26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T45d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 4059645f8c66… — Score 76/100 — Hybrid Analysis","description":"Suspicious verdict for sample 4059645f8c66…. Threat score 76/100. 0/27 AV engines flagged this file. 2 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4059645f8c6666613f7d0477fbb189e96be7160c1235fb49a0df8a32b3200c6b","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","4059645f8c6666613f7d0477fbb189e96be7160c1235fb49a0df8a32b3200c6b"],"about":{"@type":"SoftwareApplication","name":"Universal TV Remote Control v1.5 Premium Mod Apk {CracksHash}.apk","applicationCategory":["data","compressed","zip"],"identifier":"4059645f8c6666613f7d0477fbb189e96be7160c1235fb49a0df8a32b3200c6b","additionalType":"Suspicious sample"},"threatScore":76,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5db,"res/animator/fragment_open_enter.xml" (Indicator: "open") "res/animator/fragment_open_exit.xml" (Indicator: "open") "res/color/abc_background_cache_hint_selector_material_dark.xmluP1N" (Indicator: "select") "res/color/abc_background_cache_hint_selector_material_light.xmluP1N" (Indicator: "select") "res/color/com_facebook_send_button_text_color.xmluP" (Indicator: "send") "res/color/mtrl_btn_bg_color_selector.xml" (Indicator: "select") "res/color/mtrl_btn_stroke_color_selector.xmluP1N" (Indicator: "select") "res/color/mtrl_btn_text_btn_bg_color_selector.xmluP" (Indicator: "select") "res/color/mtrl_btn_text_color_selector.xml" (Indicator: "select") "res/color/mtrl_calendar_selected_range.xmluP" (Indicator: "select") "res/color/mtrl_fab_bg_color_selector.xml" (Indicator: "select") "res/color/mtrl_fab_icon_text_color_selector.xml" (Indicator: "select") "res/color/mtrl_on_primary_text_btn_text_color_selector.xmluP" (Indicator: "select") "res/color/mtrl_tabs_icon_color_selector.xml" (Indicator: "select") "res/color/mtrl_tabs_icon_color_selector_colored.xml" (Indicator: "select") "res/color/mtrl_tabs_legacy_text_color_selector.xmluP" (Indicator: "select") "res/color/mtrl_text_btn_text_color_selector.xml" (Indicator: "select") "res/color/test_mtrl_calendar_day_selected.xmluOA" (Indicator: "select") "res/drawable/abc_ic_menu_selectall_mtrl_alpha.xmluRMo" (Indicator: "select") "res/drawable/abc_list_selector_background_transition_holo_dark.xml" (Indicator: "select")28:Tac2,Heuristic match: "'Ik*H,~.iO" Pattern match: "http://www.videolan.org/x264.html" Heuristic match: "GG17666105805-kqo9tc2a4vjfle9o0o2fuchd3h7fiaus.apps.googleusercontent.com" Pattern match: "https://play.google.com/store/apps/details?id=sensustech.universal.tv.remote.control" Pattern match: "facebook.com/device" Heuristic match: "unimote-android.appspot.com" Heuristic match: "java.runtime.name" Pattern match: "vnd.android.cursor.dir/contact" Heuristic match: "android.intent.extra.shortcut.NAME" Pattern match: "http://schemas.android.com/apk/res/android" Heuristic match: "android.intent.extra.CC" Pattern match: "https://developers.google.com/protocol-buffers/" Pattern match: "google.golang.org/protobuf/types/known/emptypb" Pattern match: "google.golang.org/protobuf/types/known/sourcecontextpb" Pattern match: "google.golang.org/protobuf/types/known/anypb" Pattern match: "type.googleapis.com/full.type.name" Pattern match: "foo.bar.com/x/y.z" Pattern match: "type.googleapis.com/google.profile.Person" Pattern match: "type.googleapis.com/google.protobuf.Duration" Pattern match: "google.golang.org/protobuf/types/known/durationpb" Pattern match: "google.golang.org/protobuf/types/known/typepb" Pattern match: "type.googleapis.com/google.protobuf.Timestamp" Heuristic match: "Name: res/drawable-mdpi/com_facebook_profile_picture_blank_portrait.pn" Heuristic match: "Name: res/drawable-xxhdpi/abc_textfield_search_default_mtrl_alpha.9.pn" Heuristic match: "Name: res/drawable-xxxhdpi/abc_scrubber_control_to_pressed_mtrl_000.pn" Heuristic match: "Name: res/drawable-xxxhdpi/abc_scrubber_control_to_pressed_mtrl_005.pn" Pattern match: "google.golang.org/protobuf/types/known/apipb" Pattern match: "https://cloud.google.com/apis/design/glossary" Pattern match: "http://semver.org" Pattern match: "google.golang.org/protobuf/types/known/structpb" Pattern match: "google.golang.org/protobuf/types/descriptorpb" Heuristic match: "// independent entities, e-mail protobuf-global-extension-registry@google.com" Pattern match: "https://developers.google.com/protocol-buffers/docs/proto#options" Pattern match: "google.golang.org/protobuf/types/known/fieldmaskpb" Pattern match: "google.golang.org/protobuf/types/known/wrapperspb" Pattern match: "google.golang.org/protobuf/types/known/timestamppb" Pattern match: "https://developers.google.com/time/smear" Pattern match: "https://www.ietf.org/rfc/rfc3339.txt" Pattern match: "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString" Pattern match: "https://docs.python.org/2/library/time.html#time.strftime" Pattern match: "http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime%2D%2D"29:T412,"@@Visit facebook.com/device and enter the code shown above." (Indicator: "facebook.com") "til facebook.com/device og indtast koden, som er vist ovenfor." (Indicator: "facebook.com") "1_facebook.com/device" (Indicator: "facebook.com") "facebook.com/device '" (Indicator: "facebook.com") "facebook.com/device" (Indicator: "facebook.com") "til facebook.com/device og skriv inn koden som vises over." (Indicator: "facebook.com") "OOKunjungi facebook.com/device dan masukkan kode yang ditampilkan di atas." (Indicator: "facebook.com") "IIGehe zu facebook.com/device und gib den oben angezeigten Code ein." (Indicator: "facebook.com") "MMBesoek facebook.com/device en voer die kode wat hierbo gewys word, in." (Indicator: "facebook.com") "EESiirry osoitteeseen facebook.com/device ja anna oheinen koodi." (Indicator: "facebook.com") "p facebook.com/device v" (Indicator: "facebook.com") "nku facebook.com/device a zadajte k" (Indicator: "facebook.com")2a:T4bc,Found invoke in "bolts.MeasurementEvent.smali" to "java.lang.reflect.Method.invoke" Found invoke in "androidx.legacy.app.ActionBarDrawerToggle.smali" to "java.lang.reflect.Method.invoke" Found invoke in "androidx.appcompat.widget.SearchView$PreQAutoCompleteTextViewReflector.smali" to "java.lang.reflect.Method.invoke" Found invoke in "androidx.appcompat.widget.MenuPopupWindow.smali" to "java.lang.reflect.Method.invoke" Found invoke in "androidx.appcompat.widget.ViewUtils.smali" to "java.lang.reflect.Method.invoke" Found invoke in "androidx.appcompat.widget.DrawableUtils.smali" to "java.lang.reflect.Method.invoke" Found invoke in "androidx.appcompat.widget.AppCompatTextViewAutoSizeHelper.smali" to "java.lang.reflect.Field.get" Found invoke in "androidx.appcompat.widget.AppCompatTextViewAutoSizeHelper.smali" to "java.lang.reflect.Method.invoke" Found invoke in "androidx.appcompat.widget.ListPopupWindow.smali" to "java.lang.reflect.Method.invoke" Found invoke in "androidx.appcompat.view.menu.MenuItemWrapperICS.smali" to "java.lang.reflect.Method.invoke" Found invoke in "androidx.appcompat.view.SupportMenuInflater$InflatedOnMenuItemClickListener.smali" to "java.lang.reflect.Method.invoke"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4059645f8c6666613f7d0477fbb189e96be7160c1235fb49a0df8a32b3200c6b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":76,"unified_at_epoch_ms":1790753790885,"unified_at":"2026-09-30T07:36:30.885Z","metadata":{"hashes":{"sha256":"4059645f8c6666613f7d0477fbb189e96be7160c1235fb49a0df8a32b3200c6b","sha1":"9f4778137121c9ad3f61649a76a00f5a4978a7d4","md5":"06c77b202b783dc4da065e3fe9e0f964","sha512":"894042ec0c5cde5a2d3c623909b86d20fe78fded907323f134dc6f582c086ccb3c2ca69c578b21457e959742c7197070d7c2ae09bd2a42e0f4ac50b48ed0488e","ssdeep":"393216:OpXDfIqvquqrnl55wsAM4WN0kU0wWxwl/8C:2zfZv8T6s/4XcwlkC","ssdeep_chunks":["393216:OpXDfIq","393216:pXDfIqv","393216:XDfIqvq","393216:DfIqvqu","393216:fIqvquq","393216:Iqvquqr","393216:qvquqrn","393216:vquqrnl","393216:quqrnl5","393216:uqrnl55","393216:qrnl55w","393216:rnl55ws","393216:nl55wsA","393216:l55wsAM","393216:55wsAM4","393216:5wsAM4W","393216:wsAM4WN","393216:sAM4WN0","393216:AM4WN0k","393216:M4WN0kU","393216:4WN0kU0","393216:WN0kU0w","393216:N0kU0wW","393216:0kU0wWx","393216:kU0wWxw","393216:U0wWxwl","393216:0wWxwl/","393216:wWxwl/8","393216:Wxwl/8C","786432:OpXDfIq","786432:pXDfIqv","786432:XDfIqvq","786432:DfIqvqu","786432:fIqvquq","786432:Iqvquqr","786432:qvquqrn","786432:vquqrnl","786432:quqrnl5","786432:uqrnl55","786432:qrnl55w","786432:rnl55ws","786432:nl55wsA","786432:l55wsAM","786432:55wsAM4","786432:5wsAM4W","786432:wsAM4WN","786432:sAM4WN0","786432:AM4WN0k","786432:M4WN0kU","786432:4WN0kU0","786432:WN0kU0w","786432:N0kU0wW","786432:0kU0wWx","786432:kU0wWxw","786432:U0wWxwl","786432:0wWxwl/","786432:wWxwl/8","786432:Wxwl/8C","393216:2zfZv8T","393216:zfZv8T6","393216:fZv8T6s","393216:Zv8T6s/","393216:v8T6s/4","393216:8T6s/4X","393216:T6s/4Xc","393216:6s/4Xcw","393216:s/4Xcwl","393216:/4Xcwlk","393216:4XcwlkC"],"imphash":"Unknown"},"file_info":{"file_name":"Universal TV Remote Control v1.5 Premium Mod Apk {CracksHash}.apk","file_type":["data","compressed","zip"],"file_type_id":"zip","file_size":12685632,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1669723386000,"last_seen":1678901154000,"last_multi_scan":1678901154000}},"detections":{"summary":{"verdict":"suspicious","score":76,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":8,"suspicious_count":6,"malicious_count":2,"total":16},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Broadcast Receivers","attack_id":"T1402","attack_id_wiki":"https://attack.mitre.org/techniques/T1402","identifiers":[{"type":"malicious","value":"Has the ability to execute code after reboot"}],"sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1420","attack_id_wiki":"https://attack.mitre.org/techniques/T1420","identifiers":[{"type":"suspicious","value":"Has the ability to access external storage"}],"sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1421","attack_id_wiki":"https://attack.mitre.org/techniques/T1421","identifiers":[{"type":"informative","value":"Tests the internet connectivity"}],"sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"tactic":"Discovery","technique":"Location Tracking","attack_id":"T1430","attack_id_wiki":"https://attack.mitre.org/techniques/T1430","identifiers":[{"type":"suspicious","value":"Has the ability to query the phone location (GPS)"}],"sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"tactic":"Collection","technique":"Stored Application Data","attack_id":"T1409","attack_id_wiki":"https://attack.mitre.org/techniques/T1409","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]}],"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/65 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM room_table_modification_log WHERE invalidated = 1;\"","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$27","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"informative","category":"General","name":"Tests the internet connectivity","description":"Found invoke in \"androidx.core.net.ConnectivityManagerCompat.smali\" to \"android.net.ConnectivityManager.getActiveNetworkInfo\"\n Found invoke in \"androidx.core.net.ConnectivityManagerCompat.smali\" to \"android.net.ConnectivityManager.getNetworkInfo\"","origin":"Static Parser","mitre_attack_id":"T1421","relevance":3,"id":"static-41","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"AndroidManifest.xml\" has type \"Android binary XML\"- [targetUID: N/A]\n \"BALA.RSA\" has type \"data\"- [targetUID: N/A]\n \"BALA.SF\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]\n \"MANIFEST.MF\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]\n \"any.proto\" has type \"ASCII text\"- [targetUID: N/A]\n \"api.proto\" has type \"Java source ASCII text\"- [targetUID: N/A]\n \"descriptor.proto\" has type \"ASCII text\"- [targetUID: N/A]\n \"duration.proto\" has type \"ASCII text\"- [targetUID: N/A]\n \"empty.proto\" has type \"ASCII text\"- [targetUID: N/A]\n \"field_mask.proto\" has type \"ASCII text\"- [targetUID: N/A]\n \"source_context.proto\" has type \"ASCII text\"- [targetUID: N/A]\n \"struct.proto\" has type \"ASCII text\"- [targetUID: N/A]\n \"timestamp.proto\" has type \"ASCII text\"- [targetUID: N/A]\n \"type.proto\" has type \"Java source ASCII text\"- [targetUID: N/A]\n \"wrappers.proto\" has type \"ASCII text\"- [targetUID: N/A]","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"~~Control your TV from your Android device. https://play.google.com/store/apps/details?id=sensustech.universal.tv.remote.control\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$29","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"SHA-256-Digest: 6BbcCZj07pDXtjDxfhb8wuctkQeMUxWtqsS8LaTCJtc=\" (Indicator: \"qemu\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"kenton@google.com\"\n Pattern match: \"protobuf-global-extension-registry@google.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"suspicious","category":"General","name":"Uses java reflection classes","description":"$2a","origin":"Static Parser","relevance":3,"id":"static-47","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Has the ability to access external storage","description":"Found invoke in \"androidx.core.os.EnvironmentCompat.smali\" to \"android.os.Environment.getExternalStorageState\"\n Found invoke in \"androidx.core.os.EnvironmentCompat.smali\" to \"android.os.Environment.getExternalStorageDirectory\"\n Found invoke in \"androidx.core.content.FileProvider.smali\" to \"android.os.Environment.getExternalStorageDirectory\"","origin":"Static Parser","mitre_attack_id":"T1420","relevance":3,"id":"static-45","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"suspicious","category":"Network Related","name":"Has the ability to open an internet connection","description":"Found invoke in \"bolts.WebViewAppLinkResolver$3.smali\" to \"java.net.URL.openConnection\"\n Found invoke in \"androidx.mediarouter.app.MediaRouteControllerDialog$FetchArtTask.smali\" to \"java.net.URL.openConnection\"","origin":"Static Parser","relevance":3,"id":"static-46","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Has the ability to query the phone location (GPS)","description":"Found invoke in \"androidx.appcompat.app.TwilightManager.smali\" to \"android.location.Location.getLatitude\"\n Found invoke in \"androidx.appcompat.app.TwilightManager.smali\" to \"android.location.Location.getLongitude\"\n Found invoke in \"androidx.appcompat.app.TwilightManager.smali\" to \"android.location.LocationManager.getLastKnownLocation\"\n Found invoke in \"androidx.exifinterface.media.ExifInterface.smali\" to \"android.location.Location.getLatitude\"\n Found invoke in \"androidx.exifinterface.media.ExifInterface.smali\" to \"android.location.Location.getLongitude\"\n Found invoke in \"androidx.core.location.LocationManagerCompat.smali\" to \"android.location.LocationManager.getLastKnownLocation\"","origin":"Static Parser","mitre_attack_id":"T1430","relevance":10,"id":"static-50","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"malicious","category":"General","name":"Has the ability to read the device ID (e.g. IMEI or ESN)","description":"Found invoke in \"androidx.core.telephony.TelephonyManagerCompat$Api23Impl.smali\" to \"android.telephony.TelephonyManager.getDeviceId\"\n Found invoke in \"androidx.core.telephony.TelephonyManagerCompat.smali\" to \"android.telephony.TelephonyManager.getDeviceId\"","origin":"Static Parser","relevance":3,"id":"static-42","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"level":"malicious","category":"Installation/Persistence","name":"Has the ability to execute code after reboot","description":"Permission request for \"android.permission.RECEIVE_BOOT_COMPLETED\"","origin":"Static Parser","mitre_attack_id":"T1402","relevance":10,"id":"static-28","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Has the ability to read the device ID (e.g. IMEI or ESN)"},{"detail":"Has the ability to query the phone location (GPS)"}],"sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Has the ability to execute code after reboot"},{"detail":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Found an indicator for E-Mail sending capabilities"}],"sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]}]},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"63865d583758695bd243dea9","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"File \"Universal TV Remote Control v1.5 Premium Mod Apk {CracksHash}.apk\" was detected as \"apk\", this format is not supported on WINDOWS","verdict":"undetected","submit_name":"Universal TV Remote Control v1.5 Premium Mod Apk {CracksHash}.apk","analysis_start_time":"2022-11-29T19:28:25+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"6385f4f86c000704754efbe3","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"suspicious","threat_score":76,"submit_name":"Universal-TV-Remote-Control-v1.5-Mod.apk","analysis_start_time":"2022-11-29T12:03:07+00:00","indicators_count":{"informative":8,"suspicious":10,"malicious":2},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AndroidManifest.xml","sha256":"c0d135d45262b561186d625df938ed0324e36faa23c790cbc2687deba20434e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"BALA.RSA","sha256":"35c426478eeb369ea5d1a2f0b3993246710604a7414431a24c46424abba12014","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"BALA.SF","sha256":"bdfd216fd9e0d3f7096884f0a2b9a3e3b84daddceafaf9742b8eabc76a2bcfc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"MANIFEST.MF","sha256":"8d96087e719367764757b7a92b3426055f7112b845d496ddae9fcc956e7c737e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"any.proto","sha256":"d7c79a05a5c7fae89f0aff26d112e0b60f082fc7fc424e8910be99c86b656260","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"api.proto","sha256":"4d050ed6172b20717022f081e26ddaaa9e534c58fc7b4cf1e88bde62ebed3c9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"descriptor.proto","sha256":"9114125bf08a139ddd805247d7605a2e4f5662190a34089a2b3c6a9f58d0f55e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"duration.proto","sha256":"099047097e8fe73657b49ef67af914a7a686ac6154f9d872882708b5eb3db04c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"empty.proto","sha256":"23b75ded84bd2ee81f0098850ffaa0d5e1a6d881a9e1a760f730989e90534ec3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"field_mask.proto","sha256":"ed78e81d3f16618964b65692a02d229da6591bbec6eafc2ee4f052eaccf25b8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"source_context.proto","sha256":"28377609fb1df35293d637112cb574879465a987d943cd5e6c8feb8845438793","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"struct.proto","sha256":"7accb70d741132475ef30ac125dfef95835239c792b83ff453a5e132e235a68d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"timestamp.proto","sha256":"9489462cbd4eff7c013d10de596be38da1087c7824ea34357669bc21bf5c0800","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"type.proto","sha256":"18e4e0335dd6a5cd0d52530d818496c954ad95a69b304f1c8103d7b2ca2d509a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]},{"name":"wrappers.proto","sha256":"020c88776e814647da13c1cd5675031a3ffd35b016e64f721c5e066d375d4f43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6385f4f86c000704754efbe3"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6385f4f86c000704754efbe3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious Sample 4059645f8c66… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 4059645f8c66…. Threat score 76/100. 0/27 AV engines flagged this file. 2 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4059645f8c6666613f7d0477fbb189e96be7160c1235fb49a0df8a32b3200c6b"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 4059645f8c66… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 4059645f8c66…. Threat score 76/100. 0/27 AV engines flagged this file. 2 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4059645f8c6666613f7d0477fbb189e96be7160c1235fb49a0df8a32b3200c6b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 4059645f8c66… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 4059645f8c66…. Threat score 76/100. 0/27 AV engines flagged this file. 2 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]