26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T440,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 02d24ebffc14… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 02d24ebffc14…. Threat score 100/100. 0/27 AV engines flagged this file. 4 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5"],"about":{"@type":"SoftwareApplication","name":"VPN 4X Premium v13.0 Premium Mod Apk {CracksHash}.apk","applicationCategory":["android"],"identifier":"02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tb5c,"assets/nopie_openvpn.arm64-v8a" (Indicator: "open") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "assets/nopie_openvpn.armeabi-v7a" (Indicator: "open") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "assets/nopie_openvpn.x86" (Indicator: "open") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "assets/nopie_openvpn.x86_64" (Indicator: "open") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "assets/pie_openvpn.arm64-v8a" (Indicator: "open") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "assets/pie_openvpn.armeabi-v7a" (Indicator: "open") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "assets/pie_openvpn.x86" (Indicator: "open") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "assets/pie_openvpn.x86_64" (Indicator: "open") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "firebase-measurement-connector.properties+K-*" (Indicator: "connect") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "res/animator/fragment_open_enter.xml" (Indicator: "open") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "res/animator/fragment_open_exit.xml" (Indicator: "open") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "res/color/abc_background_cache_hint_selector_material_dark.xmluP" (Indicator: "select") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "res/color/abc_background_cache_hint_selector_material_light.xmluP" (Indicator: "select") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "res/color/m3_button_background_color_selector.xml" (Indicator: "select") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "res/color/m3_button_foreground_color_selector.xml" (Indicator: "select") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "res/color/m3_button_outline_color_selector.xmluP" (Indicator: "select") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "res/color/m3_button_ripple_color_selector.xml" (Indicator: "select") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "res/color/m3_navigation_bar_ripple_color_selector.xml" (Indicator: "select") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "res/color/m3_selection_control_button_tint.xml" (Indicator: "select") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk "res/color/m3_selection_control_ripple_color_selector.xml" (Indicator: "select") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk28:T123e,Heuristic match: "f8E68P.bj" Heuristic match: "lib/arm64-v8a/libhydra.so" Heuristic match: "lib/arm64-v8a/libosslspeedtest.so" Heuristic match: "lib/arm64-v8a/libovpnexec.so" Heuristic match: "lib/arm64-v8a/libpartner-celpher.so" Heuristic match: "lib/arm64-v8a/libping-lib.so" Heuristic match: "jHsDx~.uS" Heuristic match: "lib/x86/libhydra.so" Heuristic match: "lib/x86/libosslspeedtest.so" Heuristic match: "lib/x86/libovpnexec.so" Heuristic match: "lib/x86/libpartner-celpher.so" Heuristic match: "lib/x86/libping-lib.so" Heuristic match: "lib/x86_64/libhydra.so" Heuristic match: "lib/x86_64/libosslspeedtest.so" Heuristic match: "lib/x86_64/libovpnexec.so" Heuristic match: "lib/x86_64/libpartner-celpher.so" Heuristic match: "lib/x86_64/libping-lib.so" Heuristic match: "EWJ36{9:}mS?.so" Pattern match: "ns.adobe.com/xap/1.0/" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "https://www.istockphoto.com/photo/license-gm1217966894-?utm_medium=organic&utm_source=google&utm_campaign=iptcurl" Pattern match: "http://www.iec.ch" Heuristic match: ":my.custom.vpn.process.name" Pattern match: "https://docs.google.com/document/d/1a1SusKWKM3AAjrC7cqlVqN221LGcMgYI6l2SOengfAg/edit?usp=sharing" Heuristic match: "neongamingstudio90@gmail.com" Pattern match: "https://pagead2.googlesyndication.com/pagead/gen_204?id=gmob-apps" Pattern match: "www.google.com" Pattern match: "http://connectivitycheck.gstatic.com/generate_204" Heuristic match: "connectivitycheck.gstatic.com" Pattern match: "https://connectivitycheck.gstatic.com/generate_204" Pattern match: "http://www.android.com/" Pattern match: "https://www.facebook.com/adnw_logging/" Pattern match: "http://play.google.com/store/account/subscriptions?package=" Pattern match: "https://api.pango-paas.co" Pattern match: "https://android.stable-vpn.com" Pattern match: "https://d1pijg9qb98hxx.cloudfront.net" Pattern match: "https://google.com/" Pattern match: "https://apple.com" Pattern match: "https://microsoft.com" Pattern match: "https://yahoo.com" Pattern match: "https://baidu.com" Pattern match: "https://amazon.com" Pattern match: "https://instagram.com" Pattern match: "https://linkedin.com" Pattern match: "https://ebay.com" Pattern match: "https://bing.com" Pattern match: "https://goo.gl" Pattern match: "https://outlook.live.com" Pattern match: "https://wikipedia.org" Pattern match: "https://office.com" Pattern match: "https://google.com/generate_204" Pattern match: "https://gstatic.com/generate_204" Pattern match: "https://maps.google.com/generate_204" Pattern match: "https://www.google.com/generate_204" Pattern match: "https://clients3.google.com/generate_204" Pattern match: "https://api-%s.northghost.com/storage/project/%s/files/%s/%s" Pattern match: "https://api64.ipify.org/?format=json" Pattern match: "https://file-examples-com.github.io/uploads/2017/02/file_example_JSON_1kb.json" Pattern match: "https://api.ipify.org" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0" Pattern match: "https://github.com/seancfoley/IPAddress/blob/master/LICENSE" Heuristic match: "Name: META-INF/androidx.localbroadcastmanager_localbroadcastmanager.ve" Heuristic match: "Name: lib/arm64-v8a/libhydra.so" Heuristic match: "Name: lib/arm64-v8a/libosslspeedtest.so" Heuristic match: "Name: lib/arm64-v8a/libovpnexec.so" Heuristic match: "Name: lib/arm64-v8a/libpartner-celpher.so" Heuristic match: "Name: lib/arm64-v8a/libping-lib.so" Heuristic match: "Name: lib/x86/libhydra.so" Heuristic match: "Name: lib/x86/libosslspeedtest.so" Heuristic match: "Name: lib/x86/libovpnexec.so" Heuristic match: "Name: lib/x86/libpartner-celpher.so" Heuristic match: "Name: lib/x86/libping-lib.so" Heuristic match: "Name: lib/x86_64/libhydra.so" Heuristic match: "Name: lib/x86_64/libosslspeedtest.so" Heuristic match: "Name: lib/x86_64/libovpnexec.so" Heuristic match: "Name: lib/x86_64/libpartner-celpher.so" Heuristic match: "Name: lib/x86_64/libping-lib.so" Heuristic match: "Name: res/drawable-hdpi-v4/abc_scrubber_control_to_pressed_mtrl_000.pn" Heuristic match: "Name: res/drawable-hdpi-v4/abc_scrubber_control_to_pressed_mtrl_005.pn" Heuristic match: "Name: res/drawable-mdpi-v4/abc_scrubber_control_to_pressed_mtrl_000.pn" Heuristic match: "Name: res/drawable-mdpi-v4/abc_scrubber_control_to_pressed_mtrl_005.pn" Heuristic match: "Name: res/drawable-xhdpi-v4/abc_list_selector_disabled_holo_light.9.pn" Heuristic match: "Name: res/drawable-xxhdpi-v4/abc_list_selector_disabled_holo_dark.9.pn" Heuristic match: "Name: res/drawable-xxhdpi-v4/ic_os_notification_fallback_white_24dp.pn"29:T611,"" id="W5M0MpCehiHzreSzNTczkc9d"?> titoOnzFlag of Iceland blowing in the wind. Full page Icelandic flying flag. 3D illustration. https://www.istockphoto.com/photo/license-gm1217966894-?utm_medium=organic&utm_source=google&utm_campaign=iptcurl " (Indicator: "https://") in Source: 02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5.apk1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791173065996,"unified_at":"2026-10-05T04:04:25.996Z","metadata":{"hashes":{"sha256":"02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5","sha1":"9f841b88bf11583d311b62f8c5de4a19efeb4cbc","md5":"0ee10110021c6172944259169bab6d8f","sha512":"6d7b78f2aaf876b9db4796c4da78a31ea9a1d15d9f313233960e86dd22bb68a959fd31e0e2af607bb80ced7993d07b0b5debd2f26e0747abed80fa0c2a46afa7","ssdeep":"393216:Ru71DlnROA90BN52OZ3SirfpjCthYsmcjB9Geg04hQUFBILEPZOHYWnxixilXL4p:Ru7Ti2OZjbpihZVXnaDdBOHYwoxwLdZi","ssdeep_chunks":["393216:Ru71Dln","393216:u71DlnR","393216:71DlnRO","393216:1DlnROA","393216:DlnROA9","393216:lnROA90","393216:nROA90B","393216:ROA90BN","393216:OA90BN5","393216:A90BN52","393216:90BN52O","393216:0BN52OZ","393216:BN52OZ3","393216:N52OZ3S","393216:52OZ3Si","393216:2OZ3Sir","393216:OZ3Sirf","393216:Z3Sirfp","393216:3Sirfpj","393216:SirfpjC","393216:irfpjCt","393216:rfpjCth","393216:fpjCthY","393216:pjCthYs","393216:jCthYsm","393216:CthYsmc","393216:thYsmcj","393216:hYsmcjB","393216:YsmcjB9","393216:smcjB9G","393216:mcjB9Ge","393216:cjB9Geg","393216:jB9Geg0","393216:B9Geg04","393216:9Geg04h","393216:Geg04hQ","393216:eg04hQU","393216:g04hQUF","393216:04hQUFB","393216:4hQUFBI","393216:hQUFBIL","393216:QUFBILE","393216:UFBILEP","393216:FBILEPZ","393216:BILEPZO","393216:ILEPZOH","393216:LEPZOHY","393216:EPZOHYW","393216:PZOHYWn","393216:ZOHYWnx","393216:OHYWnxi","393216:HYWnxix","393216:YWnxixi","393216:Wnxixil","393216:nxixilX","393216:xixilXL","393216:ixilXL4","393216:xilXL4p","786432:Ru71Dln","786432:u71DlnR","786432:71DlnRO","786432:1DlnROA","786432:DlnROA9","786432:lnROA90","786432:nROA90B","786432:ROA90BN","786432:OA90BN5","786432:A90BN52","786432:90BN52O","786432:0BN52OZ","786432:BN52OZ3","786432:N52OZ3S","786432:52OZ3Si","786432:2OZ3Sir","786432:OZ3Sirf","786432:Z3Sirfp","786432:3Sirfpj","786432:SirfpjC","786432:irfpjCt","786432:rfpjCth","786432:fpjCthY","786432:pjCthYs","786432:jCthYsm","786432:CthYsmc","786432:thYsmcj","786432:hYsmcjB","786432:YsmcjB9","786432:smcjB9G","786432:mcjB9Ge","786432:cjB9Geg","786432:jB9Geg0","786432:B9Geg04","786432:9Geg04h","786432:Geg04hQ","786432:eg04hQU","786432:g04hQUF","786432:04hQUFB","786432:4hQUFBI","786432:hQUFBIL","786432:QUFBILE","786432:UFBILEP","786432:FBILEPZ","786432:BILEPZO","786432:ILEPZOH","786432:LEPZOHY","786432:EPZOHYW","786432:PZOHYWn","786432:ZOHYWnx","786432:OHYWnxi","786432:HYWnxix","786432:YWnxixi","786432:Wnxixil","786432:nxixilX","786432:xixilXL","786432:ixilXL4","786432:xilXL4p","393216:Ru7Ti2O","393216:u7Ti2OZ","393216:7Ti2OZj","393216:Ti2OZjb","393216:i2OZjbp","393216:2OZjbpi","393216:OZjbpih","393216:ZjbpihZ","393216:jbpihZV","393216:bpihZVX","393216:pihZVXn","393216:ihZVXna","393216:hZVXnaD","393216:ZVXnaDd","393216:VXnaDdB","393216:XnaDdBO","393216:naDdBOH","393216:aDdBOHY","393216:DdBOHYw","393216:dBOHYwo","393216:BOHYwox","393216:OHYwoxw","393216:HYwoxwL","393216:YwoxwLd","393216:woxwLdZ","393216:oxwLdZi"],"imphash":"Unknown"},"file_info":{"file_name":"VPN 4X Premium v13.0 Premium Mod Apk {CracksHash}.apk","file_type":["android"],"file_type_id":"apk","file_size":21735072,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1653077002000,"last_seen":1663555585000,"last_multi_scan":1663555585000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":7,"suspicious_count":7,"malicious_count":4,"total":18},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Broadcast Receivers","attack_id":"T1402","attack_id_wiki":"https://attack.mitre.org/techniques/T1402","identifiers":[{"type":"malicious","value":"Has the ability to execute code after reboot"}],"sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"tactic":"Persistence","technique":"Code Injection","attack_id":"T1540","attack_id_wiki":"https://attack.mitre.org/techniques/T1540","identifiers":[{"type":"malicious","value":"Has the ability to use the DexClassLoader (possible code injection)"}],"sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"tactic":"Defense Evasion","technique":"Application Discovery","attack_id":"T1418","attack_id_wiki":"https://attack.mitre.org/techniques/T1418","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1421","attack_id_wiki":"https://attack.mitre.org/techniques/T1421","identifiers":[{"type":"informative","value":"Tests the internet connectivity"}],"sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1422","attack_id_wiki":"https://attack.mitre.org/techniques/T1422","identifiers":[{"type":"suspicious","value":"Has the ability to get the wifi MAC address (may be used to fingerprint device)"}],"sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]}],"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/61 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DebugProbesKt.bin\" as clean (type is \"compiled Java class data version 52.0 (Java 1.8)\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$27","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"informative","category":"General","name":"Tests the internet connectivity","description":"Found invoke in \"f.c.q.w.o.smali\" to \"android.net.ConnectivityManager.getNetworkInfo\"\n Found invoke in \"f.c.q.w.o.smali\" to \"android.net.NetworkInfo.isConnected\"\n Found invoke in \"f.c.q.w.o.smali\" to \"android.net.ConnectivityManager.getActiveNetworkInfo\"\n Found invoke in \"f.c.q.u.i.smali\" to \"android.net.ConnectivityManager.getActiveNetworkInfo\"\n Found invoke in \"f.c.q.u.i.smali\" to \"android.net.NetworkInfo.getState\"\n Found invoke in \"f.c.q.u.i.smali\" to \"android.net.wifi.WifiManager.getConnectionInfo\"\n Found invoke in \"f.c.q.u.e.smali\" to \"android.net.NetworkInfo.isConnected\"\n Found invoke in \"f.c.q.u.e.smali\" to \"android.net.NetworkInfo.getState\"\n Found invoke in \"f.c.q.u.e.smali\" to \"android.net.NetworkInfo.getDetailedState\"\n Found invoke in \"f.c.p.j.smali\" to \"android.net.NetworkInfo.isConnected\"\n Found invoke in \"f.c.p.j.smali\" to \"android.net.ConnectivityManager.getActiveNetworkInfo\"\n Found invoke in \"f.c.p.r.e.smali\" to \"android.net.ConnectivityManager.getActiveNetworkInfo\"","origin":"Static Parser","mitre_attack_id":"T1421","relevance":3,"id":"static-41","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"https://www.facebook.com/adnw_logging/\" (Indicator: \"facebook.com\")\n \"https://linkedin.com\" (Indicator: \"linkedin.com\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"bitdefender\" (Indicator: \"bitdefender\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"SHA-256-Digest: 6BbcCZj07pDXtjDxfhb8wuctkQeMUxWtqsS8LaTCJtc=\" (Indicator: \"qemu\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"neongamingstudio90@gmail.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"suspicious","category":"General","name":"Uses java reflection classes","description":"Found invoke in \"com.facebook.soloader.SoLoader$1.smali\" to \"java.lang.reflect.Method.invoke\"\n Found invoke in \"com.facebook.soloader.SoLoader$Api14Utils.smali\" to \"java.lang.reflect.Method.invoke\"\n Found invoke in \"com.facebook.ads.internal.dynamicloading.DynamicLoaderFactory.smali\" to \"java.lang.reflect.Method.invoke\"\n Found invoke in \"com.facebook.ads.internal.bridge.fbsdk.FBLoginASID.smali\" to \"java.lang.reflect.Method.invoke\"\n Found invoke in \"com.facebook.ads.internal.util.process.ProcessUtils.smali\" to \"java.lang.reflect.Method.invoke\"\n Found invoke in \"com.facebook.ads.internal.util.process.ProcessUtils.smali\" to \"java.lang.reflect.Field.get\"\n Found invoke in \"f.d.a.c.e.smali\" to \"java.lang.reflect.Field.get\"\n Found invoke in \"f.c.i.d.j.c.smali\" to \"java.lang.reflect.Method.invoke\"","origin":"Static Parser","relevance":3,"id":"static-47","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"00.000.000.00\"\n \"6.10.0.0\"\n \"10.1.1.1\"\n \"127.0.0.1\"\n Potential IP \"6.10.0.0\" found in string \"GOOGLE:6.10.0.0\"\n \"10.254.0.1\"\n \"8.8.8.8\"\n \"100.64.250.1\"\n \"8.8.4.4\"\n \"128.0.0.0\"\n \"0.0.0.0\"\n Potential IP \"255.255.255.255\" found in string \"ipaddress.error.ip.format=invalid format of IP address, whether IPv4 (255.255.255.255) or IPv6 (ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff) or other supported format\"\n Potential IP \"255.255.255.255\" found in string \"ipaddress.error.ipv4.format=invalid format of IPv4 (255.255.255.255) address\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"suspicious","category":"Network Related","name":"Has the ability to open an internet connection","description":"Found invoke in \"com.google.android.gms.ads.identifier.zza.smali\" to \"java.net.URL.openConnection\"\n Found invoke in \"com.facebook.ads.internal.dynamicloading.DexLoadErrorReporter$1.smali\" to \"java.net.URL.openConnection\"\n Found invoke in \"f.b.a.a0.b.smali\" to \"java.net.URL.openConnection\"\n Found invoke in \"f.c.m.qa.a.smali\" to \"java.net.URL.openConnection\"","origin":"Static Parser","relevance":3,"id":"static-46","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Has the ability to get the wifi MAC address (may be used to fingerprint device)","description":"Found invoke in \"f.c.i.d.j.e$f.smali\" to \"android.net.wifi.WifiInfo.getMacAddress\"","origin":"Static Parser","mitre_attack_id":"T1422","relevance":10,"id":"static-53","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"malicious","category":"General","name":"Has the ability to read the device ID (e.g. IMEI or ESN)","description":"Found invoke in \"f.c.i.d.j.e$d.smali\" to \"android.telephony.TelephonyManager.getSimSerialNumber\"\n Found invoke in \"f.c.i.d.j.e$e.smali\" to \"android.telephony.TelephonyManager.getDeviceId\"","origin":"Static Parser","relevance":3,"id":"static-42","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"malicious","category":"Installation/Persistence","name":"Has the ability to execute code after reboot","description":"Permission request for \"android.permission.RECEIVE_BOOT_COMPLETED\"","origin":"Static Parser","mitre_attack_id":"T1402","relevance":10,"id":"static-28","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"https://api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"a.smali\")","origin":"File/Memory","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Has the ability to use the DexClassLoader (possible code injection)","description":"Found invoke in \"com.facebook.ads.internal.dynamicloading.DynamicLoaderFactory.smali\" to \"dalvik.system.DexClassLoader.\"","origin":"Static Parser","mitre_attack_id":"T1540","relevance":3,"id":"static-54","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]}],"incidents":[{"name":"Fingerprint","details_count":3,"details":[{"detail":"Has the ability to read the device ID (e.g. IMEI or ESN)"},{"detail":"Has the ability to get the wifi MAC address (may be used to fingerprint device)"},{"detail":"Has the ability to identify network operator related data"}],"sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Has the ability to execute code after reboot"},{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]}]},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6287f407f28de5691d533e56","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"VPN 4X Premium v13.0 Premium Mod Apk {CracksHash}.apk","analysis_start_time":"2022-05-20T20:03:24+00:00","indicators_count":{"informative":7,"suspicious":10,"malicious":4},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DebugProbesKt.bin","sha256":"2607dd7a7379d775a8b8c011f0336576f57320617e9d6a5e152b52dbcdc9ddae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"AndroidManifest.xml","sha256":"00a23697c20ea422c5860b2bd3ad2fd28f4b79d1906216fa79169b03f6bbfbf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"BNDLTOOL.RSA","sha256":"1ca223b0e92b100506b111d21a67966649b9ac59fbf6eb2af9b9799d2cf9b434","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"BNDLTOOL.SF","sha256":"39fd4c3490090c72ccd6aab1a635b6ffe01fa0b235604980f795c052ebe0d2de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"IPAddressResources.properties","sha256":"dd299e6ae55f0f740380d2beec6b5810f2b1e0259dc2c16ce16ce004cc7d9c94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"MANIFEST.MF","sha256":"94b66b42bfd5a9c14065cb0db6f7546cb69a84b96e0687c2c7097488748941e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidsupportmultidexversion.txt","sha256":"a1c3b0007bcaecc29cb7b7fa4a2ace25036988d66a354c0fd6bdea6eb51568fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidx.activity_activity.version","sha256":"563a0b4eec3c77bbc34ac630d4fa5214f5c6726ae01468404fd704473110084e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidx.annotation_annotation-experimental.version","sha256":"1575e1af4a95f12f70b4ee6a6adce8160953d93ea17dc2611b90883ccc3ad3b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidx.appcompat_appcompat-resources.version","sha256":"7d072b48526b023950e4c48db01e8c273554a6401119f5691e7589ba9bc65d9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidx.appcompat_appcompat.version","sha256":"7d072b48526b023950e4c48db01e8c273554a6401119f5691e7589ba9bc65d9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidx.arch.core_core-runtime.version","sha256":"c89b87c262e9d5ffd20e73aac74a1772adcc9f5a21682cc33adcf5086e5fef5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidx.asynclayoutinflater_asynclayoutinflater.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidx.browser_browser.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidx.cardview_cardview.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidx.coordinatorlayout_coordinatorlayout.version","sha256":"1575e1af4a95f12f70b4ee6a6adce8160953d93ea17dc2611b90883ccc3ad3b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidx.core_core.version","sha256":"bb7320d831e7a151aa901c35e7326c752fa2ef5024f30768c42319b8bed171ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidx.cursoradapter_cursoradapter.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidx.customview_customview.version","sha256":"1575e1af4a95f12f70b4ee6a6adce8160953d93ea17dc2611b90883ccc3ad3b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]},{"name":"androidx.documentfile_documentfile.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6287f407f28de5691d533e56"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6287f407f28de5691d533e56"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 02d24ebffc14… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 02d24ebffc14…. Threat score 100/100. 0/27 AV engines flagged this file. 4 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 02d24ebffc14… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 02d24ebffc14…. Threat score 100/100. 0/27 AV engines flagged this file. 4 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/02d24ebffc1490250f072ba11ef41599c94718e7370ae577e860777edb9d7db5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 02d24ebffc14… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 02d24ebffc14…. Threat score 100/100. 0/27 AV engines flagged this file. 4 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]