cb37c40f36534c677115ebc3764b9bdb7a17d9f0141c2b0e83b587ca9e123612

Analysis

max time kernel
149s
max time network
154s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
29/10/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
yuzhi-defense-v2.8.9-1123.apk
Size 680KB
Sample261029-w4y2dsssez
SHA256 cb37c40f36534c677115ebc3764b9bdb7a17d9f0141c2b0e83b587ca9e123612
MD5 dbeb77e7ce5b5b930edd4829a577e47e
SHA1 623cff7cce6521e452e035719d2788ace08fde95
SHA512 29857ddeed8f02a5ee4edc3a9e28526b064cd785019b1c47d5d882786786982cdedd11e95f1a082ea6f9c551a0f4f425bd7eb735e67c1f962bec4db2987675d7
SSDEEP 12288:hE+PsWKMvtmyz6g1nWnl1CtUD3sHtA5qqtpVQkR8Z05a6WH8hSwZh:hEBW/vtB6gslg436qtp8XSSwn
TLSH
T1B1E42343CF4D4A9EF5E526B264AB9D24EEA94F97C682FBC21482E3343C371919720717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion evasion persistence

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.defend.system

Performs UI accessibility actions on behalf of the user 1 TTPs 14 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.defend.system

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.defend.system

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.defend.system

com.defend.system
1⤵
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5021
- su -c id
  2⤵
  PID:5261
- su -c am start -n com.defend.system/.AlertActivity
  2⤵
  PID:5283
- su -c
  2⤵
  PID:5307
- su -c home=$(cmd package resolve-activity --brief -c android.intent.category.HOME -a android.intent.action.MAIN 2>/dev/null | tail -1 | cut -d/ -f1); ok=0; fail=0; for p in $(pm list packages -3 | cut -d: -f2); do case "$p" in com.defend.system|moe.shizuku*|com.android.shell|$home|com.miui.screenrecorder|*screenrecorder*|*screen.record*) continue ;; esac; if appops set "$p" SYSTEM_ALERT_WINDOW ignore 2>/dev/null; then ok=$((ok+1)); else fail=$((fail+1)); fi; am force-stop "$p" 2>/dev/null; done; appops set com.defend.system SYSTEM_ALERT_WINDOW allow 2>/dev/null; appops set com.defend.system 10020 allow 2>/dev/null; appops set com.defend.system 10021 allow 2>/dev/null; appops set com.defend.system 10022 allow 2>/dev/null; echo "OVERLAY_KILL_DONE ok=$ok fail=$fail"
  2⤵
  PID:5344
- su -c am start -n com.defend.system/.AlertActivity
  2⤵
  PID:5410
- su -c
  2⤵
  PID:5438
- su -c home=$(cmd package resolve-activity --brief -c android.intent.category.HOME -a android.intent.action.MAIN 2>/dev/null | tail -1 | cut -d/ -f1); ok=0; fail=0; for p in $(pm list packages -3 | cut -d: -f2); do case "$p" in com.defend.system|moe.shizuku*|com.android.shell|$home|com.miui.screenrecorder|*screenrecorder*|*screen.record*) continue ;; esac; if appops set "$p" SYSTEM_ALERT_WINDOW ignore 2>/dev/null; then ok=$((ok+1)); else fail=$((fail+1)); fi; am force-stop "$p" 2>/dev/null; done; appops set com.defend.system SYSTEM_ALERT_WINDOW allow 2>/dev/null; appops set com.defend.system 10020 allow 2>/dev/null; appops set com.defend.system 10021 allow 2>/dev/null; appops set com.defend.system 10022 allow 2>/dev/null; echo "OVERLAY_KILL_DONE ok=$ok fail=$fail"
  2⤵
  PID:5473
- su -c am start -n com.defend.system/.AlertActivity
  2⤵
  PID:5526
- su -c
  2⤵
  PID:5552
- su -c am start -n com.defend.system/.AlertActivity
  2⤵
  PID:5590
- su -c
  2⤵
  PID:5617
- su -c am start -n com.defend.system/.AlertActivity
  2⤵
  PID:5671
- su -c
  2⤵
  PID:5696
- su -c am start -n com.defend.system/.AlertActivity
  2⤵
  PID:5748
- su -c
  2⤵
  PID:5773
- su -c home=$(cmd package resolve-activity --brief -c android.intent.category.HOME -a android.intent.action.MAIN 2>/dev/null | tail -1 | cut -d/ -f1); ok=0; fail=0; for p in $(pm list packages -3 | cut -d: -f2); do case "$p" in com.defend.system|moe.shizuku*|com.android.shell|$home|com.miui.screenrecorder|*screenrecorder*|*screen.record*) continue ;; esac; if appops set "$p" SYSTEM_ALERT_WINDOW ignore 2>/dev/null; then ok=$((ok+1)); else fail=$((fail+1)); fi; am force-stop "$p" 2>/dev/null; done; appops set com.defend.system SYSTEM_ALERT_WINDOW allow 2>/dev/null; appops set com.defend.system 10020 allow 2>/dev/null; appops set com.defend.system 10021 allow 2>/dev/null; appops set com.defend.system 10022 allow 2>/dev/null; echo "OVERLAY_KILL_DONE ok=$ok fail=$fail"
  2⤵
  PID:5807
- su -c am start -n com.defend.system/.AlertActivity
  2⤵
  PID:5861
- su -c
  2⤵
  PID:5886
- su -c home=$(cmd package resolve-activity --brief -c android.intent.category.HOME -a android.intent.action.MAIN 2>/dev/null | tail -1 | cut -d/ -f1); ok=0; fail=0; for p in $(pm list packages -3 | cut -d: -f2); do case "$p" in com.defend.system|moe.shizuku*|com.android.shell|$home|com.miui.screenrecorder|*screenrecorder*|*screen.record*) continue ;; esac; if appops set "$p" SYSTEM_ALERT_WINDOW ignore 2>/dev/null; then ok=$((ok+1)); else fail=$((fail+1)); fi; am force-stop "$p" 2>/dev/null; done; appops set com.defend.system SYSTEM_ALERT_WINDOW allow 2>/dev/null; appops set com.defend.system 10020 allow 2>/dev/null; appops set com.defend.system 10021 allow 2>/dev/null; appops set com.defend.system 10022 allow 2>/dev/null; echo "OVERLAY_KILL_DONE ok=$ok fail=$fail"
  2⤵
  PID:5919
- su -c am start -n com.defend.system/.AlertActivity
  2⤵
  PID:5972
- su -c
  2⤵
  PID:5998
- su -c am start -n com.defend.system/.AlertActivity
  2⤵
  PID:6051
- su -c
  2⤵
  PID:6074
- su -c home=$(cmd package resolve-activity --brief -c android.intent.category.HOME -a android.intent.action.MAIN 2>/dev/null | tail -1 | cut -d/ -f1); ok=0; fail=0; for p in $(pm list packages -3 | cut -d: -f2); do case "$p" in com.defend.system|moe.shizuku*|com.android.shell|$home|com.miui.screenrecorder|*screenrecorder*|*screen.record*) continue ;; esac; if appops set "$p" SYSTEM_ALERT_WINDOW ignore 2>/dev/null; then ok=$((ok+1)); else fail=$((fail+1)); fi; am force-stop "$p" 2>/dev/null; done; appops set com.defend.system SYSTEM_ALERT_WINDOW allow 2>/dev/null; appops set com.defend.system 10020 allow 2>/dev/null; appops set com.defend.system 10021 allow 2>/dev/null; appops set com.defend.system 10022 allow 2>/dev/null; echo "OVERLAY_KILL_DONE ok=$ok fail=$fail"
  2⤵
  PID:6110
- su -c am start -n com.defend.system/.AlertActivity
  2⤵
  PID:6160
- su -c
  2⤵
  PID:6185
- su -c home=$(cmd package resolve-activity --brief -c android.intent.category.HOME -a android.intent.action.MAIN 2>/dev/null | tail -1 | cut -d/ -f1); ok=0; fail=0; for p in $(pm list packages -3 | cut -d: -f2); do case "$p" in com.defend.system|moe.shizuku*|com.android.shell|$home|com.miui.screenrecorder|*screenrecorder*|*screen.record*) continue ;; esac; if appops set "$p" SYSTEM_ALERT_WINDOW ignore 2>/dev/null; then ok=$((ok+1)); else fail=$((fail+1)); fi; am force-stop "$p" 2>/dev/null; done; appops set com.defend.system SYSTEM_ALERT_WINDOW allow 2>/dev/null; appops set com.defend.system 10020 allow 2>/dev/null; appops set com.defend.system 10021 allow 2>/dev/null; appops set com.defend.system 10022 allow 2>/dev/null; echo "OVERLAY_KILL_DONE ok=$ok fail=$fail"
  2⤵
  PID:6241
- su -c am start -n com.defend.system/.AlertActivity
  2⤵
  PID:6293
- su -c
  2⤵
  PID:6318
- su -c home=$(cmd package resolve-activity --brief -c android.intent.category.HOME -a android.intent.action.MAIN 2>/dev/null | tail -1 | cut -d/ -f1); ok=0; fail=0; for p in $(pm list packages -3 | cut -d: -f2); do case "$p" in com.defend.system|moe.shizuku*|com.android.shell|$home|com.miui.screenrecorder|*screenrecorder*|*screen.record*) continue ;; esac; if appops set "$p" SYSTEM_ALERT_WINDOW ignore 2>/dev/null; then ok=$((ok+1)); else fail=$((fail+1)); fi; am force-stop "$p" 2>/dev/null; done; appops set com.defend.system SYSTEM_ALERT_WINDOW allow 2>/dev/null; appops set com.defend.system 10020 allow 2>/dev/null; appops set com.defend.system 10021 allow 2>/dev/null; appops set com.defend.system 10022 allow 2>/dev/null; echo "OVERLAY_KILL_DONE ok=$ok fail=$fail"
  2⤵
  PID:6378
- su -c am start -n com.defend.system/.AlertActivity
  2⤵
  PID:6434
- su -c
  2⤵
  PID:6461

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yuzhi-crash.txt

Path /storage/emulated/0/Android/data/com.defend.system/files/yuzhi-crash.txt
Size 1KB
SHA256 6016f6ddaa0a05d4787e169cb32295d1ee95c2a62d454d5f634701b19173a044
MD5 bccc0ce7282b1ceb4ca8c160fcd9c44f
SHA1 3157a3e2c4d0580118f9111d90989dd9853ecd14
SHA512 2eb2a6c72ebeab3fb7b70c28c8fec2310e97f18147362e964ccc1a5ddb7b94bd24297ce5eb18b5d2b3ba682ebdca209e9e5eaf4837bd55b42587fc4a9623ea3a
TLSH
T1A621C0D70D1D29C21F5FC05E322C5248DAE253FB5A3504309F19879E4A0F50901EEBFA
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads