Overview

overview

6

Static

static

6

sample.apk

android-9-x86

6

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260306-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260306-enlocale:en-usos:android-9-x86system
  • submitted
    23/03/2026, 16:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sample.apk
  • Size 3.3MB
  • Sample260323-txrbvsgt21
  • SHA256 951c94809aa6c7ab587125f9d4df30fa6a49ee0cbba76a4b7ceedaaa0e5dcd36
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasionpersistence

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion

Processes

  • com.android.logcatd
    1⤵
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4204
    • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
      2⤵
        PID:4251
      • /system/bin/ndk_translation_program_runner_binfmt_misc /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libandroid_runtime.so /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libandroid_runtime.so service
        2⤵
          PID:4236
        • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
          2⤵
            PID:4813
          • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
            2⤵
              PID:5348
            • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
              2⤵
                PID:5880
              • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                2⤵
                  PID:6413
                • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                  2⤵
                    PID:6943
                  • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                    2⤵
                      PID:7475
                    • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                      2⤵
                        PID:8005
                      • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                        2⤵
                          PID:8530
                        • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                          2⤵
                            PID:9060
                          • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                            2⤵
                              PID:9593
                            • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                              2⤵
                                PID:10123
                              • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                2⤵
                                  PID:10658
                                • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                  2⤵
                                    PID:11187
                                  • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                    2⤵
                                      PID:11718
                                    • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                      2⤵
                                        PID:12247
                                      • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                        2⤵
                                          PID:12778
                                        • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                          2⤵
                                            PID:13307
                                          • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                            2⤵
                                              PID:13839
                                            • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                              2⤵
                                                PID:14368
                                              • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                                2⤵
                                                  PID:14899
                                                • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                                  2⤵
                                                    PID:15428
                                                  • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                                    2⤵
                                                      PID:15959
                                                    • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                                      2⤵
                                                        PID:16488
                                                      • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                                        2⤵
                                                          PID:17019
                                                        • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                                          2⤵
                                                            PID:17549
                                                          • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                                            2⤵
                                                              PID:18076
                                                            • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                                              2⤵
                                                                PID:18599
                                                              • sh /data/app/com.android.logcatd-aI4GgewNEt5vaQb30TyErA==/lib/arm/libdalvik_runtime.so --DataDirectory /data/user/0/com.android.logcatd/files/tor_data --SocksPort 127.0.0.1:9050 --ControlPort 0
                                                                2⤵
                                                                  PID:19136

                                                              Network

                                                                    MITRE ATT&CK Mobile v16

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads