Analysis

  • max time kernel
    125s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    15/04/2026, 04:42

General

  • Target
    8f35f1eea06e7225a57ac6906953e92a34aa8fdfcd9316b574ef8338ec86d1c1.apk
  • Size 95.6MB
  • Sample260415-fbqxbaas7x
  • SHA256 8f35f1eea06e7225a57ac6906953e92a34aa8fdfcd9316b574ef8338ec86d1c1
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.pt.bark
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4740

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        environment.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/environment.json
        • Size 12B
        • SHA256 80be2eb0944c0453a6ad339a56e1c8f39f8cc57a4e627758246ccfd274176fd8
        • MD5 SHA1 SHA512

        release.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/release.json
        • Size 23B
        • SHA256 9188fe301476b60232a87f3130e3de7a279836948756c65a2afed745f5aacf03
        • MD5 SHA1 SHA512

        sdk-version.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/sdk-version.json
        • Size 591B
        • SHA256 db13c6bfe1f38e4faab79262c364e231f8527612b34fba16c6a3934954983dab
        • MD5 SHA1 SHA512 TLSH

        tags.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/tags.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512

        breadcrumbs.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json
        • Size 4KB
        • SHA256 33601049be3956aae2afbd3f8e0c6e37e69e6a201736a3ff8789c55dd4292cb6
        • MD5 SHA1 SHA512 TLSH

        breadcrumbs.json.tmp

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json.tmp
        • Size 12B
        • SHA256 ae1afdb53fc94d62b6862659f839a20634382b65a7354f32b5e81cd29fb4270d
        • MD5 SHA1 SHA512

        contexts.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/contexts.json
        • Size 63B
        • SHA256 dda403ea3f2dc79793e354552c63edfb2be6a7676df6d0ecdd02a12055fcdad8
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 8e105191b50a34d1802fca379bf3e9dea920f95ea8a0be5287ae9033e7c24167
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 188B
        • SHA256 311b9fb11804e0b669024b559819a889d6d30da033146642cfa588d4b9658617
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 d29d4c2e6eecf969b1511ba3586f6a6d139237985ca6ad6ae843150486a86331
        • MD5 SHA1 SHA512 TLSH

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 18B
        • SHA256 96f7a5db03a7c5ec7847b1ca053fa92d19552fe07cf22a21a004e4aabed4a95c
        • MD5 SHA1 SHA512

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 16B
        • SHA256 96c4b7db81f09c9990c9e856e2d350b49f8ca5e0657620be9a6632cc3d7aaf1c
        • MD5 SHA1 SHA512

        8a578bba3b4c49f3961b9a6232ff5929.envelope

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/8a578bba3b4c49f3961b9a6232ff5929.envelope
        • Size 885B
        • SHA256 53f50f3f1a3b21d557e43b1bbaede83fe2c351b936980a9247a3486d2dbc71d5
        • MD5 SHA1 SHA512 TLSH

        8d93a546d71b4170a2e3c3f1cc7c10ef.envelope

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/8d93a546d71b4170a2e3c3f1cc7c10ef.envelope
        • Size 963B
        • SHA256 7c37876c4d79ecd6337b4187679ea2370c03b5256519178891cd1a6c18b3029e
        • MD5 SHA1 SHA512 TLSH

        session.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/session.json
        • Size 267B
        • SHA256 be2cdb8677d7332b2313d5f6e6931f1c784a90a4144d226045b586e74bbea7d7
        • MD5 SHA1 SHA512 TLSH

        OneSignal.db

        • Path /data/data/com.pt.bark/databases/OneSignal.db
        • Size 52KB
        • SHA256 491c9687657ca71661a5cf42a763249f88fa222edaef20eaf552c4599458f99e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 1914fbaaaafcfe580220804914d6b2eabe0935151f35f29b0eb6e08d4e5cbd14
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 96615d6beba1a3510cf4760159cd9891c1bf72413e7afe70ac9daa717ee93625
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 57bfa7573b18e5a35c3b764e9e3869d95937732e8742f350f8133c68f5807e76
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 8b42ec3ed29348c645a3826609b0c7fd3dffd80626855a9fcab888635354c7f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 2178b62fbeb334a469c579aee435c4eb6413a7f27e987420b7565502b858e1d8
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 214190a9a1dc0a73a0bf7a140576095390ad5a84c7c99bd89bb1fee43ec9e4c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 85792ebea26b17d8f83c666e68693f6c9a3bc367aa07c5db6fc576dfc248a9d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INSTALLATION

        • Path /data/data/com.pt.bark/files/INSTALLATION
        • Size 32B
        • SHA256 f69b59cf13ed845b052d5a22e74f5573ef67b053cf8f252913ce43a644cb70f5
        • MD5 SHA1 SHA512

        PersistedInstallation2030475980278794617tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation2030475980278794617tmp
        • Size 90B
        • SHA256 9919a4c8b3c0354ee4ab2281115d4dcdceb17e9547a56b42aa50ace373f3fc9c
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation3129767402435870054tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation3129767402435870054tmp
        • Size 90B
        • SHA256 b3e8c2d61d396cc8ce62ceeb7472fed2892a7291176ee449da07fb870c321e09
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation5185301494715148036tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation5185301494715148036tmp
        • Size 566B
        • SHA256 65710df471b6e42a67e10d8e21c1e43f1a0ebd485add5561ccd9028bdb425a67
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation6627274071287566294tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation6627274071287566294tmp
        • Size 567B
        • SHA256 033a69a7d8eb9cbe02047815f4318dcc2e25ce26afa1ffc404ebb4b30c50f1ef
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.pt.bark/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 86c466713ab2dda3815aee754662219fb3264c13568c915c1f64553aa634dfc9
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb
        • Size 100KB
        • SHA256 ea12053cd5f06d0fac08bbef09f7c77d5e2ccda48d077f7509e610486352944b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 62c87c28e3d637ece452c84e612095b5ed308cf22a6c09f408cb77cf8bcca06e
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 4ac467968104c283b1d533e7c1d37568bf4220edf222c82802786872a792ac7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 6e7d64e69c93850c5d9a2b11c478498e5eed10b0420fe1b09b7480b3089e2bb2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 410KB
        • SHA256 c43b03f6c920183a899c34a8c1813bd9a471b0aa109d91783e7465797c53e5b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 1KB
        • SHA256 b4853307d7cddee5a29e5f474a168bd67a821191aa1089b712ca7c561e53287e
        • MD5 SHA1 SHA512 TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 15KB
        • SHA256 4ae796747687b96c501ec4b61ed7b8f8651ded313efbffc081a3f462e94e226c
        • MD5 SHA1 SHA512 SSDEEP TLSH