b90bf42fcfcc21c2c8c7c1906ac15d0cf02398c9e0d95f0a4792da1c6cf8a8b4

Analysis

max time kernel
46s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
29/10/2026, 18:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1win.apk
Size 5.0MB
Sample261029-wxsk2aca49
SHA256 b90bf42fcfcc21c2c8c7c1906ac15d0cf02398c9e0d95f0a4792da1c6cf8a8b4
MD5 2dd2e51b5c2139079e0bf856ce1d01e2
SHA1 0d65e52b1421965979586ce0040907941d3c2de5
SHA512 aeba27f94dafa797381d110d712ba189e96b9bda202bd8787c3b9a98cdc7d7ddb1a0c2f6907be92f0ce7c64d0c234a917a13737ec01a73b556aa3f0ae4438e28
SSDEEP 98304:ZfbBCyFUklazP5B2jCvtDdMdL86Vk1Tt0rS2IX+Ug:RlDFUYazajCvNSI6zIXm
TLSH
T17536BE8EE7189A2EC47750724C6A523115574C22FA439BB3A97C375C38BB6E40F4DBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.mobile.one_win
/system/xbin/su	com.mobile.one_win

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4935	com.mobile.one_win
/system_ext/framework/androidx.window.sidecar.jar	4935	com.mobile.one_win

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.mobile.one_win

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.mobile.one_win

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mobile.one_win

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mobile.one_win

Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.mobile.one_win

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.mobile.one_win

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.mobile.one_win

com.mobile.one_win
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4935

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.mobile.one_win/databases/com.google.android.datatransport.events
Size 56KB
SHA256 35cdf4a0811fd76e8c81f90114c082442670333f5ccf774b41c5ab52c4a4ad52
MD5 ccd95c537a6595ddc89d865e9d79e3c9
SHA1 37e864b0adbc9a8980648cbbc501b48405761bbd
SHA512 7dc545ffecc5d730a443fac03bc418c5543ab2181f481049aab6484ba7fa47ff3b76e287096fce3ba4c9ed2873eb3f42d500f661e54ccbcdfdd8da348662b3fe
SSDEEP 48:TG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSkxFXfb7tFXfbk:WMEqzAiwIyNjakPb7jbk
TLSH
T1FF43855D5B3C2221C76D783DD7E243A32B7C83EF972292217E948DE68DC20657C254AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.mobile.one_win/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 cb7ea730414c4e82ecb12751015920477d157cc213fc56000f1b4d4e7014d22c
MD5 07413df0d7a5355cd22c14c4d77f7342
SHA1 ffa588982d3de71d5e950b771bccf8f4eb36149c
SHA512 79e23bcf6786b4914e61e34fecb042f9a868db940c49d55faed01f1947b9964b05900ccff04529e962727c9537e8aab501bafa8e0d459bafa19a441218daa58d
SSDEEP 6:7+/l9gruHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKwF//YJ:7+ttvqLJdeWRmBEyPbXXYJ
TLSH
T132022288AB400A03C0291B77E0C883501E22E728A333CB471AA20894AC06ACCA8F0D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.mobile.one_win/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 1a5b1749ae3ff1c276c7708b9cf328ec26f61ffcde4757bfc985bfb03e795b78
MD5 b317337af5f0c7c332499bf197c13e17
SHA1 cf773e1bc96fe00ac1efeabf7dd040ff7158ad33
SHA512 35a4315dbe5b3eb08d72df58f9e52de379d63196bdc3f806c970a88a1cbba730cf329de8edfebc72860c8af83cb503b27367967defa3457747f835502939df9c
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.mobile.one_win/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 fdc1cbc71bed7484f061b254937040d364cbf527f062aa0a11a2ee15e8adcbc6
MD5 7486876d9cbc58c1481b946e3e3f0cc0
SHA1 bdccd3017f2605aca50bcdd82eb93b4d546f4c3d
SHA512 2b6a8f2c554aac4db451d8de38634f37f33ad0b8c5e61c1c964e0464995e6f31b99f0a0cc0b4640559ab09546a8a20d5ba4a9809c2eda23487a6c5c6d2b128e1
SSDEEP 48:7MjHeqG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSj:7+e9MEqzAiwIyNjaj
TLSH
T105B2745C1D3C6211C5BE683ED7E342635D3C53EF572391603EA49CEA8DC2469B0395AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.mobile.one_win/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 70ad7ca2eb813826a999b7b7122692ea7d4f33a4ca07ceed6f856e70bc5ea29b
MD5 5422542cc2f885da8e460d79f3934bff
SHA1 92fd095fe1eb315a599b9d4565627b47f6c4d88b
SHA512 a17088773e2df89ba130fcef1fdf9b4761ddb1aa585dda66e9eff6b27c64545aaad51b317680d86d032bae6c3a5debcce2eec8c5b18e562bb12a98ac2987bad2
SSDEEP 96:7YJFl0QsIuq2LS47o47JbGpGtMEqzAiwIyNjaY:7OFl1+q2LS4c4tiEX3Z
TLSH
T12772EC4D693C5332C5EEA57DE7E146131E3C13AF5B23612439E4CDA88EC606D702557A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.mobile.one_win/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 c74e20b2d5e29c6f13c4aa92796501acedd17441a0c2202babd0c49cea6cf53b
MD5 1c8fd6b0d22f4e76f454923e6dabed88
SHA1 3285bbf14f6fdac6294069a39684ec455b0144a8
SHA512 612024f7d5042b990cf686663b9e7a0bd0256b58f8cc27f4cf6833d0a34af78d36fa245732dd6785cf6c3d8136af1d58c9c18b78bd82adcacd5a79d756412c08
SSDEEP 96:7GbdpNMEqzAiwIyNjavbdMEqzAiwIyNjar:7Gbn33Abn3e
TLSH
T1FE92739D5D3C2311C6BE287ED3E243A35E3C53DF572391603EA49CEACDC2469B0255A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.mobile.one_win/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 d7d124c10ad18429c3c365ba8258a5cd4208ea8c1d64751c0154e7188dc522aa
MD5 63301af5c2072007f96126711255ed47
SHA1 2514a9bf0fc836e2442625dfa10b2cefd928940c
SHA512 b12fdd9e73ab14b4c0f343f9655df950203da8ba748f7ebad2649bb8ed5005e31e782ac8c912394be82932c4c5024963a4371e33cc172f622bf312e44d419e2e
SSDEEP 6:7+/l9Xl8Hn1gbWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKnU:7+tIWSqLiuWdYRmBEyPbD
TLSH
T1B902228863802812C82E167790D983C00D00A738A572CB27179008E82C074CCA4B0F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.mobile.one_win/databases/google_app_measurement_local.db
Size 16KB
SHA256 fecda2e650a2cbb3652d60ee1843b2e8fa9858bab765aee964b59b80a73d5c97
MD5 db36daef009d2615bbd9dfdb4f4d871b
SHA1 48f15ced1db6f00a2e1082ff632fb87d27b4b8df
SHA512 bb61280afeb208d4ef43224b9f871d09eeb24a4660c2b6691f5893f459871eff4ef4a537a3d0df268fa51e74bc55a76ade599d398f6d58fde4975adb8e8b70d6
SSDEEP 6:l9bNFleLIls13FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOwa:TLDE17LzmzsRmBEyPbBvOwVQ
TLSH
T1E272D8CD8F10A206C5270337608AD3954F78551E936796472BA408615E52198B051EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.mobile.one_win/databases/google_app_measurement_local.db
Size 16KB
SHA256 4841ab1198cb8dca00ba7f256f120aa4e908622ff13bfa5c7ecb42482f145654
MD5 986017ef61cf4a7baaac8995593baa6f
SHA1 86715598aa741e8c8c4fe5478bba4ae42d9ea10e
SHA512 5ddd19f8891ecef2443114dab6ae9d11d79feba3828a9fabfe3b1e3f53298c405960c0aef0dbed1e037fca1c0e886b610d12f6c8f327941a6b7719fa01a13488
SSDEEP 6:l9bNFlkls1IFP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/L/vJ+/e:TL6Ee7LzmzsRmBEyPbP/DvJ+/0Fl6cnL
TLSH
T158722BCC5E10E703E12B473A64CB93E65E3C611E43679A5B3A6509749D532C8F152FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.mobile.one_win/databases/google_app_measurement_local.db
Size 16KB
SHA256 985ec518f530bc895919ae538533262ec2d00e0036aee1b1e60f0c555be0d9a2
MD5 37340bc605503b216c7970e8b5abf979
SHA1 3bd1f3087bbe11e3ae36fa904e94daa278d202f7
SHA512 ca458e038fa12a3cfc91cf734ec925c8e3d3bf2c1af6fcb1c5381318933daf03049b4f5d30f7ff4114491d3b55c3eab81f545a8124b4048b756e6e6d95a63062
SSDEEP 12:TL6UEr7LzmzsRmBEyPbP/hd149blqYFlEIkhdvJ+/0Fl6cnL:TL6fHmz3GSP/h7499FEdvJlFxL
TLSH
T1BE724688AA28E643E22B473A24C7D7D22D3C301A03639A1A3A114A3C5D433C8A161F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.mobile.one_win/databases/google_app_measurement_local.db
Size 16KB
SHA256 15deb633636d4c6413a871da402314114e65da7629f41507eb9b169d1bdc96dc
MD5 7a6677dc6b8c894ac9027aeaded0c9bd
SHA1 cbe497452e5b8b2da681ac6b05716c9e4d792d38
SHA512 2a70cb1f83c3565df2d074d8728d1a7936fa3e08e1d0a7180fac2b42aec31cdc1146743828ef58143ffb5333b9a0192fb6ae69e7cdb4ce4e1018c1334f9c4839
SSDEEP 24:TLQHmz3GSP/F/PKabCCbnT499FEdvJlFxL:T0GKSP/FKabCCb05A1xL
TLSH
T163726488B968E643F27B4B3D11C7DAD62A3D306B0723D31739069B2C6E433C09161F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.mobile.one_win/databases/google_app_measurement_local.db
Size 16KB
SHA256 77fa95293395e80c38c43fa15ad607d58d2b9b17483bf8fc4a0190dcf9edbb28
MD5 b4d6362e58d7470332d515c69d8286d6
SHA1 8fb506108b6b76dd3aa9e4dbc100dcd0bf325e46
SHA512 d5e8e840877589aa140cbfbcc30455746a3c58aa7c97863bf30cd41fbdc8d7c73042d163a8eaf0808ca8e74173bf9370f863b48a3cdc61ab4827cf6967a659fe
SSDEEP 24:TL0tHmz3GSP/A7BKabCCbnT499FEdvJlFxp:TkGKSP/u8abCCb05A1xp
TLSH
T12E72F188B968E653F27B4A3D6586EAD6293D30670723D6173A129B2C6D423C49161F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.mobile.one_win/databases/google_app_measurement_local.db
Size 16KB
SHA256 afb0219478a622b16684e464458a1b811b01d12dcbc6771e384416faf44e5ffc
MD5 041d1cd36ec8a6274496834907dd2076
SHA1 bd509a90c7c4768e44e1cad9ca7873a5bd27bec2
SHA512 31b1106dfe8198ccdc866d3ec66019f1bf2bf3854632d8ab51dbd86791de0292ac8a27a216d83b0c84b4772be85f610f68fdb377398f11655edfb708bc22ec54
SSDEEP 6:l9bNFlgls10l/FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/WK//:TLuE0l97LzmzsRmBEyPbP/Wq
TLSH
T11A72268D8F10A207C1270236B4CA63951F28511F4377AA472BA40870AE53198B091F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download