Analysis

  • user interaction
    yes
  • max time kernel
    12s
  • max time network
    151s
  • platform
    android-14_x64
  • resource
    android-34-x64-arm64-20260325.1-en
  • resource tags

    arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
  • submitted
    29/10/2026, 23:18

General

  • Target
    Hack-Utils (1).apk
  • Size 6.7MB
  • Sample261029-299mzacf86
  • SHA256 5704a23ec16dcf6a35897eb69a4df92d57a14078921437e59e3cf8c49b7127c5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Changes the wallpaper (common with ransomware activity) 1 IoCs
  • Enumerates files in the device's shared storage. 1 TTPs 1 IoCs

    Queries the system media store to list files across shared storage, letting the app discover what documents and media are present without opening them.

Processes

  • vsz.HackUtils.Veos
    1⤵
    • Queries information about active data network
    • Changes the wallpaper (common with ransomware activity)
    • Enumerates files in the device's shared storage.
    PID:4325

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        wallpaper_orig

        • Path /data/system/users/0/wallpaper_orig
        • Size 365KB
        • SHA256 5bb977482150c018dec2e4e823ecea33a3c3857e0611b8e826ccc8a71ddc0a07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        journal.tmp

        • Path /data/user/0/vsz.HackUtils.Veos/cache/image_manager_disk_cache/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512