Analysis
- user interaction
yes - max time kernel
12s - max time network
151s - platform
android-14_x64 - resource
android-34-x64-arm64-20260325.1-en - resource tags
arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system - submitted
29/10/2026, 23:18
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Hack-Utils (1).apk
Resource
android-33-x64-arm64-20260708-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Hack-Utils (1).apk
Resource
android-34-x64-arm64-20260325.1-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Hack-Utils (1).apk
Resource
android-35-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target Hack-Utils (1).apk
- Size 6.7MB
- Sample261029-299mzacf86
- SHA256 5704a23ec16dcf6a35897eb69a4df92d57a14078921437e59e3cf8c49b7127c5
- MD5 d080ee952abfff5558a30b7616573f66
- SHA1 764a0a63e825b4374e766b44cce27102ea463578
- SHA512 66c056d93a86606312a4e754d8efc3248b74411e2aced021269867a9b751984181706a876d02b1ebc5db3e0cf11c40ec22cedd14f47cb6e26df0d4e7f9045a07
- SSDEEP 98304:TQessOypga+BtGaRJq8UofrX7LU9LjmVIj7giWVJ5X+qrh8XKnhX1ciJ7cGW7myb:TnssO+VAGyUjL7gis5RCilh6VAju
- TLSH T16E660186F784AB2BC437803345F65632658B4D0B8A8297876D18764C78B79F41F9AFCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 api.ipify.org - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo vsz.HackUtils.Veos - Changes the wallpaper (common with ransomware activity) 1 IoCs
description ioc Process Framework service call android.app.IWallpaperManager.setWallpaper vsz.HackUtils.Veos - Enumerates files in the device's shared storage. 1 TTPs 1 IoCs
Queries the system media store to list files across shared storage, letting the app discover what documents and media are present without opening them.
description ioc Process URI accessed for read content://media/external/file vsz.HackUtils.Veos
Processes
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/system/users/0/wallpaper_orig
- Size 365KB
- SHA256 5bb977482150c018dec2e4e823ecea33a3c3857e0611b8e826ccc8a71ddc0a07
- MD5 cab81c2dc69357e4c5743166ee0029c0
- SHA1 fce578b5cf18b75ddb9760ee7fe810cb222b441d
- SHA512 dad46ec2d91639a02020bea518d6067bdfca8bdb3dcddbaca8ccbbd989ae3a780464e1d7d50c994c958a124f5ff076ee1d8e703073097518b1cda3fd651fc5e0
- SSDEEP 6144:nhOME49By3H4oeuNJhB1ktADTQT5s8jLKOtdkknjlbsz5bwd74ms9ib3J5eAe/7W:nEF4y3B/vEtUET5s8jOI5b45S74p9ibp
- TLSH T1F98423C3B208D8925C7FF4D590A5F08442A2528CF8EEBC2FD91BD691E23DB789161B56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/vsz.HackUtils.Veos/cache/image_manager_disk_cache/journal.tmp
- Size 31B
- SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
- MD5 8c92de9ce46d41a22f3b20f77404cc1d
- SHA1 8671a6dca00edb72be47363a7071be65cf270373
- SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
- MD5 SHA1 SHA512