Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    28/03/2025, 15:14

General

  • Target

    pokedialer-2-0-8.apk

  • Size

    11.2MB

  • MD5

    f30282fe545913561c7146ec997e157f

  • SHA1

    700ef1ffde81cfb7b3fbc1433c267d9464928802

  • SHA256

    1b012fb5f2c973f9c2cd5e6614be43fb88b60c63494b897cdf54d3ff8baa4469

  • SHA512

    2b65ab4037f8dd4355089d903764c387c03917ffec94fcbbaab5dfb50af0e561c92e4f65f2db7d351497e6655a32413dc3f4fb6c28aa6c0bd0ede11da08b0cb4

  • SSDEEP

    196608:O8y6/qDN/HJ91+EeLyFL4bj4sKFKmwI7CI8bx3pvWBnk9q6vN5ntsQlltojAVq:ORrZfJX+ELIJmZCpNlWJk5l7lltojAY

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
  • Reads the content of the call log. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Checks the presence of a debugger
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.ajamalen.pokedialer
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Reads the contacts stored on the device.
    • Reads the content of the call log.
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks memory information
    PID:5059

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ajamalen.pokedialer/databases/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.ajamalen.pokedialer/databases/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    a5ac9f6dc53cd5fff15fff50bfe4fdf3

    SHA1

    a097c52d3cd1a0edb46684c9d4117f268cfc3185

    SHA256

    d5e74e3277962a3568e255b9d2e561e1b2502c3be8020f4f8d7efc843dcd11b5

    SHA512

    703cb0c811267e8e97a5cb7172262187f22b9603787a1694fe14bb6bd84374af7b01186a61d70fe7fdc48269ced6bff87c520184e5e0c3c3ac0bd97cd2c3f6c3

  • /data/data/com.ajamalen.pokedialer/databases/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.ajamalen.pokedialer/databases/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    50e955090f85b4e9cd962570700b9afb

    SHA1

    cca7f8ebf179ed47d34fe242ff15c2c8cdc33281

    SHA256

    3e4ee6a944e832066f847d379e81d45147e46a117fef5fe3e2f5a2f5a9b20472

    SHA512

    248510bd4bee75b9980c132ddbea82c00e31980bbd135afc9baea9839e5f4fdb35c800c244180c44eda0ebd6a07e00ee1d6ffa715847fa05abd6b002dd0fce8d

  • /data/data/com.ajamalen.pokedialer/databases/androidx.work.workdb-wal

    Filesize

    88KB

    MD5

    c689b15b79f842821b3eba7e25dffe73

    SHA1

    978f58a885589c08cb2d603129c8db781daa3031

    SHA256

    e1817bea6bfeb87d5ede9d43726bf5ef01f53bfc2f365bdde7d5d282ba1731f3

    SHA512

    5d1e8b925b158f774aa1baf24552f6e48155ccc487b661426ba9c3d12e07ccf1777f456363359177e05d90ed36fc078631fd46b41b66acf20cbd2fb9e84c6d97

  • /data/data/com.ajamalen.pokedialer/databases/com.google.android.datatransport.events

    Filesize

    40KB

    MD5

    639209664610e4bac55d7acc530ea405

    SHA1

    018e050ee83a52835ccbf261ef11fa9bdd42b134

    SHA256

    4dd7ef9fce8bd54ccb10c49d0ff30588e29135d257b58a4199988626be070587

    SHA512

    81f5361fda1273ca0f6981c4c787d53bc4b96910bea0b440ddee252f4cb9220de98930f03fe0b06be3b687b64c717298b6958284c653094d0a6f7f2bd737fed9

  • /data/data/com.ajamalen.pokedialer/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    2533484591edc92d628c064a412cb484

    SHA1

    b45043d2d031f4557cacac7ecd9170915ce1dd81

    SHA256

    bc7b89edff2e4f1cea85560b04bc44f5d1ebaf1970668b120002db5fe1c872b2

    SHA512

    979d082a527eff99b17864083ae88faa4f4e7197f3c98234887797ebbbb379f136ab0416aaa9c48c9b5cedc0a1f66184b49c04e43d6a41274c9488d04cfdb7a8

  • /data/data/com.ajamalen.pokedialer/databases/com.google.android.datatransport.events-journal

    Filesize

    24KB

    MD5

    edcd342c87c72a054da7ca0d8c0c2117

    SHA1

    5816dbf9850f417fab8c98701e39787e3d2ff13b

    SHA256

    ac8eb24817bd21de6fa5345f302c4894d3f08b6c14f4ce0f7258875b8719f9c4

    SHA512

    63adf2e399d8e84358d664abe8f580677716d57f3ba921007029bbd6a5521adb8683062b8c5f5cbe36b0274d39337be20b1dcfa34fa00289d4e6b346fd8d654a

  • /data/data/com.ajamalen.pokedialer/databases/com.google.android.datatransport.events-journal

    Filesize

    20KB

    MD5

    f59651d547dde579f8ce3269cf421d6e

    SHA1

    23f7d31ba6a7c27f72846cdc6f28d294416cffa9

    SHA256

    dfad1bc51641bd8164f944400ff3fa293ea5f495ce445e328da466a37be37f9a

    SHA512

    abba4e856685493fc02cb778f75640d34f216b6b5e5c0fe4be847dd0d03837e3d6881b1c109d7c94a3fe20b395cd639ee13fa27ba3aa349c65d365a211bff5a8

  • /data/data/com.ajamalen.pokedialer/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    bf29bf5bba31fa5d325035286459df65

    SHA1

    9081ea7b02c0d79d8753dc8c8fe876a1835360e4

    SHA256

    427d0d8d52106919788964569ad06ebf13dc7aa177c8fc3fcf9c496fe50fb16d

    SHA512

    dd406f691b12e5ee0bbb9187787ebbf8c69ae29cdff9c9916d781c33cbd05a7082ef3d3a104a1f7b406e55c4d8238ae7c010545fa6e8564a619f1f4896d07c5d

  • /data/data/com.ajamalen.pokedialer/databases/com.google.android.datatransport.events-journal

    Filesize

    20KB

    MD5

    3b521f0b6b2fe3c705501589e02dffa2

    SHA1

    2be6ecbf6b8805a0aaa77455bbfa6f8232a602dc

    SHA256

    b1b56c0749340bd28d075995242260ad5ba2a8c95d6ef4cb050839be78e0c507

    SHA512

    e7e0e5c443da71885575af17ed2148468ef55320ae141b6dd71e113f7a706464335fd7484cc02dcc7a91e591b236317789853c445bb07eef3763ceca6baf4f9e

  • /data/data/com.ajamalen.pokedialer/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    ecc68f3929f77c03e240b4600e724212

    SHA1

    c06597394a8844808c0ae86b6e513b841b0f9e3b

    SHA256

    12f1611a38398c3bedee7fe11a4c594ac02ef990fa9ef2533a9e9fa1fe072a35

    SHA512

    e9faace781444eb867fccf5718601e91ac7ddcf1411ecfa446a14d01b9934f096ac6e1d10a84e26caa9ec63669f2167aba7b4752010c346cdd653b037a1409b1

  • /data/data/com.ajamalen.pokedialer/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    eb52a90bb70b76e946b62f50b6f7fb85

    SHA1

    42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

    SHA256

    48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

    SHA512

    b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

  • /data/data/com.ajamalen.pokedialer/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    ec50df7b88805620821623f8420a8311

    SHA1

    7c0526123d582f6cef522e0cf72816d9209b1434

    SHA256

    7a4007cc840fd5f807f706a98e7a71deb99d068e7b7bbc273262f33f9aaebc84

    SHA512

    9abd6f2adec9607345e068e1d61f657a1ff44d4cfb247840ebfed177cef80fececc59116e1594c76d09d9ba7f704a649351027d167c1c2a294cb4fede2b1393d

  • /data/data/com.ajamalen.pokedialer/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    faa31a91ca8dfe518ac862450a14bb2e

    SHA1

    4d18edf611a003032f50c1a378997d4dd7f4510d

    SHA256

    a7f1bf0d847363bb92c49256dca727d2beec4f6cac8bc1a720c5b960361f6047

    SHA512

    904040ede2ce665a02b01fa0bfd8bec20377dc945478089a6a84e1051790e354a636dd8c65b6539225d3f57a56d6600b712732671a969b48f4d75c31e7ef462d

  • /data/data/com.ajamalen.pokedialer/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    9b9a826a459a8c89a7a783d68151d22d

    SHA1

    4ef587c49758c39dd13fd666bb9bec27e6b39f13

    SHA256

    fcbadf0dda7a65577f9761b365b85a703d0f1687905bbe14078808dec0bff97d

    SHA512

    26cd744da814ac49b7f17c1e052166e4475d2a1a7885d398d3021b0426cf6973ad54e6abed2b87768464b2cc3010a18b5a293c1d3cdf12dc3151933fd3af8c23

  • /data/data/com.ajamalen.pokedialer/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    521bd35e5a2e81acdf2df4763dc5feb3

    SHA1

    2188ca348c10bcbc55a6ede6cf62ee7a34251e6f

    SHA256

    670506ffdf4a240e6daa994f92cf184a4e21eb45e86099805a6eff85baea5504

    SHA512

    8c15c8c1764944e26d3a5333467546d103793a00482acf853cf3763302b58f90327f3e815c65ec3e3c560c814db67341591a5abbeffb9abd317f10d13e178512

  • /data/data/com.ajamalen.pokedialer/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    01d627f2a63f79d67de217c8d0e2dc24

    SHA1

    6b64986c07b270e45225a3a9d7c480923e631979

    SHA256

    6ac73376791bdd74a68649306b7ecbcc28647dacdf8d9d0a5c442558ddd61a6f

    SHA512

    c30a08df41f1740b00471f5657715e0858d9f67a3189f7d934db67ca691f8262016f5f356626208986ec3a63b46ab8a47de3762094bbc790ce86837da12d83c5

  • /data/data/com.ajamalen.pokedialer/databases/google_app_measurement_local.db-journal

    Filesize

    512B

    MD5

    236aa4565143f37a028423bfe913d0b9

    SHA1

    c821ac116565c9cce4a63ea7ba5590181ace7441

    SHA256

    2ba5912824963387f9d003563ce9bb2e5e06692af728aeb78240dc26279878d9

    SHA512

    2c69a1ab84bb6a16c69022aeb0ec4c1daa1be0284e19e7d7c4705c433937d434654e283a23386faa464b587da50b8f4a2ee81b7f3f96c6c9142ca6d2a95018d5

  • /data/data/com.ajamalen.pokedialer/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    f3ae207fb1b899926565ef12b16ead58

    SHA1

    94865e4fbd12048bd90ab523956ff23425f0f1f7

    SHA256

    4e607c099fa6ba7e80672c704e51c4fae13d7d081bd1e504ee405009a6b04536

    SHA512

    867d54966211342da370f443efd5cbbd9e8971e647110da2433f8fd19dbbf9a03e139e7bd19f533469405eefd46a6c49f5ea42ba3dacbdf899a9e5e66bac3969

  • /data/data/com.ajamalen.pokedialer/databases/google_app_measurement_local.db-journal

    Filesize

    4KB

    MD5

    8cbfe4feb093909859c647857cfb83bb

    SHA1

    e37f463acd5eb634e613a4bf905a59f145062165

    SHA256

    52ad1a24d1d70c0cb1194f922a819aad8ab952c2c34bad5e288ca3be5a605b5f

    SHA512

    023bbe672acff18a59c0dbe05fb39cc276fd7b6e2f472db1913c83bdd907a39421edd7fadcf65999e8fb7f2d9aef4b882dc90e8a1dde6288d40b7eadd92a9b83

  • /data/data/com.ajamalen.pokedialer/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    4c3d5dba901a4d256a9fe8da390f500b

    SHA1

    262c69f27f78a27b49648e6b94a3ab3fb3b3be38

    SHA256

    75aa50d7299e481ee7e67e009f19ef7be3602bb8d6c8432258a90dce6e443d69

    SHA512

    b7a3a7d75f6febe4120652bf92a36e2952df05febf33d3c791c72c59c6407eda172169b5e5c965efac65e355cd81143e9818f7600330bcc91250ebcac9c0cff1

  • /data/data/com.ajamalen.pokedialer/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    e3ee06a84a10a2b1dcff60a22a5a2a1f

    SHA1

    6e76ebd51f73aecdd938bdfb464f1d8b939a8576

    SHA256

    1a33338d709b2b746aa5a5f3173a9a5781cae2a0d7fcee5dc6f6fc689730bc03

    SHA512

    643190af0a33a805679fd5dcd8ecdbb659adf47c3e010bf64df4aed3f476106453488ad1f6d63304b0ed48c282cfe1cf705ac8d3989e95ff117ec624afa4a5d6

  • /data/data/com.ajamalen.pokedialer/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    82ad4fbdbd62ce35c61e6f7767e9b6f3

    SHA1

    d6fdc71e756632da42851151d194103a8f9a9f6e

    SHA256

    5235fda06bb70d37331b8d8abf74bfeacfe862b457575bce83db69180d7e491c

    SHA512

    405aecfb89bc5356ba7c7c2b912dffd0a62df980ab539abd4933381e063e88fa8dff30d9209a6c03e098280893401dd9332256e48883b6fa3059d4c803ec2e91

  • /data/data/com.ajamalen.pokedialer/files/.com.google.firebase.crashlytics/com.crashlytics.settings.json

    Filesize

    772B

    MD5

    fd55a7b42a20202a655f72fcdcea6903

    SHA1

    1a219f66a60030c91b2735a34b924fe42714fc96

    SHA256

    4b01833fbec7a57cd7900762e44ecae857dbe51ac0b9f2d2a7760d2c66441187

    SHA512

    381fe0ec81444392698489a17cf3b9886e49283e030a304eb9df4a28329a0a962c965758adb011f330e153c8f01fba6fa7debb21cbe8e56cfbc84d8f5e6f6fd8

  • /data/data/com.ajamalen.pokedialer/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-67E6BD2101CF000113C3DB8B6E40034E.temp

    Filesize

    1KB

    MD5

    50f5b160c10531355cdfd74da40f4779

    SHA1

    0a27787d2bf3671bfd45c4b745ee25268e3d79dd

    SHA256

    56ea05c02044e4a5f4e39fd00494b4f2af1d5ee31400ddd43806647144b84641

    SHA512

    233d7c03462c324aaf465169fe4248a087a28d17f71a1695b8f505d2a1b80d1bfdd7665c78ffe6a0f61ef84ea0eb1538498f54b465d2435da907494bcf1b696b

  • /data/data/com.ajamalen.pokedialer/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-67E6BD2101CF000113C3DB8B6E40034E.temp.tmp

    Filesize

    16B

    MD5

    c33583fae4e0b61cde1c5b9227963237

    SHA1

    fe2ebe4d27469af1460f7e852031a04208ef629b

    SHA256

    35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

    SHA512

    fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

  • /data/data/com.ajamalen.pokedialer/files/.com.google.firebase.crashlytics/report-persistence/sessions/67E6BD2101CF000113C3DB8B6E40034E/report

    Filesize

    747B

    MD5

    7b41e1e3c7e47a91c921ded3cd92d950

    SHA1

    28b99b51db532e2bb8d2985e1d4c3baae1b0d386

    SHA256

    69dd27650bc0914a91e40ad712bd94159eca3b265802e116339aff159c64890f

    SHA512

    24f53a4f07eb5d75c6d34cd930bd50ae8f1afa9e69673fff89eb5954095399e957f34c3a65a122e51cfe5ac3f6c3a93338e96287cbe677521af13f8528a7322f

  • /data/data/com.ajamalen.pokedialer/files/PersistedInstallation6178356111173843606tmp

    Filesize

    567B

    MD5

    6a7fc6a9e7f05e1dcfbbc7b44eb1e2b8

    SHA1

    7e14a825c4ea2ef27cfe4f38802fd9664d1f0570

    SHA256

    23fdcd6d2dc16c3bf70af92ee3e9fc88742381d6981668083ea1d832012b9180

    SHA512

    8370a2ecbf2d77100d3918938511888ef52ce02294cef8a90694025d41ed7c6b5bb05cf111e37fda6797964d0f6357f707b48766a2392350abe082152f1b253d

  • /data/data/com.ajamalen.pokedialer/files/PersistedInstallation8321984499814481509tmp

    Filesize

    90B

    MD5

    3124fae7c91c0b2e889bf37c6ff73244

    SHA1

    4fab8ed05e078381681c8d6e9a2a876523a977f9

    SHA256

    1d3061423ef3ec4af6ff3c50c8aa50969f93966bed827cf1cfebd6a3379b637b

    SHA512

    2c27292b9cf0b3eff914bcbeeb803a33b2abd8676bc89b678d482bb6c8e2ba1ef2957c0031ac8b5b5031cf633384698613753f30f8785ded603b59db77d48c2c

  • /data/data/com.ajamalen.pokedialer/files/frc_1:70350103318:android:1306184a011483b4642637_firebase_defaults.json

    Filesize

    253B

    MD5

    87f828c007929698809abc555e630d7b

    SHA1

    aea976c8f983d51e805d050ffd6708d2e804429e

    SHA256

    d7b2f42b45878366778884cf47fa12c86b5d91d51255a478217a69e5d1b22a87

    SHA512

    819a3ac90fda0cccf5bb4096c3043174d6a509c9c06d1729e2cf58d22c13e3283aba91973eda2903aa8f6b0ce8d60bc3d7873221296f937364645177684eaed1

  • /data/data/com.ajamalen.pokedialer/files/frc_1:70350103318:android:1306184a011483b4642637_firebase_fetch.json

    Filesize

    398B

    MD5

    c7a5be637e18057adc8829c9c3ac7610

    SHA1

    ed0e910f407928f1cba1f6155b3024a51ec44b1b

    SHA256

    b7b4f2861a3d01768bf30c0765d8d251f7cf4623d180d7aac4dce5044a82965a

    SHA512

    0147caa765432d59260830b472813ea4e24363e133560291091291760e6c0b3e2b05ba6fd7d3aa94b220a5e4b4e18ad34a55b6a16ff7f4369c8d63ca374e9d62

  • /data/data/com.ajamalen.pokedialer/files/frc_1:70350103318:android:1306184a011483b4642637_fireperf_fetch.json

    Filesize

    1KB

    MD5

    4e41158ba37502d23726f6f02f342387

    SHA1

    c595616a330675358a156a63b393d2876643c6c3

    SHA256

    21163677db2e0b79b01a1e45b9cf647edd3e5d0d65d9cd74ba94fc70e1c550d1

    SHA512

    7a36aaa07d001bcc8b023645712dbd9fbfda78bcc0d7337a8a2064f055836bb35eb33882ba598dab9278c573051a6643cbcc4b1ef45e911e75f3aa661c1a7c92