cca27d0f8955bf653cb70b41e7438b107bfd075374d92ca8208e319331240c83

Resubmissions

05/03/2026, 19:15

260305-xyamaaax3z

05/03/2026, 19:10

260305-xvr26aax2v10

03/03/2026, 14:05

260303-rd357sat3x10

Analysis

max time kernel
149s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20260129-en
resource tags

arch:armarch:x86image:android-x86-arm-20260129-enlocale:en-usos:android-9-x86system
submitted
03/03/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Android Defender.apk
Size 1.5MB
Sample260303-rd357sat3x
SHA256 cca27d0f8955bf653cb70b41e7438b107bfd075374d92ca8208e319331240c83
MD5 48f6dca2ae182285b8ded7a326090f96
SHA1 e73f4a43b7d9a6eaf77c35b1f95a05140ac9412f
SHA512 4796a87faa4928b7bd01d2a4cfc92711d60597b6db5a50222fd9ab844a3f5d05acd93e7212f7f4a300869d5bc078061520d935ee088939da595f9ea24ed0c42d
SSDEEP 24576:vkBDaYo8/sG612v8mtHYNVQSaBrtGrlCwcUplxRB9I9CxJCJMmg:sBL/sF2vzBYzQ/HPUlfB9wCxY+L
TLSH
T120751291A3ED4529F5F39B3999310456E839BCC56A21D29E0215B85C0EBBF80CF71FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery impact privilege_escalation

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.android.defender.androiddefender
/data/local/xbin/su	com.android.defender.androiddefender
/data/local/bin/su	com.android.defender.androiddefender
/system/sd/xbin/su	com.android.defender.androiddefender
/system/bin/failsafe/su	com.android.defender.androiddefender
/data/local/su	com.android.defender.androiddefender
/sbin/su	com.android.defender.androiddefender
/system/bin/su	com.android.defender.androiddefender

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.android.defender.androiddefender

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.android.defender.androiddefender

com.android.defender.androiddefender
1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Tries to add a device administrator.
PID:4266

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

droidbackup.db

Path /data/data/com.android.defender.androiddefender/databases/droidbackup.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

droidbackup.db-journal

Path /data/data/com.android.defender.androiddefender/databases/droidbackup.db-journal
Size 512B
SHA256 b33d84e095b907fdad8e3c23de965dcc89ad13167053975b54b82ad7f2c3592c
MD5 f3d4f188ad4aa66273fcf2f927cf8b35
SHA1 5442b42dca6d08361d66a783319f884b4ba6fc50
SHA512 e4cd2ae08cee29c37a99b64f0bb26961bf9246cf6a7f4674d05e1d0abd98e11dcd515d0e8b701a9b77844e86007c58d5d64350abea60843e919fee36307952c8
MD5 SHA1 SHA512

Submit Download

droidbackup.db-shm

Path /data/data/com.android.defender.androiddefender/databases/droidbackup.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

droidbackup.db-wal

Path /data/data/com.android.defender.androiddefender/databases/droidbackup.db-wal
Size 32KB
SHA256 e8812bbfede7e146dfe9d47d2959355f6630f2fc2eaf45415129b6cef5d3654e
MD5 691f3d3c2259383a39b9e6c080d6ab41
SHA1 8870036a3fb5b356079b84c9dd2e990fe28a0318
SHA512 efcffc621e4622fe984f9432bfd4a1d3023ff15e5592df99ceb3a54c5a556bf690e3536d367f513fd2d2daeccf9fe3b6fc458a9c0cf9f90492623c76f554c2b4
SSDEEP 24:KmCAizyGSP/AFQZMK6n3yDcgFuAvVGSP/Ax/f:yxzNSP/DMK6nwqAvQSP/a
TLSH
T14CE2BDC687801327C30C4372E8E693D12EBBDE2F8753874F15A504F46E4278D61A5E18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virusdb.db-journal

Path /data/data/com.android.defender.androiddefender/databases/virusdb.db-journal
Size 512B
SHA256 b4ab5bcf0afbc8e0101bc422a1ef32fe6e5138dc5d07e0e027789f5377651817
MD5 f26ae7ad72691c3e6dbaea637f04e1cc
SHA1 7d9be9075b4fae4203ffeb5908343622bce50992
SHA512 e1c77e4405dec4882d5318cd06ba8b0aa619f907db46196e0cb254edd83c4e48523596e2190bcf8901a21bda29634c64547d9b854a38c5e353c78ff6acb6fdb8
MD5 SHA1 SHA512

Submit Download

virusdb.db-wal

Path /data/data/com.android.defender.androiddefender/databases/virusdb.db-wal
Size 32KB
SHA256 851b99345e0759ba4f6004aed3c19c6367805d068571f0f07c95f91ddcd8a9dd
MD5 9deb57f4b9bfa8a80415a41a17cae690
SHA1 24d35d6786180746d3054062c2cc9ee3b91a501a
SHA512 32249d141b3cf4909f3dd81de40a35aa200d41aae719cf2e4ac8fbe7f29f53d8a7074015ceb28f1f72e5198adf96f35cafa2beaa1836a0a7ad9639e7d6242999
SSDEEP 24:KCFqA8pyqzyGSP/avhsWXp89kXMaIjiSAduGSP/apOAF:hFx8pXzNSP/avhsE89iMaIQSP/apOC
TLSH
T12EE28CC68B442462E3C50673ECAD93535AB5921B9752C7839F917570EE017CCA863E78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Event_1772546771856-79502

Path /data/data/com.android.defender.androiddefender/files/Event_1772546771856-79502
Size 59B
SHA256 2620dd0f923cecd07ab1e1c2c792e93a4dd1d57f24c87d7f5fd35e4a55dcc23c
MD5 ecdde70877455ed254a2c90e783f1fa8
SHA1 aa6033ed17fd73b3c807add1b9d35d64ba7bbbad
SHA512 ceedc0c521843ab129882c4da905994b1e0621291c00ba81366e534ac50dec3ee8988cdadfce4bf67b48faf0fc0ba9953334a0e1ce6f13b82d5e27f932a9a567
TLSH
T1EAA00280261072111F4218416411D384895A93BDD582477949227281BF908A70325153
MD5 SHA1 SHA512 TLSH

Submit Download

Ping_1772546772216-27304

Path /data/data/com.android.defender.androiddefender/files/Ping_1772546772216-27304
Size 53B
SHA256 08faf209eb88f9dae62ab3560cd1827e3b76311fb2ae30d2eb1a66a1e582894f
MD5 58c682a79e89531156212117031ae8d6
SHA1 b341e5ab78653cb3824ffce54a7eff61723d8938
SHA512 073b7e1e0bac7b817001570d87b64177038168c625eb04e075a81a3d8c908e1c90a42b5d1eb6e95aaef86c89b622d8753b41c270da6fbcbbc0f9a35890c71cc7
TLSH
T1589002852610B6112D4108002410D348855A93B915861739453312807F41C660334052
MD5 SHA1 SHA512 TLSH

Submit Download

.bugsense

Path /storage/emulated/0/.bugsense
Size 33B
SHA256 36e5e4e78c9cc6e25ebfb0b8b52bc6eff0fd2d665515cad4b3353e48473f4dcd
MD5 82d672d2c16613adc7588609ff088a3e
SHA1 938c397b69dfbe35e1442bf23a291674b808e68a
SHA512 6dfb30dd99433faa37279d25c287a40d48e853fc3e71e96621829fd2b528be1a8a3ab5a7f50863d12872bb5b566058628150ee6dc5eaec6fd8f74e8949ff77eb
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads