089688db8500d0776501de520205209535bf0e5104d0a728f484dde75c1ed9c2

Analysis

max time kernel
150s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
02/11/2026, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
089688db_monkeysdk_com.huawei.io_170-205-28-207_9000.apk
Size 251KB
Sample261102-kpfqqa11ev
SHA256 089688db8500d0776501de520205209535bf0e5104d0a728f484dde75c1ed9c2
MD5 5dc80b8872c309b36fba9d33f7422515
SHA1 a8cd54727010b5032be004f0db145661b848c7fd
SHA512 a5c504008c8a98cd802b350897e583a3f76db15cfc75e1e42ba926985a5637f604ada55f23eab0fb264378d7ac0efceeab7eb304aae8f4a9b1b2c561b706be4f
SSDEEP 6144:LvE2KENL+Jk26uc91Cj+0ZVf8GdlmZ/DDjci2FFN:LNC3Wg+8lLm5PwFX
TLSH
T150441291D731442EEAAD643204CB23394B14CF64C462AA1F2644F73776BA35EA3C67DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion persistence upx

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.huawei.io

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.huawei.io

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.huawei.io

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-1.dat	upx

com.huawei.io
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4283
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4316
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4401
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4430
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4448
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4468
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4488
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4509
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4530
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4551
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4570
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4590
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4608
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4629
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4650
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4668
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4688
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4707
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4728
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4746
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4766
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4785
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4805
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4823
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4844
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4862
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4882
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4903
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4921
- sh /data/user/0/com.huawei.io/files/libandroid_runtime.so rockstar
  2⤵
  PID:4944

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libandroid_runtime.so

Path /data/data/com.huawei.io/files/libandroid_runtime.so
Size 178KB
SHA256 103b936e03954eec346a27728756a772fee54668b4c95581b1e1292f4451c782
MD5 27e3a0671b7f882d1c9ff5ff0f694b6c
SHA1 ef35d746d293b7ac18a9d091e1c2d2826d202b00
SHA512 3970784b78f3a040afda1b3c3e9d45a8e3bc0ba36806b773f044775616577a11c4888703d1727228f6c5c4bf85393400e67b624a840795c6ff063f19ce000fd8
SSDEEP 3072:584MBnKy2AlVl1ZYc97R0jsDOzq1gVfjbgmxIW+y9xyZZeemkDUXgtkL+:58422C+c910j+0VVr8qd7mZjDDFtki
TLSH
T1BD042291C522C17CAB1D61B101D247890F0883B4C7093EBE96A5DF0D2E86B56F39BFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/com.huawei.io/files/profileInstalled
Size 24B
SHA256 9cea342c8a99217490ce5f78400a8dceb0c8b7a64d4527d585b4f6af4b92726d
MD5 f10cd5cb977a56ba46d6cbb05ced869c
SHA1 ce79f002e74cc94dd42bae8930400049774bacdb
SHA512 13923efc69ad9d045e2eddb95777aecdd6f5bb1fe8804eb5c04d6cd6df2d3fdb87ecb10c481cd5ca2e066009a7b0a8473ff9f372d23d5349012b13329a96c26f
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.huawei.io/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 c2ba9a2c89514fd759646734c73b958c52cb6be237f11f0dfa2db0c0d128d246
MD5 191f1667cf845b493422e4cc727e498e
SHA1 302b2be03b5022fb17f511d1ce1bd92bddd9eea3
SHA512 8f6abec2aa2ba4d650dd004d1f2f7c1c0de950620aea504de80531d7bb4f3eb12514014922857f2e4460995ce714ccfe385bd4eab3354856fdd3ef1f9a5045ce
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.huawei.io/primary.prof
Size 71B
SHA256 e55391dd4f05a5a4071b4c2081a56f4dec95a1aef2a649e8b38b65e683e7bf55
MD5 8dd3c82bb95e2a6a9d0910cc0a816584
SHA1 7db96bf49198a3207007c0d161dd8acd04e17da5
SHA512 a62c74f3ea50758389a9eefb71f33f0a6b9880e7388796b191f71de1f7e177d7602dae58649db9c560d9cab6e9fd4f8f3485f87264d1b408198eebdf48fc179e
TLSH
T12FA0222E022203CCB020083380CB8F0BA3FCE0303F082F02008C228000222F0A008832
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads