a2c201884d764388b4489fa218a17ef936b326772d5f3f6d1dea3d
MD5 d516a58cc9fab125ab019487e2cf09ec
SHA1 28e003e2782645d97935e0b4d8a9a2f7159c80c9
SHA512 9eda54adabe292bfce258de72bcf58e90684b36dc827cb183f9a78d36c907108c1e8da7f5616b0f8f5148ad89070bcabfe0cebf82d2b23ea3a2a220056273610
SSDEEP 24576:R/DwUymgGe5FGAcut/oaRhjlz7Wk/zz+Xt:tN4MAcubzjlz7WkU
TLSH
T17AB56B17A5120A33C56C5B3380B74BC56737A2012F53CB572508A6B9FDC76CADBAF298
MD5 SHA1 SHA512 SSDEEP TLSH

Download

ThReOGWks.jar

Path /data/user/0/com.dhm.bxdggc/files/ya/ThReOGWks.jar
Size 2.3MB
SHA256 cb6512559e3c4f03a3f06ef61182c000809abb258f84b7735776591f7310c482
MD5 7c4c662ed59822f6f1b0a5dcb9749374
SHA1 968d9176e4c671aedf7383ebdec9044dc6614187
SHA512 91272a3459965d1a8c0516e4fd6a7fe4453fcf98e976c74c957cff4d34be5ca7c20c60750b5d0538493f2039034bae5488fc2b68caf0ca067c71971622bcb2e6
SSDEEP 24576:R/DwUymgGe5FGOzmkbxKx15J8Qdjlz7Wk/zz+Xt:tN4MOCqxe5Jndjlz7WkU
TLSH
T135B58D1799528D33C5BC533A60FB4780777267046B538B972109E6B8DE432EBDBDE288
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads