26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T440,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 531978cfa590… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 531978cfa590…. Threat score 100/100. 0/27 AV engines flagged this file. 4 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57"],"about":{"@type":"SoftwareApplication","name":"VPN 4X Premium v16.0 Premium Mod Apk {CracksHash}.apk","applicationCategory":["android"],"identifier":"531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tb5c,"assets/nopie_openvpn.arm64-v8a" (Indicator: "open") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "assets/nopie_openvpn.armeabi-v7a" (Indicator: "open") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "assets/nopie_openvpn.x86" (Indicator: "open") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "assets/nopie_openvpn.x86_64" (Indicator: "open") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "assets/pie_openvpn.arm64-v8a" (Indicator: "open") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "assets/pie_openvpn.armeabi-v7a" (Indicator: "open") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "assets/pie_openvpn.x86" (Indicator: "open") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "assets/pie_openvpn.x86_64" (Indicator: "open") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "firebase-measurement-connector.properties+K-*" (Indicator: "connect") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "res/animator/fragment_open_enter.xml" (Indicator: "open") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "res/animator/fragment_open_exit.xml" (Indicator: "open") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "res/color/abc_background_cache_hint_selector_material_dark.xmluP" (Indicator: "select") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "res/color/abc_background_cache_hint_selector_material_light.xmluP" (Indicator: "select") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "res/color/m3_button_background_color_selector.xml" (Indicator: "select") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "res/color/m3_button_foreground_color_selector.xml" (Indicator: "select") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "res/color/m3_button_outline_color_selector.xmluP" (Indicator: "select") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "res/color/m3_button_ripple_color_selector.xml" (Indicator: "select") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "res/color/m3_navigation_bar_ripple_color_selector.xml" (Indicator: "select") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "res/color/m3_selection_control_button_tint.xml" (Indicator: "select") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk "res/color/m3_selection_control_ripple_color_selector.xml" (Indicator: "select") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk28:T13e8,Heuristic match: "sd*/@].et" Heuristic match: "SN_}'\.hM" Heuristic match: "lib/arm64-v8a/libhydra.so" Heuristic match: "lib/arm64-v8a/libosslspeedtest.so" Heuristic match: "lib/arm64-v8a/libovpnexec.so" Heuristic match: "lib/arm64-v8a/libpartner-celpher.so" Heuristic match: "lib/arm64-v8a/libping-lib.so" Heuristic match: "lib/arm64-v8a/libpl_droidsonroids_gif.so" Heuristic match: "jHsDx~.uS" Heuristic match: "lib/x86/libhydra.so" Heuristic match: "lib/x86/libosslspeedtest.so" Heuristic match: "lib/x86/libovpnexec.so" Heuristic match: "lib/x86/libpartner-celpher.so" Heuristic match: "lib/x86/libping-lib.so" Heuristic match: "lib/x86/libpl_droidsonroids_gif.so" Heuristic match: "lib/x86_64/libhydra.so" Heuristic match: "lib/x86_64/libosslspeedtest.so" Heuristic match: "lib/x86_64/libovpnexec.so" Heuristic match: "lib/x86_64/libpartner-celpher.so" Heuristic match: "lib/x86_64/libping-lib.so" Heuristic match: "lib/x86_64/libpl_droidsonroids_gif.so" Heuristic match: "EWJ36{9:}mS?.so" Pattern match: "ns.adobe.com/xap/1.0/" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "https://www.istockphoto.com/photo/license-gm1217966894-?utm_medium=organic&utm_source=google&utm_campaign=iptcurl" Pattern match: "http://www.iec.ch" Heuristic match: "d< titoOnzFlag of Iceland blowing in the wind. Full page Icelandic flying flag. 3D illustration. https://www.istockphoto.com/photo/license-gm1217966894-?utm_medium=organic&utm_source=google&utm_campaign=iptcurl " (Indicator: "https://") in Source: 531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57.apk1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790833511158,"unified_at":"2026-10-01T05:45:11.158Z","metadata":{"hashes":{"sha256":"531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57","sha1":"69e43fccb264572408a9497ca3007ba1a6ea65ef","md5":"4c82a6d69bd840b79f901decba1a65be","sha512":"a67c1e2e7d7bf5e8bef200931de88364d19fb252228211884b79689c7415c5d527355a05c889ecf5f17c4bc994277a2fcdf829b8ef9a64b1ea62de83243691e4","ssdeep":"393216:Tu71DlnRsy6WfHT9MznuvhWvGNblzB9Geg04hQjFBILEPZuHYWnxixilXL7QZFi1:Tu7T2efmSZWONbllXna8dBuHYwoxwL0w","ssdeep_chunks":["393216:Tu71Dln","393216:u71DlnR","393216:71DlnRs","393216:1DlnRsy","393216:DlnRsy6","393216:lnRsy6W","393216:nRsy6Wf","393216:Rsy6WfH","393216:sy6WfHT","393216:y6WfHT9","393216:6WfHT9M","393216:WfHT9Mz","393216:fHT9Mzn","393216:HT9Mznu","393216:T9Mznuv","393216:9Mznuvh","393216:MznuvhW","393216:znuvhWv","393216:nuvhWvG","393216:uvhWvGN","393216:vhWvGNb","393216:hWvGNbl","393216:WvGNblz","393216:vGNblzB","393216:GNblzB9","393216:NblzB9G","393216:blzB9Ge","393216:lzB9Geg","393216:zB9Geg0","393216:B9Geg04","393216:9Geg04h","393216:Geg04hQ","393216:eg04hQj","393216:g04hQjF","393216:04hQjFB","393216:4hQjFBI","393216:hQjFBIL","393216:QjFBILE","393216:jFBILEP","393216:FBILEPZ","393216:BILEPZu","393216:ILEPZuH","393216:LEPZuHY","393216:EPZuHYW","393216:PZuHYWn","393216:ZuHYWnx","393216:uHYWnxi","393216:HYWnxix","393216:YWnxixi","393216:Wnxixil","393216:nxixilX","393216:xixilXL","393216:ixilXL7","393216:xilXL7Q","393216:ilXL7QZ","393216:lXL7QZF","393216:XL7QZFi","393216:L7QZFi1","786432:Tu71Dln","786432:u71DlnR","786432:71DlnRs","786432:1DlnRsy","786432:DlnRsy6","786432:lnRsy6W","786432:nRsy6Wf","786432:Rsy6WfH","786432:sy6WfHT","786432:y6WfHT9","786432:6WfHT9M","786432:WfHT9Mz","786432:fHT9Mzn","786432:HT9Mznu","786432:T9Mznuv","786432:9Mznuvh","786432:MznuvhW","786432:znuvhWv","786432:nuvhWvG","786432:uvhWvGN","786432:vhWvGNb","786432:hWvGNbl","786432:WvGNblz","786432:vGNblzB","786432:GNblzB9","786432:NblzB9G","786432:blzB9Ge","786432:lzB9Geg","786432:zB9Geg0","786432:B9Geg04","786432:9Geg04h","786432:Geg04hQ","786432:eg04hQj","786432:g04hQjF","786432:04hQjFB","786432:4hQjFBI","786432:hQjFBIL","786432:QjFBILE","786432:jFBILEP","786432:FBILEPZ","786432:BILEPZu","786432:ILEPZuH","786432:LEPZuHY","786432:EPZuHYW","786432:PZuHYWn","786432:ZuHYWnx","786432:uHYWnxi","786432:HYWnxix","786432:YWnxixi","786432:Wnxixil","786432:nxixilX","786432:xixilXL","786432:ixilXL7","786432:xilXL7Q","786432:ilXL7QZ","786432:lXL7QZF","786432:XL7QZFi","786432:L7QZFi1","393216:Tu7T2ef","393216:u7T2efm","393216:7T2efmS","393216:T2efmSZ","393216:2efmSZW","393216:efmSZWO","393216:fmSZWON","393216:mSZWONb","393216:SZWONbl","393216:ZWONbll","393216:WONbllX","393216:ONbllXn","393216:NbllXna","393216:bllXna8","393216:llXna8d","393216:lXna8dB","393216:Xna8dBu","393216:na8dBuH","393216:a8dBuHY","393216:8dBuHYw","393216:dBuHYwo","393216:BuHYwox","393216:uHYwoxw","393216:HYwoxwL","393216:YwoxwL0","393216:woxwL0w"],"imphash":"Unknown"},"file_info":{"file_name":"VPN 4X Premium v16.0 Premium Mod Apk {CracksHash}.apk","file_type":["android"],"file_type_id":"apk","file_size":23870198,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1653505129000,"last_seen":1678268742000,"last_multi_scan":1678268742000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":7,"suspicious_count":7,"malicious_count":4,"total":18},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Broadcast Receivers","attack_id":"T1402","attack_id_wiki":"https://attack.mitre.org/techniques/T1402","identifiers":[{"type":"malicious","value":"Has the ability to execute code after reboot"}],"sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"tactic":"Persistence","technique":"Code Injection","attack_id":"T1540","attack_id_wiki":"https://attack.mitre.org/techniques/T1540","identifiers":[{"type":"malicious","value":"Has the ability to use the DexClassLoader (possible code injection)"}],"sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"tactic":"Defense Evasion","technique":"Application Discovery","attack_id":"T1418","attack_id_wiki":"https://attack.mitre.org/techniques/T1418","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1422","attack_id_wiki":"https://attack.mitre.org/techniques/T1422","identifiers":[{"type":"suspicious","value":"Has the ability to get the wifi MAC address (may be used to fingerprint device)"}],"sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1421","attack_id_wiki":"https://attack.mitre.org/techniques/T1421","identifiers":[{"type":"informative","value":"Tests the internet connectivity"}],"sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]}],"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/61 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DebugProbesKt.bin\" as clean (type is \"compiled Java class data version 52.0 (Java 1.8)\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$27","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"informative","category":"General","name":"Tests the internet connectivity","description":"Found invoke in \"f.c.q.w.o.smali\" to \"android.net.NetworkInfo.isConnected\"\n Found invoke in \"f.c.q.w.o.smali\" to \"android.net.ConnectivityManager.getActiveNetworkInfo\"\n Found invoke in \"f.c.q.w.o.smali\" to \"android.net.ConnectivityManager.getNetworkInfo\"\n Found invoke in \"f.c.q.u.i.smali\" to \"android.net.ConnectivityManager.getActiveNetworkInfo\"\n Found invoke in \"f.c.q.u.i.smali\" to \"android.net.wifi.WifiManager.getConnectionInfo\"\n Found invoke in \"f.c.q.u.i.smali\" to \"android.net.NetworkInfo.getState\"\n Found invoke in \"f.c.q.u.e.smali\" to \"android.net.NetworkInfo.getState\"\n Found invoke in \"f.c.q.u.e.smali\" to \"android.net.NetworkInfo.getDetailedState\"\n Found invoke in \"f.c.q.u.e.smali\" to \"android.net.NetworkInfo.isConnected\"\n Found invoke in \"f.c.p.j.smali\" to \"android.net.ConnectivityManager.getActiveNetworkInfo\"\n Found invoke in \"f.c.p.j.smali\" to \"android.net.NetworkInfo.isConnected\"\n Found invoke in \"f.c.p.r.e.smali\" to \"android.net.ConnectivityManager.getActiveNetworkInfo\"","origin":"Static Parser","mitre_attack_id":"T1421","relevance":3,"id":"static-41","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"https://www.facebook.com/adnw_logging/\" (Indicator: \"facebook.com\")\n \"https://linkedin.com\" (Indicator: \"linkedin.com\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"bitdefender\" (Indicator: \"bitdefender\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"SHA-256-Digest: 6BbcCZj07pDXtjDxfhb8wuctkQeMUxWtqsS8LaTCJtc=\" (Indicator: \"qemu\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"neongamingstudio90@gmail.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"suspicious","category":"General","name":"Uses java reflection classes","description":"Found invoke in \"com.facebook.soloader.SoLoader$1.smali\" to \"java.lang.reflect.Method.invoke\"\n Found invoke in \"com.facebook.soloader.SoLoader$Api14Utils.smali\" to \"java.lang.reflect.Method.invoke\"\n Found invoke in \"com.facebook.ads.internal.dynamicloading.DynamicLoaderFactory.smali\" to \"java.lang.reflect.Method.invoke\"\n Found invoke in \"com.facebook.ads.internal.bridge.fbsdk.FBLoginASID.smali\" to \"java.lang.reflect.Method.invoke\"\n Found invoke in \"com.facebook.ads.internal.util.process.ProcessUtils.smali\" to \"java.lang.reflect.Method.invoke\"\n Found invoke in \"com.facebook.ads.internal.util.process.ProcessUtils.smali\" to \"java.lang.reflect.Field.get\"\n Found invoke in \"f.d.a.c.e.smali\" to \"java.lang.reflect.Field.get\"\n Found invoke in \"f.c.i.d.j.c.smali\" to \"java.lang.reflect.Method.invoke\"","origin":"Static Parser","relevance":3,"id":"static-47","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"00.000.000.00\"\n \"6.10.0.0\"\n \"10.1.1.1\"\n \"127.0.0.1\"\n Potential IP \"6.10.0.0\" found in string \"GOOGLE:6.10.0.0\"\n \"10.254.0.1\"\n \"8.8.8.8\"\n \"100.64.250.1\"\n \"8.8.4.4\"\n \"128.0.0.0\"\n \"0.0.0.0\"\n Potential IP \"255.255.255.255\" found in string \"ipaddress.error.ip.format=invalid format of IP address, whether IPv4 (255.255.255.255) or IPv6 (ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff) or other supported format\"\n Potential IP \"255.255.255.255\" found in string \"ipaddress.error.ipv4.format=invalid format of IPv4 (255.255.255.255) address\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"suspicious","category":"Network Related","name":"Has the ability to open an internet connection","description":"Found invoke in \"com.google.android.gms.ads.identifier.zza.smali\" to \"java.net.URL.openConnection\"\n Found invoke in \"com.facebook.ads.internal.dynamicloading.DexLoadErrorReporter$1.smali\" to \"java.net.URL.openConnection\"\n Found invoke in \"f.b.a.b0.b.smali\" to \"java.net.URL.openConnection\"\n Found invoke in \"f.c.m.qa.a.smali\" to \"java.net.URL.openConnection\"","origin":"Static Parser","relevance":3,"id":"static-46","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Has the ability to get the wifi MAC address (may be used to fingerprint device)","description":"Found invoke in \"f.c.i.d.j.e$f.smali\" to \"android.net.wifi.WifiInfo.getMacAddress\"","origin":"Static Parser","mitre_attack_id":"T1422","relevance":10,"id":"static-53","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"malicious","category":"General","name":"Has the ability to read the device ID (e.g. IMEI or ESN)","description":"Found invoke in \"f.c.i.d.j.e$d.smali\" to \"android.telephony.TelephonyManager.getSimSerialNumber\"\n Found invoke in \"f.c.i.d.j.e$e.smali\" to \"android.telephony.TelephonyManager.getDeviceId\"","origin":"Static Parser","relevance":3,"id":"static-42","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Has the ability to execute code after reboot","description":"Permission request for \"android.permission.RECEIVE_BOOT_COMPLETED\"","origin":"Static Parser","mitre_attack_id":"T1402","relevance":10,"id":"static-28","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"https://api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"a.smali\")","origin":"File/Memory","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Has the ability to use the DexClassLoader (possible code injection)","description":"Found invoke in \"com.facebook.ads.internal.dynamicloading.DynamicLoaderFactory.smali\" to \"dalvik.system.DexClassLoader.\"","origin":"Static Parser","mitre_attack_id":"T1540","relevance":3,"id":"static-54","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]}],"incidents":[{"name":"Fingerprint","details_count":3,"details":[{"detail":"Has the ability to read the device ID (e.g. IMEI or ESN)"},{"detail":"Has the ability to get the wifi MAC address (may be used to fingerprint device)"},{"detail":"Has the ability to identify network operator related data"}],"sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Has the ability to execute code after reboot"},{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]}]},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"628e7c651145350902061f8b","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"VPN 4X Premium v16.0 Premium Mod Apk {CracksHash}.apk","analysis_start_time":"2022-05-25T18:58:50+00:00","indicators_count":{"informative":7,"suspicious":10,"malicious":4},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DebugProbesKt.bin","sha256":"2607dd7a7379d775a8b8c011f0336576f57320617e9d6a5e152b52dbcdc9ddae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"AndroidManifest.xml","sha256":"8898b192d359fc80bfb899989ccabede44f46dd6c4f5c2dbcf49456d0bdd14b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"BNDLTOOL.RSA","sha256":"e02c6a111db6b6fa923e901ff60f109f6c1999a5e729d456be0b1b5bac0008f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"BNDLTOOL.SF","sha256":"80bab399409817c9acdc254b5db81f31fceafaaab1045cc049d4ffad9859fb84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"IPAddressResources.properties","sha256":"dd299e6ae55f0f740380d2beec6b5810f2b1e0259dc2c16ce16ce004cc7d9c94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"MANIFEST.MF","sha256":"8688c3e443fb7e77148dc87fa9b9ca43fbb43470b17343376d3c3d1d1afaecd6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidsupportmultidexversion.txt","sha256":"a1c3b0007bcaecc29cb7b7fa4a2ace25036988d66a354c0fd6bdea6eb51568fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidx.activity_activity.version","sha256":"563a0b4eec3c77bbc34ac630d4fa5214f5c6726ae01468404fd704473110084e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidx.annotation_annotation-experimental.version","sha256":"1575e1af4a95f12f70b4ee6a6adce8160953d93ea17dc2611b90883ccc3ad3b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidx.appcompat_appcompat-resources.version","sha256":"7d072b48526b023950e4c48db01e8c273554a6401119f5691e7589ba9bc65d9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidx.appcompat_appcompat.version","sha256":"7d072b48526b023950e4c48db01e8c273554a6401119f5691e7589ba9bc65d9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidx.arch.core_core-runtime.version","sha256":"c89b87c262e9d5ffd20e73aac74a1772adcc9f5a21682cc33adcf5086e5fef5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidx.asynclayoutinflater_asynclayoutinflater.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidx.browser_browser.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidx.cardview_cardview.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidx.coordinatorlayout_coordinatorlayout.version","sha256":"1575e1af4a95f12f70b4ee6a6adce8160953d93ea17dc2611b90883ccc3ad3b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidx.core_core.version","sha256":"bb7320d831e7a151aa901c35e7326c752fa2ef5024f30768c42319b8bed171ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidx.cursoradapter_cursoradapter.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidx.customview_customview.version","sha256":"1575e1af4a95f12f70b4ee6a6adce8160953d93ea17dc2611b90883ccc3ad3b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]},{"name":"androidx.documentfile_documentfile.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628e7c651145350902061f8b"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["628e7c651145350902061f8b"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 531978cfa590… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 531978cfa590…. Threat score 100/100. 0/27 AV engines flagged this file. 4 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 531978cfa590… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 531978cfa590…. Threat score 100/100. 0/27 AV engines flagged this file. 4 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/531978cfa590bb8509b65bcdd8b89d5f902fa4a00d4c46ba83a164d0ce0e0b57"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 531978cfa590… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 531978cfa590…. Threat score 100/100. 0/27 AV engines flagged this file. 4 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]