8922c6b9ee8056ac43ac4c80d0942172b619d38fc393eacd6ce1814974beb460

Analysis

max time kernel
299s
max time network
303s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
20/10/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FYLMOTV_2.3.apk
Size 54.8MB
Sample261020-tht47sby21
SHA256 8922c6b9ee8056ac43ac4c80d0942172b619d38fc393eacd6ce1814974beb460
MD5 de44062731452e3efa0c821c75347396
SHA1 ed66786778f3d95b9cd3f0cfbfda3ccfa7cf47a0
SHA512 0438f45b8bc42bfd97b61cdd0e476aad218b5decd91213d749333783e31473c8619dd5b4abfd07af420c2694b9b8653359621a60efc319c95ef7166bcde84f90
SSDEEP 1572864:ARQjAk++zAI0Wu/CztZ77OYJXPx4HaMOkQK82QvquWfyF:ke+K0h/CxZ7BJXPeaMdF8wQF
TLSH
T152C73326F70E9813C0E7723C8DB64A62691A0F048F02F25B1D24797829FB9D55E1BB7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.fylmotv2
/system/xbin/su	com.fylmotv2

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.fylmotv2

Checks the presence of a debugger
defense_evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.fylmotv2

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.fylmotv2

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.fylmotv2

com.fylmotv2
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4823

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

addb

Path /data/data/com.fylmotv2/databases/addb
Size 20KB
SHA256 0d00934b16520e3a2636da9711223428065cf9194e996dd7220fe0e1ebc580b9
MD5 5dc49cd98f8deeb5a04290ee1f95192b
SHA1 5c9d978eb11eb31d021c67383dad75eae68e6d33
SHA512 df7b5b5eba035ff95b380ac168dfe9a1d9eeb497913095521c14baa583d8b5c4cf1c398cf50cac7ba9232f840704aa8722c404031b89edccd0377749e180b8ed
SSDEEP 12:TLelyNTSFbyB5m/rWKEcNAZlgcWS9MZJ95EcRmBEyPbAVOwG:TLeYy5CgX28lEnGSEG
TLSH
T10A9246C74301B321C2B98671A87583D35AF0123FD2E0CA9764B86C309CA194A30A9E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addb-journal

Path /data/data/com.fylmotv2/databases/addb-journal
Size 512B
SHA256 2ed483895cf6cfd60b5cce72aec413109147d991c66f1787b36a5ed2de44a0f7
MD5 00ff9e02e72e76422b28ca83ce0f63ac
SHA1 f7ce0301c1ee5af9422bd323bf3d979760e5cfc3
SHA512 530479f4ca56f6a1188c9490790f8cc8ce6212eaa0de83d59e72685e9be880f1c96631b900d36d1e4a0fdc6fe074be22c9bac5031c5b1a42d8c6084faaeae522
MD5 SHA1 SHA512

Submit Download

addb-journal

Path /data/data/com.fylmotv2/databases/addb-journal
Size 8KB
SHA256 a7ef6521168f71d21e4d8c934745f17c8472dfc5e502935e9916eba388c9dfe4
MD5 03370385e1d40c800b66472918a0b631
SHA1 4a81309378797902f60b25ff0429619f76cfd00b
SHA512 2aaaccc59f97fea2e49d4df2ed2e3b58ebf47bf6727721759244c2c7ae0d1da250be77ed810c3f48ddd5ad408f178420b37f198372ce59921f93c876d3317ddd
SSDEEP 6:7+/l9Nn1ug9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKf:7+tMqLiuWdYRmBEyPbA
TLSH
T15D02228863800812C82E367798D483500D10AB28D265CBD71AD208A82C07ACCA4A0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addb-journal

Path /data/data/com.fylmotv2/databases/addb-journal
Size 8KB
SHA256 cdea023b2c5ce99aaa588887b64952af97f671fa2d496cc60af7f066b2e5c96a
MD5 f2c090e0f16937cf461ed979cd66003f
SHA1 6f1d2e7bb97286f742b610c07f4ec77bfb0fdec3
SHA512 7cb13359a7eb8c92e6f49b5ea7cb02604bbd9d84bf836a83e8bc88c89f5a1d1fa385fc69fb6356d41868ea784fdd1d5503950d6343d675529cc27f37ea3a51d9
SSDEEP 6:7+/l9FmHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKSM/X:7+tqvqLJdeWRmBEyPb4X
TLSH
T1C20222CA63400903C829277BA0C883401E28AB299323CB0726920A542C076CCA8A0D80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.fylmotv2/databases/com.google.android.datatransport.events
Size 56KB
SHA256 a4b44c26a00e6e654745404451ad4288a3c2e8d2a244a74816eb585cc59269e8
MD5 44b1ac2062ee17d8efbee21ab3c87970
SHA1 970c8d04a4054072aaf78b49494e3998fa9fe800
SHA512 da81407eaaa7cd3f9a76d6a4bb85ce772894a8ac6598fc8f901feb17461a072b2eb8114298e7a0e7aec5279340073a91d379a8f8ba58cc6ccf83c6d6f92b12e1
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSg:rAMEX0wIyNjag
TLSH
T1E643639D5B2C2221C57E283ED7E143A35B7C93DF572392623DA08CFA8DC246974354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.fylmotv2/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 ad7e5f0428b68b8a6a127cc2fad0d74be9748e5642cbc784b98e4c7e2aa7451c
MD5 88687504ea478ec3ca5fa64df89638c2
SHA1 0adb652c39f4d7be884f294f6aa9db383e4b6804
SHA512 17b08b3e8897c7d8f9793c39eb5dd6411a8be36e3225c2a62b24fefe7c5c63c3a8ea1325aa5635db0904e641484d3ccc01ed571a634e905ce332fdcb788227eb
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.fylmotv2/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 913b253a203b00a7d647ce65222ff3bd06e34327afe229b6fb4e961375740fa7
MD5 d6e7f8f565d9670d30c003101ac1dca2
SHA1 5f748b53e65b673bb767420a12018a2b435112b4
SHA512 ab210b31f4bb66646d223ed61a897f96c93e57a021d28a162fd0c02ed2c013102353df9881e2018a48eca40fb122e15175623ec98dad1f7b0946a23338eff867
SSDEEP 6:7+/l9jd4n1Ng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK4ZV:7+tBCqLiuWdYRmBEyPbXV
TLSH
T15E02228963820822CA39177790D483840D00AB2A92A1CB171AA008A43C074CDB4B0E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.fylmotv2/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 db90eb7243908b5f5b80363f146e3220a622e6d7d0e4fd0be94a225b6cd395c1
MD5 f539959a02100e6d8e8a679dc0675cb0
SHA1 9cc22514f35deaf3822d63caa8af330260c60721
SHA512 958fc34f6ce3ba5bac45dd4f7d42602807231b52993b5ed3b32a242fb745e3e6eb7e6502ad61c74d44a0f709fb9f45b84a183b0e63289c26d8dacf0cee8c6c95
SSDEEP 6:7+/l975Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKK//G:7+t7qLJdeWRmBEyPbVG
TLSH
T1BE02228AA3410A13C52A2B77A0E983503E51AB299323CB075AA108952C86ACCA8A0E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

okgo.db

Path /data/data/com.fylmotv2/databases/okgo.db
Size 44KB
SHA256 403bbc202c5ce2b61366582e4f665ff1cee445d4833098b6f7cdf6a8b9bd7b58
MD5 3bc8cc97ac8782c9a6c5803a913e2601
SHA1 d204ddd1ed918ec12c742f451461f1e28911dcda
SHA512 863bec58c28b8e353fbc6aaa6d0e680738e8080b5ab7b3a962759e4e53373d0f8a8f314e9148cd6cccdb3efdf14223c97848d349bbf31a529c3171f3d6cdf527
SSDEEP 24:TLVlfGoTwufmcyZQk1TwufmU9COSgIU4pAXGS+Iee:TrjyZQIhIU4A2S
TLSH
T14F137C5A2B381430CE1D127258C047B00E7AA77F4B97DB073CE120B5ACAA055AC2ECBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

okgo.db-journal

Path /data/data/com.fylmotv2/databases/okgo.db-journal
Size 512B
SHA256 b16f74e3475bcabf5eb8a4e4c0591ef8939f8720f6173951223db804e7815425
MD5 92c68ec2d20e6c813aa057950e9d895e
SHA1 4860692a777261930c951f4fcdb51430b546ec21
SHA512 f5fdcdbc8176924cad8a07434624dd91277999e3d2a76ba69cc12f447178d9ced9621e22de90bf728c0dbed07a9ac4f66d257136eb2095f9976ce3983a9bf962
MD5 SHA1 SHA512

Submit Download

okgo.db-journal

Path /data/data/com.fylmotv2/databases/okgo.db-journal
Size 8KB
SHA256 b850a036004c0b888805d594c7cf6a7cb0ff1ebdf0504f50cc2eb810b622874b
MD5 da0b07ed99e5be8ce4538e036af41c52
SHA1 28367b0fbbc5101e8557f5df2ae70c75ae864102
SHA512 e6f466363418c97e4f1d6b6b2229882f71c4cf55617e52ee38ddf3b0a7f6c82996996fdc728cfc69d930be7dabe10db9f724573ec028b532850186291d0b3a60
SSDEEP 6:7+/l9Dllgn16Mng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKti:7+tF2nqLiuWdYRmBEyPbAi
TLSH
T13602C0CDA3800813C83DA77790DA93410D00E7288171CB67169008967C07DCCECB0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

okgo.db-journal

Path /data/data/com.fylmotv2/databases/okgo.db-journal
Size 8KB
SHA256 99d22b3a1e1ebb35960d99eaeb5b226b7ad732f5c52dd5269f99b252730ac7c6
MD5 bbf0031e74a2bb8a8c93c4dd20316532
SHA1 afeb1c9e40a4a57a09338f251c9f157c13b1f24b
SHA512 b8d0860ed37574ac3c2ede9bf4412ced828eec461bdcbd3505110f5b019f4794ae412712e85802e9b6bdc1a4e9b47d9e56333b8c57c0b6a88e45e73d827ca445
SSDEEP 6:7+/l9+rOPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKXK//mr:7+twOqLJdeWRmBEyPbhe
TLSH
T1C002228973400803C429177BA8E883441E10A72C9223CB071691885C7C8E6CCE891F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.json

Path /data/data/com.fylmotv2/files/.com.google.firebase.crashlytics.files.v2:com.fylmotv2/open-sessions/6AD791140334000112D7942FC167CA98/native/app.json
Size 213B
SHA256 ab5aa53395d3249897e757d954ef28014ad69efb4fbc7d6dd8630c13d042adc6
MD5 eb24029dbff50ab89f37ccc4f96b67ab
SHA1 b5ef1cc5f5ea05ed8c10d8d5709ab51ac01f771b
SHA512 34596fe2b8437ea964c4ab715644d6313093e33e838fc8c371675a1f5b81d995e391cbb0002c446b370962ed326246b0da7e686cbfe1f0cb9a2618ded86b397e
TLSH
T12ED022208219E8FFB677169540DA80F547FF12E2098B308C6A2F1C390721A9813062A6
MD5 SHA1 SHA512 TLSH

Submit Download

device.json

Path /data/data/com.fylmotv2/files/.com.google.firebase.crashlytics.files.v2:com.fylmotv2/open-sessions/6AD791140334000112D7942FC167CA98/native/device.json
Size 194B
SHA256 697e9b12aee79ea99a03cf74cc13e5ddd415efa453794a0a4ae8cecb7752cbd0
MD5 0f26f66a0d6df17d05e9f3b17931e5b9
SHA1 3dd029d662800099a96c4e9279b256acee5c38f4
SHA512 9027164a6da10d3d1c73fa0c94eb3aede88da2bd15d4cbfe77cda38dc93779d756c138c8dc14da4ba590c1fface0800bba6300526fc1f886e553b1425fedf5db
TLSH
T1D5C012B5EC7E3A6E4BD1E1C81C338E53BC6008751A4D2D2064F59D15254F854939995A
MD5 SHA1 SHA512 TLSH

Submit Download

os.json

Path /data/data/com.fylmotv2/files/.com.google.firebase.crashlytics.files.v2:com.fylmotv2/open-sessions/6AD791140334000112D7942FC167CA98/native/os.json
Size 56B
SHA256 3a5df913db77290768c5dfbdfd65b218dfa34b7999441f5cc87797e4b65e445c
MD5 66dcd98f1fd5bca64c229cc972cfcd9c
SHA1 08e2eb6c7a4b34a5eba69d00099d5b30f1d84f94
SHA512 362e92c6671814ec671a70aa7df0f0a5138ad93cfa3b0e88736536ae838ae70f45012b373d2e77835cf33da17f83020aa62821a1b4a78c93ec38da94403cd8f1
TLSH
T1FC9002769880A036101203545A555E51D37014726045F0245857041152A71B80231109
MD5 SHA1 SHA512 TLSH

Submit Download

session.json

Path /data/data/com.fylmotv2/files/.com.google.firebase.crashlytics.files.v2:com.fylmotv2/open-sessions/6AD791140334000112D7942FC167CA98/native/session.json
Size 128B
SHA256 1e085d9e9b29e97f10581ceb59d19c1603a17b25617fc3ccb590196b8689ad18
MD5 87467d8c2325d0ba5a02543cad201925
SHA1 18fd8af5c1a88d71d83a6c31c108317f3689b9da
SHA512 120359585590d61655f1df89e9f510571ce88154ac181573cd2a145e94e4ba03907aa62fe8f57349a560cc6581a0fe9f9e677c8a10f9044b7262c17f57a63c47
TLSH
T16AB02B7126C0F034029EBAD3F1234E300EA203041D328C2604F2013932B0F8D4386E44
MD5 SHA1 SHA512 TLSH

Submit Download

report

Path /data/data/com.fylmotv2/files/.com.google.firebase.crashlytics.files.v2:com.fylmotv2/open-sessions/6AD791140334000112D7942FC167CA98/report
Size 748B
SHA256 49406063a916f532d34761dc88bc96f73712b2366437fe19e6dc16f9c5e2474f
MD5 ce448d00a06e26134134fe0fc960da51
SHA1 58c49f8fbe28009cc696b96f5a6a6ea5e530fefb
SHA512 cb1e9ab0d4b85d6a723863d39c9f6d12402b472934fee4f0704e6a5e20197d545b45da7d1e4ac47d00949fd0d73bec7fafdc9ad4080c42ea15daeafbf13e1f73
TLSH
T10C0110298B7D777E125DE3C591A1EA92D2B91364DE12366C1CCB402137CE97C63026BA
MD5 SHA1 SHA512 TLSH

Submit Download

pluto1628_catalog.tmp

Path /data/data/com.fylmotv2/files/pluto1628_catalog.tmp
Size 321KB
SHA256 00d092749388ebf7701b09e7cb449c5995c2928fb378b16638181f5c61a09074
MD5 a7ce003662dfe8f1a6202d612d3680cd
SHA1 9b51275ad64df75a829ea278d0ec760e0e6a3959
SHA512 edaccbc9f6186dbbb3217ba41db94c3bb24c3e1c4d2ac08cb8b336c1947536ba4bfaab059f9285e71e9034a2e01875c8f14e43cc3854f07e230eac555c5a604f
SSDEEP 3072:bjSMbaWsvk9eRMyxQ/5qHUOzSDE50WMCZ:mHT50M
TLSH
T18264E0E6A9ADECE7C382F2D660DF5D265E4E3792E1C9D740839CCD1CD0BD491822BA05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads