6575ad16955c0c96495b979add0c17631d599822d64998f923990d77967fbb0e

Analysis

max time kernel
6s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
12/10/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app.apk
Size 15.8MB
Sample261012-g4wtpsfy21
SHA256 6575ad16955c0c96495b979add0c17631d599822d64998f923990d77967fbb0e
MD5 abe5bb6fc3e732cdf3ce25cfce082c10
SHA1 4d7193f1c426e8db98b598f424a2311c9d693418
SHA512 e6cbdc487aba1d90ccd0541a85c8c7737d9977efb2e1aa6138ddc774f6e937384aaca36e361ca68cc99e309273d24d2db6916d5df0af98324c70da4608809737
SSDEEP 393216:pS4paeNO36DURs4rK81d0HcHlQV/jLfq8eJ/qiXR:pDpLQ3VRZmkdacHlQ1heJyYR
TLSH
T1A8F63331FFD65899CCDB2F730DADC39A066EB1B2900E59465832741B6801FB6BB4BB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/app.datamind.scout/app_wvj/ocwl.bin	4289	app.datamind.scout
/data/user/0/app.datamind.scout/app_wvj/ocwl.bin	4315	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/app.datamind.scout/app_wvj/ocwl.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/app.datamind.scout/app_wvj/oat/x86/ocwl.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/app.datamind.scout/app_wvj/ocwl.bin	4289	app.datamind.scout

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	app.datamind.scout

app.datamind.scout
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4289
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/app.datamind.scout/app_wvj/ocwl.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/app.datamind.scout/app_wvj/oat/x86/ocwl.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4315

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ocwl.bin

Path /data/data/app.datamind.scout/app_wvj/ocwl.bin
Size 38KB
SHA256 8dbf3291bcac80135c786744abd20a837b129287d55ea605abe9bf20b9792121
MD5 9eb69046a91a069a02c956fb2d9bcb32
SHA1 83ee6cf411553f05a86eb6193906b7e6995742bb
SHA512 c15d6c66b57d64d87a13487460316984656caf1b1b7b220a4d99093dfa4e315c6df290c2c60c4a217effd13447aad4362a5dc5d81e770581990487676624fe1d
SSDEEP 768:vmYWShx9usGk9NvHRp0iF6ni/XDlQbxxDEpe:vmYHx9usBR0i+gpe
TLSH
T121030913F2112969DDBEA73ED9EB03044731F38653234B572182B57A9DE73C1A6B128B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download