084c86323adb8804abde067ee5e393683ad3a4989dadab25c4c5139db8943479

Analysis

max time kernel
149s
max time network
150s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
01/11/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SystemService 3.apk
Size 1.9MB
Sample261101-2b89jsdw4z
SHA256 084c86323adb8804abde067ee5e393683ad3a4989dadab25c4c5139db8943479
MD5 c11c39df53bcaaa3a2ded0fe82807ece
SHA1 e56b9fbc8995495076b02d378f66f1fd6fd096cc
SHA512 921b407f547d17dd016b2e6df944266305b065312e82e5588da66e676431f7eb347dbf505b9c2186a11850fb23f469658b81f21bb3e9fa138cb3b32ebbe02dfb
SSDEEP 49152:+mAU6f41WusuPhGoYQxBFHa4MiaxGvKATQkbanPWC3kx05aCz4y:3fl1Wuj06FHbfaxGvbbaPWCcjC7
TLSH
T1E595339AFC0CF04AE94A8337656C2EEBD7C052E6311865CE1F256614B8596E3B472CCF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

banker collection discovery evasion ransomware stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5068	com.android.update

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/data/phones	com.android.update

Changes the wallpaper (common with ransomware activity) 1 IoCs

ransomware

description	ioc	Process
Framework service call	android.app.IWallpaperManager.setWallpaper	com.android.update

com.android.update
1⤵
- Removes its main activity from the application launcher
- Reads the contacts stored on the device.
- Changes the wallpaper (common with ransomware activity)
PID:5068

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wallpaper_orig

Path /data/system/users/0/wallpaper_orig
Size 7KB
SHA256 aeaf2267755bf72f6dfb22d9f231aa381b2598b2102fe79e18e0f34ed2375aac
MD5 edabbd357a90646c86d92743c9112258
SHA1 9d8df10e1f80e205556d95f25f2055e940821654
SHA512 285b01dff447695138fbd8a230b26c53ac9918a5f7b2a51295b11511b17514c6fc075470a8621e489f0f1199398aabb830c354491ee2df39a8d65bea8848ce88
SSDEEP 96:QC6s5gGQ5cbbdpsMfha0QLJ8evmNEpox9jMAh3T6T6yiIgCZbUvnT5RJLYmcm+0W:MsqG4c/rXYPmC6XL9TVyiIgCYfjcmhW
TLSH
T18EF19E085BD9E4A0EED67133700BAE16F6268D2D86FA48238B9104690DF187E11F7F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download