Analysis

  • user interaction
    yes
  • max time kernel
    19s
  • max time network
    17s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260129-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260129-enlocale:en-usos:android-11-x64system
  • submitted
    31/01/2026, 04:32

General

  • Target
    YacineTV_____V3.2.apk
  • Size 8.4MB
  • Sample260131-e6dd2ahv2h
  • SHA256 0cbc222443477b45edbfd4d15033868d910d3758cae38c22204771677ec2de1b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 8 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • ver3.ycntivi.off
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4842

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        000385eac75823a29199f3468f142a19f8c06bedc6efcf93f6c73f21008dfa08.0.tmp

        • Path /data/data/ver3.ycntivi.off/cache/image_manager_disk_cache/000385eac75823a29199f3468f142a19f8c06bedc6efcf93f6c73f21008dfa08.0.tmp
        • Size 9KB
        • SHA256 d4e9549e4bfb1c09eb8a447938cf052eda9588bb761c8d44fa82c7176e6bf703
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0376ab6bf4f3edf63633e1f359b6a68ebcfae8af011bb58c9d18b073f1c02b4e.0.tmp

        • Path /data/data/ver3.ycntivi.off/cache/image_manager_disk_cache/0376ab6bf4f3edf63633e1f359b6a68ebcfae8af011bb58c9d18b073f1c02b4e.0.tmp
        • Size 7KB
        • SHA256 b3eff374ac139ff0eeb920a9a3dc8204ab00059774e44a3df8e2d330433ec34e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        4f118b957202a30711ec27cd660ead4e0ef397516dd2a177164f3dac31cad61a.0.tmp

        • Path /data/data/ver3.ycntivi.off/cache/image_manager_disk_cache/4f118b957202a30711ec27cd660ead4e0ef397516dd2a177164f3dac31cad61a.0.tmp
        • Size 8KB
        • SHA256 4b7a2b797e989164d1e5cc683bd217744444a7e1cdeceb7dd55300276f8817bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        57cdc8e884e3033f4472fdb387876873dd9e4a7d743082c700ce267ed44f283d.0.tmp

        • Path /data/data/ver3.ycntivi.off/cache/image_manager_disk_cache/57cdc8e884e3033f4472fdb387876873dd9e4a7d743082c700ce267ed44f283d.0.tmp
        • Size 18KB
        • SHA256 3a7ef1d21e24bd2ccf6645afacc536dbc92530d080501880c0499058d7fedf73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        6ee5dbb0ffbe49586f1c00200a95e11de897c283b469bce20a2e5615ed17ea42.0.tmp

        • Path /data/data/ver3.ycntivi.off/cache/image_manager_disk_cache/6ee5dbb0ffbe49586f1c00200a95e11de897c283b469bce20a2e5615ed17ea42.0.tmp
        • Size 19KB
        • SHA256 b05df6c5bbf5e43e9e8a640acf7caedafa0209af52078214a75c51a6c27a71f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        8cd95dffb202ac7071401b9edd2dd4b17e0e449864fb3ceab00df491f1ae0401.0.tmp

        • Path /data/data/ver3.ycntivi.off/cache/image_manager_disk_cache/8cd95dffb202ac7071401b9edd2dd4b17e0e449864fb3ceab00df491f1ae0401.0.tmp
        • Size 9KB
        • SHA256 c771bb80fec429ec073fe646d5cc2a372f6d175319ae0b9bcae4135c9be801dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        a1963f583c7517416f466231bc992a98c06c3cb4b86d7c5f8644a6d40383be19.0.tmp

        • Path /data/data/ver3.ycntivi.off/cache/image_manager_disk_cache/a1963f583c7517416f466231bc992a98c06c3cb4b86d7c5f8644a6d40383be19.0.tmp
        • Size 26KB
        • SHA256 6b079fa7f1a41bc2f76b924e011b8983103765a1568dd3e6fbcde4de37367748
        • MD5 SHA1 SHA512 SSDEEP TLSH

        e1a1e146f57c71222bc220e6f823ffc9f9fd62028ee2a17e20de4c911addddca.0.tmp

        • Path /data/data/ver3.ycntivi.off/cache/image_manager_disk_cache/e1a1e146f57c71222bc220e6f823ffc9f9fd62028ee2a17e20de4c911addddca.0.tmp
        • Size 10KB
        • SHA256 331438c1940f0cb547b265d29b89bea0257ae676b43882971a4b1b07bc80b475
        • MD5 SHA1 SHA512 SSDEEP TLSH

        journal

        • Path /data/data/ver3.ycntivi.off/cache/image_manager_disk_cache/journal
        • Size 2KB
        • SHA256 bd16ad80e39c268a58d914edc489e7201f9193cebb54bdf5f5d8e858287641dc
        • MD5 SHA1 SHA512 TLSH

        journal.tmp

        • Path /data/data/ver3.ycntivi.off/cache/image_manager_disk_cache/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512

        OneSignal.db

        • Path /data/data/ver3.ycntivi.off/databases/OneSignal.db
        • Size 52KB
        • SHA256 491c9687657ca71661a5cf42a763249f88fa222edaef20eaf552c4599458f99e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 c722c3a1cfb4e76b547acd8bc2e9527854b3aaeaca46884cb550e31055969568
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 68d886d0e3453fcc6892251d77550602fc9d001fd2113d6c2ef5abe2e54a7807
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 7703ba4848beddc516dfa1193a6f8861c054c640ee8d1b353b3f52c664cd1e54
        • MD5 SHA1 SHA512

        google_analytics_v4.db

        • Path /data/data/ver3.ycntivi.off/databases/google_analytics_v4.db
        • Size 28KB
        • SHA256 489c2f7b686f7c463086ba28bebd2c2f471e7d883d4fa761928e29e28dc3511b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/google_analytics_v4.db-journal
        • Size 512B
        • SHA256 4dd4b33eb8f848be1f87ff378f9c8df5a0a9ed32eeecf30ca3df89de97debdc9
        • MD5 SHA1 SHA512

        google_analytics_v4.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 2e2a0977d2b0364248f516e82b95710851d9d13eefb5433695baa1d1528964d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/google_analytics_v4.db-journal
        • Size 4KB
        • SHA256 eb06fdd6409ae308cdc6672d6f9867ea8dc1a861a82606df831e75d3229fcd16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 401c6b7442a23a120be6fb5b340af91193103257ea1a2453fbc1139fc7af3c76
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 ab61d5cd2e490846d85c0e2f5bf4d9e4cf2d5369b80f119f514172616b239714
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/google_analytics_v4.db-journal
        • Size 12KB
        • SHA256 ea55be674951411341a1df4713a4611ceaeaa63e6e07ee5ec914ef66dfbf88eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/ver3.ycntivi.off/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 c19791967a82123f0442f553c3a724e721393fedbb2ec6d1e8da2e6b62afa7c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/ver3.ycntivi.off/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 174d2eefb6c66db8dbf114c489ff715f5b300f56ba3fc2f6f4c1d7100e64c9c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/ver3.ycntivi.off/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 35446fa962aa4afbea9618bd07933362590d74dac6c9100e8259cd68d07b3681
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/ver3.ycntivi.off/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 7025090e4467456fec09a9e8af7ff126f53cc3f99692689d13d5e978e2ff0247
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/ver3.ycntivi.off/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 1d0deef81fb99e90a079575c392c5f3840bb8ad85e00d8b33d09e49fd496413a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/ver3.ycntivi.off/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 1990e82d4e9b9a8b843872e45c3e255520e0767c7918ae1501102e866221cfa3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 05bd9bc5dca59631e078734bbe219578c2b7220e20ec5a4e35f4ea6e3be6a003
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 189c7db120f6fa991a9ac74704bdad208333d8ac499048224b8a6355436600e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 bb3811e68da39b71bc38651c2d3391a94a1da19df65df724397e438395cc59bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 ce47381fb8878efb7869d01051855b2555744d1b7e2f2123c875f7fd2580c1dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 06a57a87b0311c8245689d419e3e1e338a988ad071a0aa34f83968c8792760dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/ver3.ycntivi.off/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 462512609a245220bc2f30dbdda560a093854db94a078ca44c35e577027cf36b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation297094075817437142tmp

        • Path /data/data/ver3.ycntivi.off/files/PersistedInstallation297094075817437142tmp
        • Size 90B
        • SHA256 671ba1249ddbefd4cebd363d3b244b4fc17b0746c3bb42e9d3899d1a402f5022
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation3446677887999612884tmp

        • Path /data/data/ver3.ycntivi.off/files/PersistedInstallation3446677887999612884tmp
        • Size 570B
        • SHA256 e083a95e1ee4c23a50006e36dd30de303e8a22635237356d07e95dfc23d0d07c
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation652891582629449143tmp

        • Path /data/data/ver3.ycntivi.off/files/PersistedInstallation652891582629449143tmp
        • Size 570B
        • SHA256 0c6e96c19aa1f5c6b4e3b0fbfa04424aa45f03fccb65babecd60bb87bab7efe0
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation9024075158462055007tmp

        • Path /data/data/ver3.ycntivi.off/files/PersistedInstallation9024075158462055007tmp
        • Size 90B
        • SHA256 aa8da99a3b1381ac8d9d37f0487cfce937a028f0caff93396f0732cf09ae2ad6
        • MD5 SHA1 SHA512 TLSH

        frc_1:692330584196:android:68ea9f0c920aa17904cad1_firebase_defaults.json

        • Path /data/data/ver3.ycntivi.off/files/frc_1:692330584196:android:68ea9f0c920aa17904cad1_firebase_defaults.json
        • Size 154B
        • SHA256 afb4396e7436b889fb5f31e54de06a2cdb8c7f2d7fd1b01960a44c0878945fe7
        • MD5 SHA1 SHA512 TLSH

        frc_1:692330584196:android:68ea9f0c920aa17904cad1_firebase_fetch.json

        • Path /data/data/ver3.ycntivi.off/files/frc_1:692330584196:android:68ea9f0c920aa17904cad1_firebase_fetch.json
        • Size 231B
        • SHA256 38f2fccdb96c52bf368ced0934b1203fc39ecdd2ac0087707ff85edd3bc1bfbc
        • MD5 SHA1 SHA512 TLSH

        gaClientId

        • Path /data/data/ver3.ycntivi.off/files/gaClientId
        • Size 36B
        • SHA256 d0b61410d772c133a377b98bd210eb1215167e253d09964a6915fe5b37432941
        • MD5 SHA1 SHA512

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/ver3.ycntivi.off/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 a73a26f3cff3282233bff75b6f4d3cd0d35d888fdf7dbb4c530b29d92b7c3215
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/ver3.ycntivi.off/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/ver3.ycntivi.off/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 5598d42728448357f643b57006a5eed568cf8814bdfd2d1f8833379db6a7bc06
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/ver3.ycntivi.off/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/ver3.ycntivi.off/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 66b6a3e5e762328e7f38053f9c5b2173958f09a02ced711dc26fdd32a7aceff2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/ver3.ycntivi.off/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 d236ee71ce0b22f82cd2de12bab0e3654a6e6b65fa4d9721b79a22a90643a82e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/ver3.ycntivi.off/no_backup/androidx.work.workdb-wal
        • Size 185KB
        • SHA256 3f83c6e9d138cf7e20740298f4d52e2daf4747e65efe999602f1ae45f81c3f79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/ver3.ycntivi.off/primary.prof
        • Size 2KB
        • SHA256 1242935355650217aee59b3a4de907bb9fb2ae6b0360ca8e74060dda14206585
        • MD5 SHA1 SHA512 TLSH

        androidx.window.sidecar.jar

        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 12KB
        • SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
        • MD5 SHA1 SHA512 SSDEEP TLSH