8fa9f9e2e2c4c930a2330ee228fd6702b4d614bd3920cc1ffd7fba08bf76a08a

Analysis

max time kernel
108s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
07/11/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Noviq.apk
Size 1.7MB
Sample261107-wtak2sdy4w
SHA256 8fa9f9e2e2c4c930a2330ee228fd6702b4d614bd3920cc1ffd7fba08bf76a08a
MD5 28b3ea9527aa18ddf62a0527600d52d6
SHA1 1cc5d68f95d3f755441fe4506d6169969ce7d102
SHA512 a31caa0ef9552c84891f4a58d4bb194b28baac85e743c3de304f037485cf478efd1c03bbcff12567a0926ac50dca5bb42a634a7bcae8fecd397aef4506052155
SSDEEP 49152:TiVOnYaKSThZ74XDWeS6230N6yDcv+F1zNfAvDHMukEd1J7bUE:WVLaKSThZEzWenoyYvQz7Ed1OE
TLSH
T1F3851216B738AA6ECD71007A1E1EA774176A7C63CE018703B514776C78BB6E80F467E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion evasion execution impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4772	cash.noviq.android
/system_ext/framework/androidx.window.sidecar.jar	4772	cash.noviq.android

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	cash.noviq.android

Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://media/external/images/media	cash.noviq.android

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	cash.noviq.android

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cash.noviq.android

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	cash.noviq.android

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cash.noviq.android

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	cash.noviq.android

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	cash.noviq.android

cash.noviq.android
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Reads the content of photos stored on the user's device.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4772

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Data from Local System

T1533

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

backup_database-journal

Path /data/data/cash.noviq.android/databases/backup_database-journal
Size 512B
SHA256 94dc61018086d9a804684b8f03b5925d0beb6dff694f33d4e2df3e20fec7400d
MD5 ba4c8c91e6bd799426f13add1746beb8
SHA1 67e7ddad9893aef5174105a1d3bf9c127785c1c7
SHA512 cc179edec98e1da75688ecfa89e72d0c3b5010387beee9aabe7fec523be983fc6efcc8188314cf62196c824b82cb182e803d4555c1c51c0161128ee83057fded
MD5 SHA1 SHA512

Submit Download

backup_database-wal

Path /data/data/cash.noviq.android/databases/backup_database-wal
Size 52KB
SHA256 3dc6c7b216aa20150b7c9858f85e70a3e08d73bfce92cc5cb18b2ad4e5e77cda
MD5 40eb57588d253796aebe92e53b263f27
SHA1 5cd458924e1efb72618bb3d5f20bb6dff814d80a
SHA512 8882d464f7986c84a8ff21d89a1db1a51cca8712bd54205a0306b8837e5ff6afd33f34691776aebeb71c48c3488ff81cc3ab6e660952f95827ddb30a4fabfbdf
SSDEEP 48:SzVSP/jbPa7Vc66y/3YHGYpIW0L9zaCc9PGRI3ILpI97HcJDzKeSP/nkj3n:i8PbLA36IVgDP03
TLSH
T18333EFAE6F191382C9F581B3D4924FF21A6E041F93B243871AE642F1FCC91C4516996A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evac_logs.db-journal

Path /data/data/cash.noviq.android/databases/evac_logs.db-journal
Size 512B
SHA256 a1289e17390b3a90b19140a8b51beef3a6f2eb9320f1bc8b24e8a86dad273c7a
MD5 1e69bc4665e333be8c10e1a87b091121
SHA1 6c7b2a3ae7acf765ef34d814cfb602cd79cdef25
SHA512 a2cec5adf84f71bb1f9e1cba502263d9200a64c6b8ff06ea2eb8507722ea9a99b42b2112dd26fba546ac87055bdc9d387a4d32bce55c3fb87b0ba01435a34e7d
MD5 SHA1 SHA512

Submit Download

evac_logs.db-wal

Path /data/data/cash.noviq.android/databases/evac_logs.db-wal
Size 197KB
SHA256 fa06a37d9ac1db2a4393b93a8b62da0bbca5d2e54419bcfd93b68bc5a0f721e7
MD5 49cdc71a090ecf29de7739351836e84f
SHA1 932e0f0f57b726023fec38a49f0fbb1776c9f559
SHA512 33d75d4be89ab0f9b3795305592316b80ce8a7cee8521ddeeacf9acb889f35d49ac4fb87b55b8ad7d49636e9fde17d0f35024abe0c9f4e4174f8594f93fa9c7c
SSDEEP 384:BIBW1OuPUqvUuvU6vUGvU8svUBvUqWHvUmJHvUeJHvUuJHvUxJHvU1:ZU
TLSH
T1EB147A9E4F16955ACE1B81BFEE2A83C27325344801B862B654F240E58CD63DC757FEE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/cash.noviq.android/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 8c043b6f0aba374970dc716b26d74a179c7cc2b752ab6c86224f6c0b3ee83a38
MD5 aade5536c13fa4c6d6e2a05150ca9f86
SHA1 41ddaa631b7186b290bca1e7fe7376b2403e64aa
SHA512 690f9be6d9b194f52941d0cded6008ec3088d9856e004cdc911ccc36e3b875af45f21a199e0029bd65275c920f0ea11d5ea8e096b49b099cd01a07ce54d5fb7e
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/cash.noviq.android/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/cash.noviq.android/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 299cd3f0c5c97ad4b767dbeb225ff04c8fbfe71b67120d11094b317bde714f76
MD5 57d0cfe05a688fba4bd09f7a8d505587
SHA1 823417f7d6b1a2149d117824fedc56e6292424f4
SHA512 4f1f93badef7955dff985052494498beaa7c3de139324ce48923eac9067de2b0bfd97f844fe6d857263e4cd9e92e7646573e3ab1520c4a0de9bbe99b24670402
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/cash.noviq.android/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/cash.noviq.android/no_backup/androidx.work.workdb-wal
Size 309KB
SHA256 226f747e809a7a40bb6c84763503e2edf7ad14b29036387ff8c89b0c2f133155
MD5 e763bcbc9e37547fe14843b54805d463
SHA1 bc76ea83a04888b3091a77c70303a249353b42c9
SHA512 41daf8df8c79f8de712a50f066901a25d0fd532b7c18774d848cd094306fdd7da54b301c8d24061120cd42b09af95eaa240d0b6892524168b20dd3dff5acb23a
SSDEEP 384:WtidjnfWzzb83zS8oXD86u0EY1mU1q1z1B1f1o1w61o1x1L1bQv1N1IX1N1i:LfWz03zStXD86y2my0Bj9GxGTJQ/Y/
TLSH
T18A64729E2F15A324CB291679B4D04BF13A3F09B98A3153A2396179C0ADA2410F57EDFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/cash.noviq.android/primary.prof
Size 7KB
SHA256 b54b5def3536e1a6bb01f6b39cfd230c4ef75c83c23997e933b57b90d0ae8bcc
MD5 677676ed21cf4b6012a1da21324eaf99
SHA1 78f60eb5b93336a6a9b7176dde948191ede81804
SHA512 63046890b57b1e9b9570624e431a9543aeeb01646f7ee513b12c15a0dda1c0d068545f626040584a8332cc1a99bbf691285e1c2f8dea918b768cba404fc74e34
SSDEEP 192:LPWV7NSDevA2pANxyFCFKYiX9DrvR9Acb7z5Q:LPk7NSDevIWqc9DbnAg7zC
TLSH
T112E1AFB5DC1741CC5FD81B0976593E620792ACD042C56B80ED6496FF80C48B46B66FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads