4656aa68ad30a5cf9bcd2b63f21fba7cfa0b70533840e771bd7d6680ef44794b

Analysis

max time kernel
62s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
23/10/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2_5372811853149808045.apk
Size 504KB
Sample261023-pgalysbw6s
SHA256 4656aa68ad30a5cf9bcd2b63f21fba7cfa0b70533840e771bd7d6680ef44794b
MD5 592fa585b64412e31b3da77b1e825208
SHA1 3689a276f85fd94750dc063860097fdc28ec527f
SHA512 4ffe14a69d0227952abc36f5514074bed5b9145cdffe020358c484d002b67ae14f3dc657a48b5f891cce6c1361cb6e2da8212911ebc904ad14fa121c5ca8f2d5
SSDEEP 12288:E99ZC0lVYC+PpEqVcCmfSylRo3xdxq4dtXATPJLW:2nlV7ipE9Cmbp4dmTRLW
TLSH
T16BB4239BDF87A927F125A67BF2718254F2421C5AB3F8E92B07813210BEFC4A40585F95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker discovery

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.good.sunsine

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.good.sunsine

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.good.sunsine

com.good.sunsine
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Checks memory information
PID:4818

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OPBKEY_3e3e9de5b904db4296ba641b2395d1e7b330

Path /storage/emulated/0/OPBKEY_3e3e9de5b904db4296ba641b2395d1e7b330
Size 5B
SHA256 4f09179369a6e29cbfd2013e4d3ea74bb93971e37ea0a3e884be7c7701e7f270
MD5 94ddec79d8fcac66e21b47ef1399044d
SHA1 003f5f7d613ba6ee2c53d5deca30a74259c6ba6c
SHA512 7cd9693e62d2c4ab424ba0ff4f9b688d2e4715379e2a2cd4637963eb1e3742cd14e059e8b50b0470be06fd63da10a0a030170618c04cf50b4e84ac961c876abf
MD5 SHA1 SHA512

Submit Download

opaDC.txt

Path /storage/emulated/0/opaDC.txt
Size 36B
SHA256 18de200cf3ddae2d44e5ceee8a6cda607ec387643ac2957a544f9c4ebf7d79d6
MD5 d7eee30c2d31675034ca712ddc279a3e
SHA1 1ca676804906b14dd41e20ab203097a0f7640db4
SHA512 f69670834e4ccad2ab023659d5d39b618f5ba3418ff1933b663c7cb163d649cc08c7a57dad5e824647ecb6fe7012d4a7ef5977cc282f2e76f877463f6152247d
MD5 SHA1 SHA512