5704a23ec16dcf6a35897eb69a4df92d57a14078921437e59e3cf8c49b7127c5

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
29/10/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hack-Utils (1).apk
Size 6.7MB
Sample261029-28kmfscf83
SHA256 5704a23ec16dcf6a35897eb69a4df92d57a14078921437e59e3cf8c49b7127c5
MD5 d080ee952abfff5558a30b7616573f66
SHA1 764a0a63e825b4374e766b44cce27102ea463578
SHA512 66c056d93a86606312a4e754d8efc3248b74411e2aced021269867a9b751984181706a876d02b1ebc5db3e0cf11c40ec22cedd14f47cb6e26df0d4e7f9045a07
SSDEEP 98304:TQessOypga+BtGaRJq8UofrX7LU9LjmVIj7giWVJ5X+qrh8XKnhX1ciJ7cGW7myb:TnssO+VAGyUjL7gis5RCilh6VAju
TLSH
T16E660186F784AB2BC437803345F65632658B4D0B8A8297876D18764C78B79F41F9AFCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
14	api.ipify.org

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	vsz.HackUtils.Veos

Changes the wallpaper (common with ransomware activity) 1 IoCs

ransomware

description	ioc	Process
Framework service call	android.app.IWallpaperManager.setWallpaper	vsz.HackUtils.Veos

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	vsz.HackUtils.Veos

vsz.HackUtils.Veos
1⤵
- Queries information about active data network
- Changes the wallpaper (common with ransomware activity)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5061

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16