64cc916d01eeec9350089fd1468f9af17c1f6a4f4c87811faad769f3faa943d8

Analysis

max time kernel
46s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
07/11/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app.apk
Size 10.7MB
Sample261107-wtcemszw9j
SHA256 64cc916d01eeec9350089fd1468f9af17c1f6a4f4c87811faad769f3faa943d8
MD5 bbab6ec0a5a6bb4d302b4c5ca5678610
SHA1 e98863e255cd65ed0081a123822fce865a7982dc
SHA512 2197ba235313d1e2b543dc787eec585414394d72862e68d377e8f54c4f80f15456a4c49b4562c38db1b36423a6c3004a971f2af7f03f1a5f720db44a14a6b8c7
SSDEEP 196608:2xN9/EpCJlbCK/N33dws1ieSUltySz1dyt9i/L2Wt:2F/uCz33N8eDlgSzLyk
TLSH
T15DB60285FB00D92BC477603101AB5621916B4C158E829A87AE487A9CBCF7DED0F5EFDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.shihab.ffzunebd
/system/bin/su	com.shihab.ffzunebd
/system/xbin/su	com.shihab.ffzunebd
/data/local/xbin/su	com.shihab.ffzunebd
/system/bin/failsafe/su	com.shihab.ffzunebd
/data/local/su	com.shihab.ffzunebd
/data/local/bin/su	com.shihab.ffzunebd
/system/sd/xbin/su	com.shihab.ffzunebd

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.shihab.ffzunebd

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.shihab.ffzunebd

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.shihab.ffzunebd

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.shihab.ffzunebd

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.shihab.ffzunebd

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.shihab.ffzunebd

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.shihab.ffzunebd

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.shihab.ffzunebd

com.shihab.ffzunebd
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5078

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db

Path /data/data/com.shihab.ffzunebd/databases/OneSignal.db
Size 52KB
SHA256 ab03de5564295f5ec34e2fccba9811cff818911b07798e9e456a58309deeb3a7
MD5 e1941e84ac2269c7b1b8bb7041b14001
SHA1 aed569ddb068a94e893702c297683c233d841f6f
SHA512 99124fc5347f6a7e19e0e30330c4e2f0f2d9074a0fc6a0ab7be25c5bd90d8dfdc66e8abeb1852be871dadb7a5945d7046d2e72ffb4f179c385ed7ffded33c2b7
SSDEEP 24:TLLSRZBUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvJqrEqjUix5+xGTrOPjwV+x:TeAcrA0oJxqrKcrObMoOS
TLSH
T11E338BCF4A862191EFC765B3155252E44E3B610E889317A63BF760245E83B16D72387C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.shihab.ffzunebd/databases/OneSignal.db-journal
Size 512B
SHA256 75eef6fe4b0c34e6c231343026778028064f9ce2cfbaa34cce9a733cc38883b3
MD5 c825d1119a35e246edabd68193efe71e
SHA1 80fcda7f46f91a337a24e9bd1b270dfdd8aff4b5
SHA512 21e9d34ee8d36178eebd41df40902ce716c3022138daa62f9cc2f73847aafb3a23574e6368fe8395a07bb6508f492d8463b5347312c44deece9e92e4c4893cf9
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.shihab.ffzunebd/databases/OneSignal.db-journal
Size 8KB
SHA256 34978e1faf37587d222f844feef78537a51e3eca2568a6a1b603642c5323db28
MD5 bad21414ac7a3cbfe84b9c4925994fa6
SHA1 916e2fd4aa0d93e3e5b101d57c2469de31d684dd
SHA512 b0dfc82c26b8b2ff4584dae61c0e14cf441a93757c8a7dd117d8a98b7772ff218e425f0041551fc8194986d3476fe717fd48eb82e781b69046f51204f60bb645
SSDEEP 6:7+/l9xBn18g9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKd:7+t8qLiuWdwRmBEyPbi
TLSH
T1E702C08D6B800823C93D66F790D483402D20EF29C171CB47156008D87C034CCE4A0F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.shihab.ffzunebd/databases/OneSignal.db-journal
Size 8KB
SHA256 67f0859525bf8a1f085694e14c3c184e65a24d9010edaeb14617dcfa08c4e8bd
MD5 a60b54dfe82a9f3ad1a284fad1399bb5
SHA1 fcd5b68e3b821a2336d6aa5b39eecc661e074bb6
SHA512 9b2224a2beb2264f7ee8efe6b846cb6fd2295a6db808ab436e7cac03c4406d40374d18b8a6eb1504a12c55322fe5557d536ddcbabc7ad69fea2d38176335264d
SSDEEP 6:7+/l91Gl4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKs/k:7+tywqLJdTRmBEyPb/k
TLSH
T1C902228963400833C1191BB790C8C3412E60F718C277CB07556118983C0A6CCEC90D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.shihab.ffzunebd/databases/com.google.android.datatransport.events
Size 56KB
SHA256 5907e14baf66b87345ac60f9b752711015666488fd387e7ca5f03102e2cc77b7
MD5 23ebd485a550beaca570ede665e196d4
SHA1 90fb23f333e54f16aca88aa2a2543433a67dca87
SHA512 8e80a90a7e84c634603f099edd08c7369f89bdbee250c14cb41413250e0f1264ca6bce8316d450ed6ca5885452698f697b33bceb771c8b12c593213ea20e28c7
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSQ:8MEX0wIyNjaQ
TLSH
T11B43639D5F2C2221C57E283ED7E143635B7C93DF572392623D908CF98DC206974358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.shihab.ffzunebd/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 c5012424bcd7973b91883c58091a8c6c392dc8aec321e3c8dfc9980b4b2ea2c9
MD5 f687925c32bc2a75299a07065c3b1123
SHA1 43c0791913a275ad8a0b3d59e78b5ff92a96c047
SHA512 7a0b692d8cc86b3e160edf668bedd10a8bc4c9c5b909f1197a583c8794318b4c12b06123d2d63781cd972d71a4783ad192460ef5697e418e2ad624bc3616d244
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.shihab.ffzunebd/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 bddf49c1f2356c91f198eb8fa3bfd11eb053e1bd8dce85ed3c2d3e78e0553224
MD5 3930303d99e88a1f06c66db825059d0f
SHA1 145ef3f0c078664308c90647dddf2d0d9d735d9c
SHA512 c70818f6ac8c2e53bc477564bbcfe94da5d5fd46bfa7f8e1d48df5f5e3ae3c3bbc7d4d79d9e6295b845b0b8c6720ffc44d7b4bbe21fb470968b716b5f55016cd
SSDEEP 6:7+/l9DyGn1mpg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKCq:7+t9yrpqLiuWdwRmBEyPbFq
TLSH
T1D90222C977800823C82A16BB94E883440D01E71AE161CB071760089C7C0B4CCB4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.shihab.ffzunebd/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 30f9bb4627c86ba7f612a56a64bb1f0edb0791798341d9a9200683204da7d212
MD5 0540a50d502469cbadd9800b3b60c4e0
SHA1 762cdd46e19211b3867e94c8e26757e6f6f78349
SHA512 29e408fe7b3f2decd8edec9a21643f5ddf03a04f49ed898a8e9747b273534f0bf43b223992c030161d3833b3c723011f2b50db4cba791c46c57978d2874f1b80
SSDEEP 6:7+/l9lPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKy0vM/W:7+tbqLJdTRmBEyPbD00W
TLSH
T1010222A963401813C22A57B790D883412E20A72A87A3CB07156018983C066DCEC90D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation6383300785123056661tmp

Path /data/data/com.shihab.ffzunebd/files/PersistedInstallation6383300785123056661tmp
Size 568B
SHA256 a71f153952b8c12c82a14578281f2a5a8d1746c8e8673947f584c290dcdf6a6e
MD5 5a5660770dbcaf2ea127591a1f10b860
SHA1 42872a4df54da585ebfda20bb242580f78f6db4b
SHA512 34944e655b6b781d078986554c2153414ab44bad83a8387c329fce98badbfc3dc87d9b9a38d2c45f890e0292ecc27fbe4506721eaf91441f4ee9238d75d6fdd2
TLSH
T1C5F041065A610A2ED0EA124A3A89BD084C0B08141A5411EDFF9B8CB609F22BFA58BA48
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation95458438986012376tmp

Path /data/data/com.shihab.ffzunebd/files/PersistedInstallation95458438986012376tmp
Size 90B
SHA256 1e216f890d889906c67c1c2455c9a83bbd156f79af226fa09494520a59a25976
MD5 99ab885ca2426586d0393bba87443317
SHA1 9353f519b2936e962b8f5ada7f42857b1ba51243
SHA512 077e20e716013ed54c7319827d594b5b1760e17f31ee10f1b23c6bbdb641c23d880aa2e8d023b6a14d7c9284394a54f59ac928ac4f6fd48e0947eb3698fc25c6
TLSH
T1F7B012026E3042518A9EB3072E4DD1401F91184115899E181A8D948000D52F38103A98
MD5 SHA1 SHA512 TLSH

Submit Download

profileInstalled

Path /data/data/com.shihab.ffzunebd/files/profileInstalled
Size 24B
SHA256 4e8849ca789f1539677dc9aa8555e7886df497682aaa0cdb0338f6e85d8ad555
MD5 ac03fe88ccea1253965d949b216f8aee
SHA1 00279005159b079ca4eec30612dd949d47c48104
SHA512 856f13dd136ad5a91376fa045938c88fe6c7fa15c03d169c365970d4927a29293218756d9a6494ca4a4e7b2e6ee5302546e567005cfb0655a71b4ff2a86f9f9b
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.shihab.ffzunebd/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.shihab.ffzunebd/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 ea90eb111c91879fd7e2d309be6f22ee60319e4981fc0fc2e31ce1a2911b033b
MD5 66cf0c58d708beff1972b22702db1ff6
SHA1 9a6e960b82377bc0928c84c9194a342ba1f55bb7
SHA512 cf6b169ba3120f429f4a72d22aa25e56da58673ba18561def49636bbd74a267fac25e70bd6b0f4cc63023f6d41b936391bac9372b11872c7dac5671b091577ab
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.shihab.ffzunebd/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.shihab.ffzunebd/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 84959601bba45f161c343ebd8c756798ef45813496f952613330db66ed396c2b
MD5 91cafc815db5bc02cd32d7110f2d3984
SHA1 fdd7befa05222b373cb1feeeb1132f951b02669a
SHA512 3c30a7e0cb916602cd3beab859109b8bbadf32c0cde9fe4d0a273d43caf432ebc6cd94af40ea1502056f58a5690caacc1b21fc0b0f06dace99ef26289b21b1af
SSDEEP 192:1eXcya+6dW2sB7qX1g7SWViYoEQHYndjnHt9S/f8JzSV+6D86T0ED:ohndjnHt9S/f8JzSk6D86T0ED
TLSH
T1E9B3228D0F592680C09F64B495D00FB2797E812EC793E3D6A5910075EDD6931EE2DCFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.shihab.ffzunebd/no_backup/androidx.work.workdb-wal
Size 193KB
SHA256 0fe1013511f9600dc34f016487c1871f4c478bc392bbe2159c9b4d5ce16e62c8
MD5 b229a751775cb4f4f9283a620c90a6d1
SHA1 42ae730a06d024bb5bc7c0f56ccae79315cef7b9
SHA512 79ef5974bd1c978820da6d2332cd242a8899d0b3abc5c8bcc371c468905b811dd4d74ac55563487dc99676a7086c9a5c6810a14cfc2875423cf14ab50b74af46
SSDEEP 192:Oz31DtYkMVODU4TmRFU1DtYfZhM1DtYS1DtYC:O1DtYyOY1DtYo1DtYS1DtYC
TLSH
T1B0144BE7B71EC8B0FE0F263F655391E30A7794E90F8659E5E15B432451CE1A2A3E7210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.shihab.ffzunebd/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 970a581df1a78e85d63e7a89ecb4667cb1a2ca0ec79e19a6fdc28ffefc313ea6
MD5 0a27d0a8ca474343796d20231da7aa97
SHA1 28e3abe362631fb646feaad2c2d59926136c6049
SHA512 480769f5e82bbffac6684ab9e9a5f0e03e7c285c50a833984225001700ef907274c75959aa8003b7e4c18dd3addcfdca7f2ebf3a5792ea37fe5ef9dcdf86e775
SSDEEP 12:KGTnE4+zdTRmBEyPbP/gTcHX2TsTv4Ow2:KCE4+zyGSP/gTYXZC2
TLSH
T135728C40674049D3D40B173A5494C3060EA0E61ACB12C7CFA16124656C097ECA8D8E18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads