63451f1b0395924fbd053e07edf4bcfc3ab243072a2069109fa45dd2e228b408

Analysis

user interaction
yes
max time kernel
12s
max time network
439s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
29/10/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
owned-0.14.0-0.apk
Size 4.3MB
Sample261029-wnchfsey5l
SHA256 63451f1b0395924fbd053e07edf4bcfc3ab243072a2069109fa45dd2e228b408
MD5 eabdc2e8b507ab909748e8a3204b22f3
SHA1 b976ea9bb8f2dae5d020386998a12a67448f3af4
SHA512 a119158b3d09bffe6a4f3d398200702419d888bb76f7254165b40f06b86c84f1a5315d946df3161c7fe7f0217b975577398b0068fb577ea892561b59dfa8e2a6
SSDEEP 49152:EX2Y97tgncOka0oyxIfziW0lNb8ptDpDvDHMu8d7d0jf7Wc1W:S9s5fvh2d76f1W
TLSH
T133268C4DEE479EB9CD7E123408BB0B2933356D01E6C3430B590ABAA87F736D15B856C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion execution impact persistence privilege_escalation

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	violet.owned

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	violet.owned

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	violet.owned

violet.owned
1⤵
- Makes use of the framework's Accessibility service
- Tries to add a device administrator.
- Schedules tasks to execute at a specified time
PID:3348

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

base.3348.tmp

Path /data/data/violet.owned/cache/oat_primary/x86_64/base.3348.tmp
Size 491KB
SHA256 e69c0d61864b941ec71f184bf9dd87630519489f6cb4f0266c155c493294b461
MD5 6a50ffedfa72a7449928cf573b950cc1
SHA1 82610a656fb93a70aec6e5f45d41a5517853419e
SHA512 e952d0e7ba3a82b49a58178b26b132dc506ed71c6f2f360ab1ffe29667a26c48fc6269738da827bbd3d389e29935da5ddba1250b63697135edbb540f119ba1f8
SSDEEP 6144:dhUaaGhfncO2t7TjMGl5cN6a2u9mfP8u8lLFsSITDApCgI9ad15StvC07i14bS6x:dhUaXh6t7TzY0P0KA1m
TLSH
T1A3B46DAFEB62D065C1EF9EF3CB8745F9F92A8111225629009461773EA417F14EB70FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

owned.db

Path /data/data/violet.owned/databases/owned.db
Size 4KB
SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
MD5 f92de9b7aca81136a5f2712adbd9ae8d
SHA1 8612ffa8ecae146263660d878c1e74d3da282d00
SHA512 9c2b923253b6871e68b7c513a1cbd80d39e270749933dc8e08d5add372f5f432c183768854e699cbd68c105b4e81a5500caa1d3fb2b194743c2b76b6095a526e
TLSH
T195810440574000F1D05407F354D1171D0F17D1DCD5410F0315010041CC455440C70FCD
MD5 SHA1 SHA512 TLSH

Submit Download

owned.db-journal

Path /data/data/violet.owned/databases/owned.db-journal
Size 512B
SHA256 9afbb4792796fd40e9075062810091cdbeba57be08b3bcde562c4beae6d29460
MD5 1f71083c1d240357f7e31dc04ff0de54
SHA1 36284073ad73ae7e099a930613f4ae9c62476b78
SHA512 9d8faf8f65cdef7e6e30a30186788f7a179ce6a93ed7e55c3ac5802bf8ece23fc581f8e6dcbf384957821fa151f2bf36931777805e244b4fe33c015d62e8a3ff
MD5 SHA1 SHA512

Submit Download

owned.db-shm

Path /data/data/violet.owned/databases/owned.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

owned.db-wal

Path /data/data/violet.owned/databases/owned.db-wal
Size 40KB
SHA256 8d88f24efa3638220ad1f1323b86dcf90e1eff7d4e6c6396624c6e23bdf9f95e
MD5 ba72e46540150a7d2e006ef2800a385f
SHA1 91792ab87096b220cdb7dacfea033b694dc6fe90
SHA512 0a676244b3cea93f0ca2645c5bdd8dd71eebad4e9ffbd8ab929b3cbd07d5f7956552aec1a31383c735436b7d5df66671a57edfebd05b4be8132a832ea910d597
SSDEEP 48:W+AzrCSP/Bk+ZuXj66h/37ObSP/BBv8Vg8bmhfqKDac:W+QbP5ks61aeP5BkgsmhfqI
TLSH
T179036755BF846127F5050378D4C692A11CB8593DE397DE4B4AF44D183C139CC7586E47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/violet.owned/files/profileInstalled
Size 24B
SHA256 10499f8c13521d4a190e210b57ecaa564bd18411b2bf93efc975d293e9bb971c
MD5 77a454c039baf45f2426f8bacf56cb71
SHA1 119aa01f49044477439f793ac391d9ce9ce3cd4d
SHA512 ff3e69d0e28deaeae0366f14de06731831fccf0067cfe94ca5ed35bbf9f1094bb44cba4cfe91c053382d8605cb07101796da4ddbf8bfaaaa5f4f2bc845a61261
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/violet.owned/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 613633eef4217d81ab17917bcfd672a94e3528fd342e8b5f195780bdda90f998
MD5 136f23829749839e0eaf5e3740646778
SHA1 1b0fcb8388befe7a0e456dc2637577c1ac986c55
SHA512 5ba95d12bc8ed5818641dfef75b5562ad04d682c1b5457e6b01a03bb17989a2768c64a0da3e8fa3c774cc11a38bfc04366e2b7893522cb31b00f44e17d1896ce
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/violet.owned/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 3f018bdf4216eab638adddebdd4aa528eb650bbd0d0e14113a3cb04ac14cf7a0
MD5 4d8edd3b03ea3de7211200b465d69a94
SHA1 918b0fed2d19a0e7396ef4f5c4439326b9c68fbb
SHA512 6fef0c28b62e060f6cb198766472871cb155b9201d8f88768a119d38528d07d546874beb2f9f4cf850e3e4be5614742f03652d6f3a1146d9b415715cbf02b2b4
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-wal

Path /data/data/violet.owned/no_backup/androidx.work.workdb-wal
Size 181KB
SHA256 a9f94ac9d00df006ae0b5fe03614f7437c58ddde9b45ebaa7b77f3fbd1906ad1
MD5 2cdee6e23cfb3ea1bc557c3b983ec652
SHA1 8476b32f74fab6d518877d90558752b9fa0db91a
SHA512 61e9f6d035267ad3c81e880a95eb247ac958f88f717e0e30e6458735b4fb7da8b38083c82ff891c8ad9716fe6ffb6f6c19d56b5f9351a37f324c04cdee1dc11d
SSDEEP 192:FCl3DtidjnfWzzb83zSpS+XD86u0E5N1qBiKv1YLH:UBDtidjnfWzzb83zSPXD86u0E/1qBj1G
TLSH
T1B30442CF0F491500C2AA35B2F5901BE0FA7E652F93A69386A5948175EDC3820DA75CFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/violet.owned/primary.prof
Size 8KB
SHA256 8d27594571e6ae52004fc83357b26032c1dbd9513489de014473c51f62187cbe
MD5 317c2980cb53f0014a78d27a2e849a24
SHA1 e456329275cf86ba20d537b800236bd4365198f8
SHA512 5c89de504813aa49aeacf44b6985f8cf0f1a570408ae45a8acd6f6852620606626c8e9cc856916e2bdb6c6f6e182b5bdc8931c80b8bc34f4b05456927aa8de8f
SSDEEP 192:pY5bXpaqPycgG1EpRe10xaHIxWTGqMhqLsXHkH:6VXpFgdTaoxWnIXkH
TLSH
T16802B00655F58BB5F4D14B08CEF40017FFB85DA4E1D60658DEA96481EA8AAB09BCDC33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads