File name:

o1l3ek8e.apk

Full analysis: https://app.any.run/tasks/688245bf-10c5-465a-9477-07fa9891788d
Verdict: Malicious activity
Analysis date: October 12, 2025, 03:34:17
OS: Android 14
Indicators:
MIME: application/vnd.android.package-archive
File info: Android package (APK), with AndroidManifest.xml, with APK Signing Block
MD5:

E703F6EB59C32AAB740F2878F1E86520

SHA1:

54C670F6EE376395727838C8A1C39E17ABA6FFD8

SHA256:

EC2CE22AF9B9215D78BF3EA71539017B73C765E0E2D9275CF51088FADC055C62

SSDEEP:

98304:pbW+EAArjakDqLZ/ooZxDfkzlA4EwXDUjubqWpLxTo5JHjQ2zFMW0kyzQ+InoVB5:NWuHQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Checks whether the screen is currently on

      • app_process64 (PID: 4013)

    • Connects to the CnC server

      • app_process64 (PID: 4013)

  • SUSPICIOUS

    • Retrieves a list of running services

      • app_process64 (PID: 4013)

    • Abuses foreground service for persistence

      • app_process64 (PID: 4013)

    • Activates a regular task at set intervals

      • app_process64 (PID: 4013)

    • Detects when screen powers off

      • app_process64 (PID: 4013)

    • Checks if the device's lock screen is showing

      • app_process64 (PID: 4013)

    • Contacting a server suspected of hosting an CnC

      • app_process64 (PID: 4013)

    • Connects to unusual port

      • app_process64 (PID: 4013)

    • Requests access to accessibility settings

      • app_process64 (PID: 4013)

    • Launches a new activity

      • app_process64 (PID: 4013)

    • Overlays content on other applications

      • app_process64 (PID: 4013)

    • Prevents its uninstallation by user

      • app_process64 (PID: 4013)

    • Intercepts events for accessibility services

      • app_process64 (PID: 4013)

    • Updates data in the storage of application settings (SharedPreferences)

      • app_process64 (PID: 4013)

    • Uses encryption API functions

      • app_process64 (PID: 4013)

    • Reads messages from SMS inbox

      • app_process64 (PID: 4013)

    • Leverages accessibility to control apps

      • app_process64 (PID: 4013)

    • Performs UI accessibility actions without user input

      • app_process64 (PID: 4013)

  • INFO

    • Verifies whether the device is connected to the internet

      • app_process64 (PID: 4013)

    • Dynamically registers broadcast event listeners

      • app_process64 (PID: 4013)

    • Retrieves the value of a secure system setting

      • app_process64 (PID: 4013)

    • Stores data using SQLite database

      • app_process64 (PID: 4013)

    • Gets the display metrics associated with the device's screen

      • app_process64 (PID: 4013)

    • Dynamically inspects or modifies classes, methods, and fields at runtime

      • app_process64 (PID: 4013)

    • Retrieves data from storage of application settings (SharedPreferences)

      • app_process64 (PID: 4013)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.apk | Android Package (73.9)
.jar | Java Archive (20.4)
.zip | ZIP compressed archive (5.6)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2025:10:12 11:29:50
ZipCRC: 0xb07af546
ZipCompressedSize: 7115
ZipUncompressedSize: 38328
ZipFileName: AndroidManifest.xml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start app_process64 app_process32 app_process32 no specs app_process32 app_process64 no specs

Process information

PID
CMD
Path
Indicators
Parent process
4013<pre-initialized> /system/bin/app_process64
app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
4050com.android.webview:webview_service /system/bin/app_process32
app_process32
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
4052webview_zygote /system/bin/app_process32—app_process32
User:
webview_zygote
Integrity Level:
UNKNOWN
Exit code:
0
4168com.android.webview:webview_apk /system/bin/app_process32
app_process32
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
4268<pre-initialized> /system/bin/app_process64—app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
63
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
4013app_process64/data/data/AezRvyQeLaL.njwR.FMbeoLa.slOmhspflwva/no_backup/androidx.work.workdb-journalbinary
MD5:—
SHA256:—
4013app_process64/data/data/AezRvyQeLaL.njwR.FMbeoLa.slOmhspflwva/shared_prefs/AezRvyQeLaL.njwR.FMbeoLa.slOmhspflwva.xmlxml
MD5:—
SHA256:—
4013app_process64/data/data/AezRvyQeLaL.njwR.FMbeoLa.slOmhspflwva/no_backup/androidx.work.workdb-walbinary
MD5:—
SHA256:—
4013app_process64/data/data/AezRvyQeLaL.njwR.FMbeoLa.slOmhspflwva/app_webview/last-exit-infobinary
MD5:—
SHA256:—
4013app_process64/data/data/AezRvyQeLaL.njwR.FMbeoLa.slOmhspflwva/shared_prefs/WebViewChromiumPrefs.xmlxml
MD5:—
SHA256:—
4013app_process64/data/data/AezRvyQeLaL.njwR.FMbeoLa.slOmhspflwva/app_webview/Default/Web Data-journalbinary
MD5:—
SHA256:—
4013app_process64/data/data/AezRvyQeLaL.njwR.FMbeoLa.slOmhspflwva/cache/WebView/Default/HTTP Cache/Code Cache/js/indexbinary
MD5:—
SHA256:—
4013app_process64/data/data/AezRvyQeLaL.njwR.FMbeoLa.slOmhspflwva/cache/WebView/Default/HTTP Cache/Code Cache/wasm/indexbinary
MD5:—
SHA256:—
4013app_process64/data/data/AezRvyQeLaL.njwR.FMbeoLa.slOmhspflwva/app_webview/Default/Shared Dictionary/cache/indexbinary
MD5:—
SHA256:—
4013app_process64/data/data/AezRvyQeLaL.njwR.FMbeoLa.slOmhspflwva/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-indexbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
24
DNS requests
16
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1939
app_process64
GET
204
142.250.185.195:80
http://connectivitycheck.gstatic.com/generate_204
US
—
—
whitelisted
—
—
GET
204
142.250.185.132:80
http://www.google.com/gen_204
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
142.250.185.195:80
connectivitycheck.gstatic.com
GOOGLE
US
whitelisted
450
mdnsd
224.0.0.251:5353
—
—
—
whitelisted
—
—
142.250.185.132:443
www.google.com
GOOGLE
US
whitelisted
—
—
142.250.185.132:80
www.google.com
GOOGLE
US
whitelisted
4013
app_process64
163.181.58.173:443
y.music.163.com
—
MY
whitelisted
4013
app_process64
118.107.43.130:5000
—
BGPNET Global ASN
SG
unknown
4013
app_process64
103.135.240.77:443
music.163.com
NETEASE HONG KONG LIMITED
JP
whitelisted
579
app_process64
216.239.35.4:123
time.android.com
—
—
whitelisted
1939
app_process64
142.250.185.195:80
connectivitycheck.gstatic.com
GOOGLE
US
whitelisted
1939
app_process64
142.250.185.132:443
www.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
www.google.com
  • 142.250.185.132
whitelisted
y.music.163.com
  • 163.181.58.173
  • 163.181.58.177
  • 163.181.58.175
  • 163.181.58.171
  • 155.102.51.3
  • 163.181.58.174
  • 163.181.58.172
  • 163.181.58.170
  • 163.181.92.205
  • 163.181.58.176
  • 163.181.254.189
unknown
music.163.com
  • 103.135.240.77
  • 103.135.240.78
whitelisted
connectivitycheck.gstatic.com
  • 142.250.185.195
whitelisted
time.android.com
  • 216.239.35.4
  • 216.239.35.0
  • 216.239.35.8
  • 216.239.35.12
unknown
staging-remoteprovisioning.sandbox.googleapis.com
  • 142.250.102.81
whitelisted
clientservices.googleapis.com
  • 216.58.206.35
whitelisted
update.googleapis.com
  • 142.250.184.227
whitelisted
edgedl.me.gvt1.com
  • 34.104.35.123
whitelisted

Threats

PID
Process
Class
Message
4013
app_process64
Malware Command and Control Activity Detected
MALWARE [ANY.RUN] Trojan:Android/SpyAgent CnC Activity outbound M1
1939
app_process64
Misc activity
ET INFO Android Device Connectivity Check
4013
app_process64
Malware Command and Control Activity Detected
MALWARE [ANY.RUN] Trojan:Android/SpyAgent CnC Activity outbound M2
4013
app_process64
Malware Command and Control Activity Detected
MALWARE [ANY.RUN] Trojan:Android/SpyAgent CnC Activity inbound M1
4013
app_process64
Malware Command and Control Activity Detected
MALWARE [ANY.RUN] Trojan:Android/SpyAgent CnC Activity outbound M2
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
o1l3ek8e.apk