Analysis
- user interaction
yes - max time kernel
55s - max time network
53s - platform
android-15_x64 - resource
android-35-x64-arm64-20260325-en - resource tags
- submitted
24/10/2026, 21:37
General
- Target owned.apk
- Size 3.9MB
- Sample261024-1glvrset2p
- SHA256 272c732f462719a3349c5bbdc88a70069150988c1e498935206778a3dc95241c
Score
7/10
Malware Config
Signatures
- Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
- Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
- Tries to add a device administrator. 2 TTPs 1 IoCs
- Changes the wallpaper (common with ransomware activity) 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
violet.owned1⤵
- Makes use of the framework's Accessibility service
- Reads the content of photos stored on the user's device.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Changes the wallpaper (common with ransomware activity)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
base.3313.tmp
owned.db-journal
owned.db-wal
profileInstalled
profileinstaller_profileWrittenFor_lastUpdateTime.dat
androidx.work.workdb
androidx.work.workdb-journal
androidx.work.workdb-shm
androidx.work.workdb-wal
primary.prof
primary.prof.jrdyEB.tmp
wallpaper_orig