24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T453,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 03b30a946230… — Score 95/100 — Hybrid Analysis","description":"Malicious verdict for sample 03b30a946230…. Threat score 95/100. 0/23 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/03b30a946230584d42be6b2225aeb4a2968c874f429c1473cee6029699fa1984","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","03b30a946230584d42be6b2225aeb4a2968c874f429c1473cee6029699fa1984"],"about":{"@type":"SoftwareApplication","name":"LockMyPix Safe Photo Vault v5.2.7.3 Gemini Premium Mod Apk {CracksHash}.apk","applicationCategory":["android"],"identifier":"03b30a946230584d42be6b2225aeb4a2968c874f429c1473cee6029699fa1984","additionalType":"Malicious sample"},"threatScore":95,"antivirusDetections":{"malicious":0,"total":23},"behavioralIndicators":{"malicious":2,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1048,"DELETE FROM `nobject` WHERE `id` = ?" (Source: e8.m$b.smali, Indicator: "delete from `nobject` where `id` = ?") "DELETE FROM df" (Source: e8.h$d.smali, Indicator: "delete from df") "INSERT OR REPLACE INTO `df` (`a0`,`a1`,`a2`) VALUES (?,?,?)" (Source: e8.h$a.smali, Indicator: "insert or replace into `df` (`a0`,`a1`,`a2`) values (?,?,?)"), "DELETE FROM `df` WHERE `a0` = ?" (Source: e8.h$b.smali, Indicator: "delete from `df` where `a0` = ?"), "INSERT OR REPLACE INTO `sfo` (`tf`,`fn`,`fp`,`fc`) VALUES (?,?,?,?)" (Source: e8.b$a.smali, Indicator: "insert or replace into `sfo` (`tf`,`fn`,`fp`,`fc`) values (?,?,?,?)"), "DELETE FROM nobject WHERE id = ?" (Source: e8.m$d.smali, Indicator: "delete from nobject where id = ?"), "SELECT * FROM ldo WHERE f2 = ?" (Source: e8.d.smali, Indicator: "select * from ldo where f2 = ?"), "SELECT * FROM ldo WHERE f1 = ?" (Source: e8.d.smali, Indicator: "select * from ldo where f1 = ?"), "SELECT * FROM ldo WHERE f2 LIKE?" (Source: e8.d.smali, Indicator: "select * from ldo where f2 like?"), "DELETE FROM `ldo` WHERE `f1` = ?" (Source: e8.d$b.smali, Indicator: "delete from `ldo` where `f1` = ?"), "UPDATE OR ABORT `ldo` SET `f1` = ? `f2` = ? WHERE `f1` = ?" (Source: e8.d$c.smali, Indicator: "update or abort `ldo` set `f1` = ? `f2` = ? where `f1` = ?"), "UPDATE OR ABORT `nobject` SET `id` = ? `title` = ? `content` = ? `date` = ? `position` = ? `color` = ? WHERE `id` = ?" (Source: e8.m$c.smali, Indicator: "update or abort `nobject` set `id` = ? `title` = ? `content` = ? `date` = ? `position` = ? `color` = ? where `id` = ?"), "SELECT * FROM df ORDER BY CASE a2 WHEN \'UPDATE_FILE\' THEN 0 WHEN \'DELETE_FILE\' THEN 1 WHEN \'TRASH_FILE\' THEN 2 WHEN \'DOWNLOAD_NOTES\' THEN 3 END" (Source: e8.h.smali, Indicator: "select * from df order by case a2 when \'update_file\' then 0 when \'delete_file\' then 1 when \'trash_file\' then 2 when \'download_notes\' then 3 end"), "DELETE FROM `sfo` WHERE `tf` = ?" (Source: e8.b$b.smali, Indicator: "delete from `sfo` where `tf` = ?"), "INSERT OR REPLACE INTO `ldo` (`f1`,`f2`) VALUES (?,?)" (Source: e8.d$a.smali, Indicator: "insert or replace into `ldo` (`f1`,`f2`) values (?,?)"), "UPDATE OR ABORT `df` SET `a0` = ? `a1` = ? `a2` = ? WHERE `a0` = ?" (Source: e8.h$c.smali, Indicator: "update or abort `df` set `a0` = ? `a1` = ? `a2` = ? where `a0` = ?"), "UPDATE OR ABORT `sfo` SET `tf` = ? `fn` = ? `fp` = ? `fc` = ? WHERE `tf` = ?" (Source: e8.b$c.smali, Indicator: "update or abort `sfo` set `tf` = ? `fn` = ? `fp` = ? `fc` = ? where `tf` = ?"), "SELECT * FROM nobject WHERE (title <> \'\' OR content <> \'\') AND (title Like ? or content Like ?) ORDER BY date DESC" (Source: e8.m.smali, Indicator: "select * from nobject where (title <> \'\' or content <> \'\') and (title like ? or content like ?) order by date desc"), "SELECT * FROM nobject WHERE (title <> \'\' OR content <> \'\') AND (title Like ? or content Like ?) ORDER BY title ASC" (Source: e8.m.smali, Indicator: "select * from nobject where (title <> \'\' or content <> \'\') and (title like ? or content like ?) order by title asc"), "SELECT * FROM nobject WHERE (title <> \'\' OR content <> \'\') AND (title Like ? or content Like ?) ORDER BY title DESC" (Source: e8.m.smali, Indicator: "select * from nobject where (title <> \'\' or content <> \'\') and (title like ? or content like ?) order by title desc"), "SELECT * FROM nobject WHERE id = ?" (Source: e8.m.smali, Indicator: "select * from nobject where id = ?"), "SELECT * FROM nobject WHERE (title <> \'\' OR content <> \'\') AND (title Like ? or content Like ?) ORDER BY date ASC" (Source: e8.m.smali, Indicator: "select * from nobject where (title <> \'\' or content <> \'\') and (title like ? or content like ?) order by date asc"), "DELETE FROM sfo" (Source: e8.b$d.smali, Indicator: "delete from sfo"), "DELETE FROM ldo" (Source: e8.d$d.smali, Indicator: "delete from ldo"), "CREATE TABLE IF NOT EXISTS sortorder (_id TEXT NOT NULL, sort INTEGER(5) dir STRING(256) NULL PRIMARY KEY (_id, dir));" (Source: e8.e.smali, Indicator: "create table if not exists sortorder (_id text not null, sort integer(5) dir string(256) null primary key (_id, dir));")26:T1048,"DELETE FROM `nobject` WHERE `id` = ?" (Source: e8.m$b.smali, Indicator: "delete from `nobject` where `id` = ?") "DELETE FROM df" (Source: e8.h$d.smali, Indicator: "delete from df") "INSERT OR REPLACE INTO `df` (`a0`,`a1`,`a2`) VALUES (?,?,?)" (Source: e8.h$a.smali, Indicator: "insert or replace into `df` (`a0`,`a1`,`a2`) values (?,?,?)"), "DELETE FROM `df` WHERE `a0` = ?" (Source: e8.h$b.smali, Indicator: "delete from `df` where `a0` = ?"), "INSERT OR REPLACE INTO `sfo` (`tf`,`fn`,`fp`,`fc`) VALUES (?,?,?,?)" (Source: e8.b$a.smali, Indicator: "insert or replace into `sfo` (`tf`,`fn`,`fp`,`fc`) values (?,?,?,?)"), "DELETE FROM nobject WHERE id = ?" (Source: e8.m$d.smali, Indicator: "delete from nobject where id = ?"), "SELECT * FROM ldo WHERE f2 = ?" (Source: e8.d.smali, Indicator: "select * from ldo where f2 = ?"), "SELECT * FROM ldo WHERE f1 = ?" (Source: e8.d.smali, Indicator: "select * from ldo where f1 = ?"), "SELECT * FROM ldo WHERE f2 LIKE?" (Source: e8.d.smali, Indicator: "select * from ldo where f2 like?"), "DELETE FROM `ldo` WHERE `f1` = ?" (Source: e8.d$b.smali, Indicator: "delete from `ldo` where `f1` = ?"), "UPDATE OR ABORT `ldo` SET `f1` = ? `f2` = ? WHERE `f1` = ?" (Source: e8.d$c.smali, Indicator: "update or abort `ldo` set `f1` = ? `f2` = ? where `f1` = ?"), "UPDATE OR ABORT `nobject` SET `id` = ? `title` = ? `content` = ? `date` = ? `position` = ? `color` = ? WHERE `id` = ?" (Source: e8.m$c.smali, Indicator: "update or abort `nobject` set `id` = ? `title` = ? `content` = ? `date` = ? `position` = ? `color` = ? where `id` = ?"), "SELECT * FROM df ORDER BY CASE a2 WHEN \'UPDATE_FILE\' THEN 0 WHEN \'DELETE_FILE\' THEN 1 WHEN \'TRASH_FILE\' THEN 2 WHEN \'DOWNLOAD_NOTES\' THEN 3 END" (Source: e8.h.smali, Indicator: "select * from df order by case a2 when \'update_file\' then 0 when \'delete_file\' then 1 when \'trash_file\' then 2 when \'download_notes\' then 3 end"), "DELETE FROM `sfo` WHERE `tf` = ?" (Source: e8.b$b.smali, Indicator: "delete from `sfo` where `tf` = ?"), "INSERT OR REPLACE INTO `ldo` (`f1`,`f2`) VALUES (?,?)" (Source: e8.d$a.smali, Indicator: "insert or replace into `ldo` (`f1`,`f2`) values (?,?)"), "UPDATE OR ABORT `df` SET `a0` = ? `a1` = ? `a2` = ? WHERE `a0` = ?" (Source: e8.h$c.smali, Indicator: "update or abort `df` set `a0` = ? `a1` = ? `a2` = ? where `a0` = ?"), "UPDATE OR ABORT `sfo` SET `tf` = ? `fn` = ? `fp` = ? `fc` = ? WHERE `tf` = ?" (Source: e8.b$c.smali, Indicator: "update or abort `sfo` set `tf` = ? `fn` = ? `fp` = ? `fc` = ? where `tf` = ?"), "SELECT * FROM nobject WHERE (title <> \'\' OR content <> \'\') AND (title Like ? or content Like ?) ORDER BY date DESC" (Source: e8.m.smali, Indicator: "select * from nobject where (title <> \'\' or content <> \'\') and (title like ? or content like ?) order by date desc"), "SELECT * FROM nobject WHERE (title <> \'\' OR content <> \'\') AND (title Like ? or content Like ?) ORDER BY title ASC" (Source: e8.m.smali, Indicator: "select * from nobject where (title <> \'\' or content <> \'\') and (title like ? or content like ?) order by title asc"), "SELECT * FROM nobject WHERE (title <> \'\' OR content <> \'\') AND (title Like ? or content Like ?) ORDER BY title DESC" (Source: e8.m.smali, Indicator: "select * from nobject where (title <> \'\' or content <> \'\') and (title like ? or content like ?) order by title desc"), "SELECT * FROM nobject WHERE id = ?" (Source: e8.m.smali, Indicator: "select * from nobject where id = ?"), "SELECT * FROM nobject WHERE (title <> \'\' OR content <> \'\') AND (title Like ? or content Like ?) ORDER BY date ASC" (Source: e8.m.smali, Indicator: "select * from nobject where (title <> \'\' or content <> \'\') and (title like ? or content like ?) order by date asc"), "DELETE FROM sfo" (Source: e8.b$d.smali, Indicator: "delete from sfo"), "DELETE FROM ldo" (Source: e8.d$d.smali, Indicator: "delete from ldo"), "CREATE TABLE IF NOT EXISTS sortorder (_id TEXT NOT NULL, sort INTEGER(5) dir STRING(256) NULL PRIMARY KEY (_id, dir));" (Source: e8.e.smali, Indicator: "create table if not exists sortorder (_id text not null, sort integer(5) dir string(256) null primary key (_id, dir));")27:T3439,"libucrop.so_1718822352586" has type "ELF 32-bit LSB shared object Intel 80386 version 1 (SYSV) dynamically linked BuildID[sha1]=c0b65f843e2b7d7bb344e4afb0f0e20c6bb45900 stripped"- [targetUID: N/A] "libapplovin-native-crash-reporter.so_1718822352583" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked BuildID[sha1]=1914508fe2617f10a046396ef553c4161fde9010 stripped"- [targetUID: N/A] "libucrop.so" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked BuildID[sha1]=cda3d5b63c53d66abfd24bc439e948e72c3815b2 stripped"- [targetUID: N/A] "libapplovin-native-crash-reporter.so_1718822352586" has type "ELF 32-bit LSB shared object Intel 80386 version 1 (SYSV) dynamically linked BuildID[sha1]=0bf617ed8ff762d9689c6edbe64ac4bcd997b9e6 stripped"- [targetUID: N/A] "libapplovin-native-crash-reporter.so" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked BuildID[sha1]=5ff0dc0386aafaed04844afe51194c0db4f033c7 stripped"- [targetUID: N/A] "libucrop.so_1718822352587" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked interpreter /system/bin/linker BuildID[sha1]=ab69110d819cf0fb1f1dc380e735b147a47ebdbc stripped"- [targetUID: N/A] "libapplovin-native-crash-reporter.so_1718822352587" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked BuildID[sha1]=4bd0d3e516be2f207c3ea22bdd6b8d5b36c8e2d5 stripped"- [targetUID: N/A] "CERT.SF" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "MANIFEST.MF" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "public-suffix-list.txt" has type "Public Suffix List data UTF-8 Unicode text"- [targetUID: N/A] "AndroidManifest.xml" has type "Android binary XML"- [targetUID: N/A] "libpl_droidsonroids_gif.so" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked BuildID[sha1]=83f7d519aa1a05776e24e360ff500922d6df3ecf stripped"- [targetUID: N/A] "libpl_droidsonroids_gif.so_1718822352586" has type "ELF 32-bit LSB shared object Intel 80386 version 1 (SYSV) dynamically linked BuildID[sha1]=51171a716f3614114d30b9292f8581d12eb6366a stripped"- [targetUID: N/A] "libpl_droidsonroids_gif.so_1718822352587" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked BuildID[sha1]=d80aaa3ff3bb8feb9a66b534fb9e21517a9c1eee stripped"- [targetUID: N/A] "field_mask.proto" has type "ASCII text"- [targetUID: N/A] "api.proto" has type "Java source ASCII text"- [targetUID: N/A] "timestamp.proto" has type "ASCII text"- [targetUID: N/A] "type.proto" has type "Java source ASCII text"- [targetUID: N/A] "any.proto" has type "ASCII text"- [targetUID: N/A] "duration.proto" has type "ASCII text"- [targetUID: N/A] "LICENSE_OFL" has type "ASCII text"- [targetUID: N/A] "wrappers.proto" has type "ASCII text"- [targetUID: N/A] "struct.proto" has type "ASCII text"- [targetUID: N/A] "client_analytics.proto" has type "ASCII text"- [targetUID: N/A] "messaging_event.proto" has type "Perl5 module source ASCII text"- [targetUID: N/A] "empty.proto" has type "ASCII text"- [targetUID: N/A] "source_context.proto" has type "ASCII text"- [targetUID: N/A] "LICENSE_UNICODE" has type "UTF-8 Unicode text"- [targetUID: N/A] "DebugProbesKt.bin" has type "compiled Java class data version 52.0 (Java 1.8)"- [targetUID: N/A] "messaging_event_extension.proto" has type "Perl5 module source ASCII text"- [targetUID: N/A] "CERT.RSA" has type "data"- [targetUID: N/A] "kotlin-tooling-metadata.json" has type "JSON data"- [targetUID: N/A] "mimetypes.default" has type "ASCII text"- [targetUID: N/A] "mailcap.default" has type "ASCII text"- [targetUID: N/A] "version-control-info.textproto" has type "ASCII text"- [targetUID: N/A] "play-services-measurement-sdk-api.properties" has type "ASCII text"- [targetUID: N/A] "firebase-measurement-connector.properties" has type "ASCII text"- [targetUID: N/A] "play-services-measurement-impl.properties" has type "ASCII text"- [targetUID: N/A] "play-services-measurement-base.properties" has type "ASCII text"- [targetUID: N/A] "play-services-measurement-api.properties" has type "ASCII text"- [targetUID: N/A] "play-services-measurement-sdk.properties" has type "ASCII text"- [targetUID: N/A] "play-services-cloud-messaging.properties" has type "ASCII text"- [targetUID: N/A] "play-services-auth-api-phone.properties" has type "ASCII text"- [targetUID: N/A] "play-services-ads-identifier.properties" has type "ASCII text"- [targetUID: N/A] "firebase-database-collection.properties" has type "ASCII text"- [targetUID: N/A] "protolite-well-known-types.properties" has type "ASCII text"- [targetUID: N/A] "play-services-measurement.properties" has type "ASCII text"- [targetUID: N/A] "play-services-auth-base.properties" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-viewmodel-savedstate.version" has type "ASCII text"- [targetUID: N/A] "firebase-encoders-proto.properties" has type "ASCII text"- [targetUID: N/A] "firebase-analytics-ktx.properties" has type "ASCII text"- [targetUID: N/A] "user-messaging-platform.properties" has type "ASCII text"- [targetUID: N/A] "play-services-ads-lite.properties" has type "ASCII text"- [targetUID: N/A] "play-services-basement.properties" has type "ASCII text"- [targetUID: N/A] "play-services-ads-base.properties" has type "ASCII text"- [targetUID: N/A] "firebase-auth-interop.properties" has type "ASCII text"- [targetUID: N/A] "firebase-annotations.properties" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-livedata-core.version" has type "ASCII text"- [targetUID: N/A] "firebase-iid-interop.properties" has type "ASCII text"- [targetUID: N/A] "play-services-appset.properties" has type "ASCII text"- [targetUID: N/A] "play-services-tasks.properties" has type "ASCII text"- [targetUID: N/A] "play-services-stats.properties" has type "ASCII text"- [targetUID: N/A] "play-services-base.properties" has type "ASCII text"- [targetUID: N/A] "firebase-analytics.properties" has type "ASCII text"- [targetUID: N/A] "play-services-fido.properties" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-viewmodel.version" has type "ASCII text"- [targetUID: N/A] "play-services-auth.properties" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-livedata.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-service.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-runtime.version" has type "ASCII text"- [targetUID: N/A] "play-services-ads.properties" has type "ASCII text"- [targetUID: N/A] "firebase-encoders.properties" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-process.version" has type "ASCII text"- [targetUID: N/A] "androidx.arch.core_core-runtime.version" has type "ASCII text"- [targetUID: N/A] "firebase-auth.properties" has type "ASCII text"- [targetUID: N/A] "recaptcha.properties" has type "ASCII text"- [targetUID: N/A] "integrity.properties" has type "ASCII text"- [targetUID: N/A] "androidsupportmultidexversion.txt" has type "ASCII text"- [targetUID: N/A] "googleid.properties" has type "ASCII text"- [targetUID: N/A] "billing.properties" has type "ASCII text"- [targetUID: N/A] "native-image.properties" has type "ASCII text"- [targetUID: N/A] "stamp-cert-sha256" has type "data"- [targetUID: N/A] "io.grpc.g" has type "ASCII text"- [targetUID: N/A] "androidx.webkit_webkit.version" has type "ASCII text"- [targetUID: N/A] "androidx.security_security-crypto.version" has type "ASCII text"- [targetUID: N/A] "androidx.privacysandbox.ads_ads-adservices-java.version" has type "ASCII text"- [targetUID: N/A] "androidx.viewpager2_viewpager2.version" has type "ASCII text"- [targetUID: N/A] "androidx.credentials_credentials-play-services-auth.version" has type "ASCII text"- [targetUID: N/A] "androidx.core_core-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.media_media.version" has type "ASCII text"- [targetUID: N/A] "androidx.profileinstaller_profileinstaller.version" has type "ASCII text"- [targetUID: N/A] "androidx.work_work-runtime.version" has type "ASCII text"- [targetUID: N/A] "androidx.datastore_datastore.version" has type "ASCII text"- [targetUID: N/A] "androidx.customview_customview.version" has type "ASCII text"- [targetUID: N/A] "androidx.drawerlayout_drawerlayout.version" has type "ASCII text"- [targetUID: N/A] "androidx.sqlite_sqlite.version" has type "ASCII text"- [targetUID: N/A] "androidx.room_room-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.recyclerview_recyclerview.version" has type "ASCII text"- [targetUID: N/A] "androidx.savedstate_savedstate.version" has type "ASCII text"- [targetUID: N/A] "androidx.appcompat_appcompat-resources.version" has type "ASCII text"- [targetUID: N/A] "androidx.emoji2_emoji2.version" has type "ASCII text"- [targetUID: N/A] "androidx.annotation_annotation-experimental.version" has type "ASCII text"- [targetUID: N/A] "androidx.fragment_fragment.version" has type "ASCII text"- [targetUID: N/A] "androidx.exifinterface_exifinterface.version" has type "ASCII text"- [targetUID: N/A] "androidx.transition_transition.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-extensions.version" has type "ASCII text"- [targetUID: N/A] "kotlinx_coroutines_play_services.version" has type "ASCII text with no line terminators"- [targetUID: N/A] "ym.i0" has type "ASCII text"- [targetUID: N/A] "androidx.databinding_viewbinding.version" has type "ASCII text with no line terminators"- [targetUID: N/A] "io.grpc.m" has type "ASCII text"- [targetUID: N/A] "dn.t" has type "ASCII text"- [targetUID: N/A] "ik.d0" has type "ASCII text"- [targetUID: N/A] "androidx.security_security-crypto-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.privacysandbox.ads_ads-adservices.version" has type "ASCII text"- [targetUID: N/A] "androidx.credentials_credentials.version" has type "ASCII text"- [targetUID: N/A] "androidx.core_core.version" has type "ASCII text"- [targetUID: N/A] "androidx.localbroadcastmanager_localbroadcastmanager.version" has type "ASCII text"- [targetUID: N/A] "androidx.asynclayoutinflater_asynclayoutinflater.version" has type "ASCII text"- [targetUID: N/A] "androidx.customview_customview-poolingcontainer.version" has type "ASCII text"- [targetUID: N/A] "androidx.vectordrawable_vectordrawable.version" has type "ASCII text"- [targetUID: N/A] "androidx.emoji_emoji.version" has type "ASCII text"- [targetUID: N/A] "androidx.legacy_legacy-support-core-ui.version" has type "ASCII text"- [targetUID: N/A] "androidx.legacy_legacy-support-v13.version" has type "ASCII text"- [targetUID: N/A] "androidx.cardview_cardview.version" has type "ASCII text"- [targetUID: N/A] "androidx.biometric_biometric.version" has type "ASCII text"- [targetUID: N/A] "androidx.cursoradapter_cursoradapter.version" has type "ASCII text"- [targetUID: N/A] "androidx.sqlite_sqlite-framework.version" has type "ASCII text"- [targetUID: N/A] "androidx.startup_startup-runtime.version" has type "ASCII text"- [targetUID: N/A] "androidx.preference_preference.version" has type "ASCII text"- [targetUID: N/A] "androidx.documentfile_documentfile.version" has type "ASCII text"- [targetUID: N/A] "androidx.datastore_datastore-preferences.version" has type "ASCII text"- [targetUID: N/A] "androidx.legacy_legacy-support-v4.version" has type "ASCII text"- [targetUID: N/A] "androidx.coordinatorlayout_coordinatorlayout.version" has type "ASCII text"- [targetUID: N/A] "androidx.swiperefreshlayout_swiperefreshlayout.version" has type "ASCII text"- [targetUID: N/A] "androidx.emoji2_emoji2-views-helper.version" has type "ASCII text"- [targetUID: N/A] "androidx.tracing_tracing.version" has type "ASCII text"- [targetUID: N/A] "androidx.dynamicanimation_dynamicanimation.version" has type "ASCII text"- [targetUID: N/A] "androidx.legacy_legacy-support-core-utils.version" has type "ASCII text"- [targetUID: N/A] "androidx.slidingpanelayout_slidingpanelayout.version" has type "ASCII text"- [targetUID: N/A] "androidx.versionedparcelable_versionedparcelable.version" has type "ASCII text"- [targetUID: N/A] "com.google.android.material_material.version" has type "ASCII text"- [targetUID: N/A] "androidx.appcompat_appcompat.version" has type "ASCII text"- [targetUID: N/A] "androidx.loader_loader.version" has type "ASCII text"- [targetUID: N/A] "androidx.print_print.version" has type "ASCII text"- [targetUID: N/A] "androidx.interpolator_interpolator.version" has type "ASCII text"- [targetUID: N/A] "androidx.viewpager_viewpager.version" has type "ASCII text"- [targetUID: N/A] "androidx.browser_browser.version" has type "ASCII text"- [targetUID: N/A] "androidx.room_room-runtime.version" has type "ASCII text"- [targetUID: N/A] "androidx.activity_activity.version" has type "ASCII text"- [targetUID: N/A] "androidx.vectordrawable_vectordrawable-animated.version" has type "ASCII text"- [targetUID: N/A] "kotlinx_coroutines_android.version" has type "ASCII text with no line terminators"- [targetUID: N/A] "kotlinx_coroutines_core.version" has type "ASCII text with no line terminators"- [targetUID: N/A]28:T432,Heuristic match: "La.KY" Heuristic match: ",LC.nE" Heuristic match: "#Y.Fr" Heuristic match: "it.id" Pattern match: "http://ns.adobe.com/xap/1.0/\u0000" Pattern match: "https://issuetracker.google.com/issues/new?component=413107&template=1096568" Pattern match: "https://issuetracker.google.com/issues/new?component=907884&template=1466542" Pattern match: "http://schemas.android.com/apk/res/android" Heuristic match: "androidx.work.util.id" Pattern match: "https://www.googleapis.com/auth/drive.file" Pattern match: "https://one.google.com/" Pattern match: "http://play.google.com/store/apps/details?id=" Heuristic match: "lockmypix.com" Heuristic match: "com.fourchars.lmpfree.ph" Pattern match: "https://android.googlesource.com/toolchain/llvm-project" Pattern match: "https://developers.google.com/protocol-buffers///" Pattern match: "http://scripts.sil.org/OFL-----------------------------------------------------------SIL" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0//" Pattern match: "http://www.unicode.org/copyright.html.Permission"29:T9fb,Found string "AES/CBC/PKCS7Padding" (Indicator: "aes"; File: "c.smali") Found string "AES256_GCM" (Indicator: "aes"; File: "a$e.smali") Found string "AES256_GCM" (Indicator: "aes256"; File: "a$e.smali") Found string "AES256_SIV" (Indicator: "aes"; File: "a$d.smali") Found string "AES256_SIV" (Indicator: "aes256"; File: "a$d.smali") Found string ".encrypt" (Indicator: ".encrypt"; File: "d.smali") Found string "AES engine not initialised" (Indicator: "aes"; File: "a.smali") Found string "invalid encrypter for AES encrypted file" (Indicator: "aes"; File: "c.smali") Found string "invalid aes key strength, cannot determine key sizes" (Indicator: "aes"; File: "c.smali") Found string "invalid AES key strength, cannot generate AES Extra data record" (Indicator: "aes"; File: "c.smali") Found string "zip parameters are null, cannot generate AES Extra Data record" (Indicator: "aes"; File: "c.smali") Found string "Error occured while reading stored AES authentication bytes" (Indicator: "aes"; File: "f.smali") Found string "corrput AES extra data records" (Indicator: "aes"; File: "a.smali") Found string "unable to determine salt length: invalid aes key strength" (Indicator: "aes"; File: "b.smali") Found string "unable to determine salt length: AESExtraDataRecord is null" (Indicator: "aes"; File: "b.smali") Found string "invalid decryptor when trying to calculate compressed size for AES encrypted file:" (Indicator: "aes"; File: "b.smali") Found string "AESExtraDataRecord does not exist for AES encrypted file:" (Indicator: "aes"; File: "b.smali") Found string "unzipFile():" (Indicator: "zipfile"; File: "b.smali") Found string "one of the input parameters is null in AESDecryptor Constructor" (Indicator: "aes"; File: "a.smali") Found string "AES not initialized properly" (Indicator: "aes"; File: "a.smali") Found string "invalid aes key strength for file:" (Indicator: "aes"; File: "a.smali") Found string "invalid derived password verifier for AES" (Indicator: "aes"; File: "a.smali") Found string "empty or null password provided for AES Decryptor" (Indicator: "aes"; File: "a.smali") Found string "invalid aes extra data record - in init method of AESDecryptor" (Indicator: "aes"; File: "a.smali") Found string "invalid file header in init method of AESDecryptor" (Indicator: "aes"; File: "a.smali") Found string "Invalid key strength in AES encrypter constructor" (Indicator: "aes"; File: "b.smali") Found string "input password is empty or null in AES encrypter constructor" (Indicator: "aes"; File: "b.smali")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"03b30a946230584d42be6b2225aeb4a2968c874f429c1473cee6029699fa1984","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":95,"unified_at_epoch_ms":1790705478134,"unified_at":"2026-09-29T18:11:18.134Z","metadata":{"hashes":{"sha256":"03b30a946230584d42be6b2225aeb4a2968c874f429c1473cee6029699fa1984","sha1":"7eb3ad27fa9c37abc1dcf30d2f0be63ca2617a70","md5":"fada545de873d80dd5bbf2eec1b336ce","sha512":"62c26b0747828d21b22776a6e2793d1c7c99e50256c427bfd570697dba851f848c437ff39d102fd0d0a7c84e5562ca5788e59843c3554ab091941e3879362676","ssdeep":"393216:GbCKdBLKwoH6UxBU777+mlQ5eGeCvXngni7ZjMTgVnm8Wa8iG9:GbkaUx6qKO9eCvSi7agVnm8Wa8iG9","ssdeep_chunks":["393216:GbCKdBL","393216:bCKdBLK","393216:CKdBLKw","393216:KdBLKwo","393216:dBLKwoH","393216:BLKwoH6","393216:LKwoH6U","393216:KwoH6Ux","393216:woH6UxB","393216:oH6UxBU","393216:H6UxBU7","393216:6UxBU77","393216:UxBU777","393216:xBU777+","393216:BU777+m","393216:U777+ml","393216:777+mlQ","393216:77+mlQ5","393216:7+mlQ5e","393216:+mlQ5eG","393216:mlQ5eGe","393216:lQ5eGeC","393216:Q5eGeCv","393216:5eGeCvX","393216:eGeCvXn","393216:GeCvXng","393216:eCvXngn","393216:CvXngni","393216:vXngni7","393216:Xngni7Z","393216:ngni7Zj","393216:gni7ZjM","393216:ni7ZjMT","393216:i7ZjMTg","393216:7ZjMTgV","393216:ZjMTgVn","393216:jMTgVnm","393216:MTgVnm8","393216:TgVnm8W","393216:gVnm8Wa","393216:Vnm8Wa8","393216:nm8Wa8i","393216:m8Wa8iG","393216:8Wa8iG9","786432:GbCKdBL","786432:bCKdBLK","786432:CKdBLKw","786432:KdBLKwo","786432:dBLKwoH","786432:BLKwoH6","786432:LKwoH6U","786432:KwoH6Ux","786432:woH6UxB","786432:oH6UxBU","786432:H6UxBU7","786432:6UxBU77","786432:UxBU777","786432:xBU777+","786432:BU777+m","786432:U777+ml","786432:777+mlQ","786432:77+mlQ5","786432:7+mlQ5e","786432:+mlQ5eG","786432:mlQ5eGe","786432:lQ5eGeC","786432:Q5eGeCv","786432:5eGeCvX","786432:eGeCvXn","786432:GeCvXng","786432:eCvXngn","786432:CvXngni","786432:vXngni7","786432:Xngni7Z","786432:ngni7Zj","786432:gni7ZjM","786432:ni7ZjMT","786432:i7ZjMTg","786432:7ZjMTgV","786432:ZjMTgVn","786432:jMTgVnm","786432:MTgVnm8","786432:TgVnm8W","786432:gVnm8Wa","786432:Vnm8Wa8","786432:nm8Wa8i","786432:m8Wa8iG","786432:8Wa8iG9","393216:GbkaUx6","393216:bkaUx6q","393216:kaUx6qK","393216:aUx6qKO","393216:Ux6qKO9","393216:x6qKO9e","393216:6qKO9eC","393216:qKO9eCv","393216:KO9eCvS","393216:O9eCvSi","393216:9eCvSi7","393216:eCvSi7a","393216:CvSi7ag","393216:vSi7agV","393216:Si7agVn","393216:i7agVnm","393216:7agVnm8","393216:agVnm8W"],"imphash":"Unknown"},"file_info":{"file_name":"LockMyPix Safe Photo Vault v5.2.7.3 Gemini Premium Mod Apk {CracksHash}.apk","file_type":["android"],"file_type_id":"apk","file_size":24693963,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1718822043000,"last_seen":1718822045000,"last_multi_scan":1718822045000}},"detections":{"summary":{"verdict":"malicious","score":95,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":10,"suspicious_count":2,"malicious_count":2,"total":14},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Broadcast Receivers","attack_id":"T1402","attack_id_wiki":"https://attack.mitre.org/techniques/T1402","identifiers":[{"type":"malicious","value":"Has the ability to execute code after reboot"}],"sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"tactic":"Collection","technique":"Audio Capture","attack_id":"T1429","attack_id_wiki":"https://attack.mitre.org/techniques/T1429","identifiers":[{"type":"suspicious","value":"Has the ability to record audio"}],"sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.637522000894184","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$25","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$26","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$27","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"AndroidManifest.xml\" has type \"Android binary XML\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"6.17.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://issuetracker.google.com\"\n Found HTTPS url \"https://www.googleapis.com\"\n Found HTTPS url \"https://one.google.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"level":"suspicious","category":"General","name":"Requires permissions that could be uesd for malicious intents","description":"Permission request for \"android.permission.WRITE_EXTERNAL_STORAGE\"\n Permission request for \"android.permission.INTERNET\"\n Permission request for \"android.permission.RECEIVE_BOOT_COMPLETED\"\n Permission request for \"android.permission.RECORD_AUDIO\"\n Permission request for \"android.permission.CAMERA\"\n Permission request for \"android.permission.WAKE_LOCK\"","origin":"Static Parser","relevance":10,"id":"static-27","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Has the ability to record audio","description":"Permission request for \"android.permission.RECORD_AUDIO\"","origin":"Static Parser","mitre_attack_id":"T1429","relevance":10,"id":"static-34","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Has the ability to execute code after reboot","description":"Permission request for \"android.permission.RECEIVE_BOOT_COMPLETED\"","origin":"Static Parser","mitre_attack_id":"T1402","relevance":10,"id":"static-28","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Bolonyokte\" matched file \"sample.bin\" as \"UnknownDotNet RAT - Bolonyokte\" (Author: Jean-Philippe Teissier / @Jipe_)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Has the ability to record audio"}],"sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Has the ability to execute code after reboot"}],"sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]}]},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":21,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6673249a1a9289ac4300c29f","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"malicious","threat_score":95,"submit_name":"LockMyPix Safe Photo Vault v5.2.7.3 Gemini Premium Mod Apk {CracksHash}.apk","analysis_start_time":"2024-06-19T18:34:05+00:00","indicators_count":{"informative":10,"suspicious":2,"malicious":2},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"libucrop.so_1718822352586","sha256":"67e1aac0dbf92c423d458cb2bb8f1f4cce5dca63dc131012edc327551689edf1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"libapplovin-native-crash-reporter.so_1718822352583","sha256":"3b44e2af8197270f1b04a13e9c639ec57c695174426a0d69e103db7c34b84b14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"libucrop.so","sha256":"7a4fcf83f28c26fd2f54b0e44c2a75ee0104c764315d0945043e3385797150ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"libapplovin-native-crash-reporter.so_1718822352586","sha256":"7c1c1881582836ef2013b5be3ecddf9bfa28fc7847304f2f00f5f1d548d7043b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"libapplovin-native-crash-reporter.so","sha256":"dbe01a17d580a250a654761c9458bfac3e9b0c96bfb67f29bf7165929d65c6ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"libucrop.so_1718822352587","sha256":"6d5767f6748494dd9a6a91160838d3d1019d7e64aa5f15ecf15cd15748a8cac0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"libapplovin-native-crash-reporter.so_1718822352587","sha256":"d06b1b9bccfdd258f110b77d5def65cf81201fc7fd2643048869e886fdee2f30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"CERT.SF","sha256":"53dfb39bcaa2be3733d33b77c951d528a16c7d19fada254a80b6fe4b848ff3e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"MANIFEST.MF","sha256":"d46b4911be015b92a3078ba8b78dc02210af34217ec459d88bd46d8604a4b8f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"public-suffix-list.txt","sha256":"ff2293eff88881f6742f388d6b9ab7d1ba89a6183a6d576d3753506bf79ef67c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"AndroidManifest.xml","sha256":"c9b5edcc0816e2913965c28a1986bb342844ba2eadad9f83b2d0424d0ab1525d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"libpl_droidsonroids_gif.so","sha256":"7b81f0e8c4c306ce5cdbc14a8dc35283efa3a19a6432b1902e40c56986a16032","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"libpl_droidsonroids_gif.so_1718822352586","sha256":"0b39d8315e00267ac5dcf4f7c23c07b7230a766f700f5338750eea56cd8dbed1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"libpl_droidsonroids_gif.so_1718822352587","sha256":"de6fd2e2880618ef2a566a2390173b5816065487a4ecf080cf52e15a1eb90182","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"field_mask.proto","sha256":"17b0f342cc3a262e317d56884f3f575afbfac512ad0579349cc7450e41f26891","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"api.proto","sha256":"9daa858a1c529f47f9d4ed1bc2df0dab6154ad42f99cf0351b3da9d4daff8eb0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"timestamp.proto","sha256":"fd8d738e0cb5301455a957b16a984d2c30c7ac377850ca72dbfa0e8c0f27ec15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"type.proto","sha256":"59b9e8322f547748f137b02bd570404851cc220c8ff4963f76a5217cf84e3bcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"any.proto","sha256":"17eeb5dc4a65300beac9ca6d7ebb6bfabfd1825fec2338013687a5805293e606","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"duration.proto","sha256":"a3f7301ff2956ec2e30c2241ece07197e4a86c752348d5607224819d4921c9fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]},{"name":"DebugProbesKt.bin","sha256":"ae8a082dd609313835ba93c3ef479a3af9903977d7bdc81df45bbd209ec7d0da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6673249a1a9289ac4300c29f"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6673249a1a9289ac4300c29f"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 03b30a946230… — Score 95/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 03b30a946230…. Threat score 95/100. 0/23 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/03b30a946230584d42be6b2225aeb4a2968c874f429c1473cee6029699fa1984"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 03b30a946230… — Score 95/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 03b30a946230…. Threat score 95/100. 0/23 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/03b30a946230584d42be6b2225aeb4a2968c874f429c1473cee6029699fa1984"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 03b30a946230… — Score 95/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 03b30a946230…. Threat score 95/100. 0/23 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]