Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    02/05/2026, 04:25

General

  • Target
    6194aa250a7ec0c9e956c5a661ff9a3fe7db7135177a130fe97e0e3c8421115e.apk
  • Size 17.0MB
  • Sample260502-e15lbscz4q
  • SHA256 6194aa250a7ec0c9e956c5a661ff9a3fe7db7135177a130fe97e0e3c8421115e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.alienmanfc6.wheresmyandroid
    1⤵
    • Acquires the wake lock
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4959

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 50e04108de017bb234d31c999c68a4eb45fa914e8da6e4c7978cf720548ea7f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 1876abc2d95ca62feb2703bd7d5b6fa3c49a75c59d8cf17520ab66774891f95a
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 ecd5628b0899b41c039bfbc5ef5f6cd1f7cb6cf29aff2550357ef148899495f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 19209536713ae0eb26a642ba42136ff122430f40e7aa196cd2e60878a767fb38
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db
        • Size 28KB
        • SHA256 21336f0e2ee602555724196e437f278b50596a5cda1925455c464691886d14ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 512B
        • SHA256 18e8aac75ff236b71c022b9a5d3600f152516af8281ea54ea3196cac3f2ad98b
        • MD5 SHA1 SHA512

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 d74f41069d061cf3d49634578bb7c51df2a90e806a19a95298455aa34ffd4e9b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 4KB
        • SHA256 ad65a668087541d27f0b45951775713038df8abea8095bee921cf4a806b6c9c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 48693f89e7ad75b2ce9461bae22bcb842e1fd88d252688e2cf6a833bbc165493
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 c2ef2e9304e88c29da016daf93f6592b6d5add48818e9e94d60bfed9271c18e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 12KB
        • SHA256 d3673a23b594cef82b9136eec840b385feed38b93abfa2c54d4c23eb94449a84
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 90859cbb1055c0b0b2bd2e7d5a904e5fbcc531719968860ee4f5aa0c45fdb711
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 e7c02ed480ed62f9dfe94102f9c0577641763b4e632d2d51fd9661a5d5564625
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 0903d08850fa5f8063893c143416dcbd87b6b746f57a62cb747e3d2c92d7a305
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 3177c0b18b6f0defb3e918da437ac347325d9d93bdcd0fed94d635d40f91ae4e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 b0b63a87432b7a3e63f22203c036adb36c4801f6de19638226107cc4bc94c68d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 cb6144dd802250b6836918dc9582d3076fe81328b2bff7f960ddfcffb7dfc90f
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 ec13b2235eadd39fe6f7ea6c92045df477953ac943e83d968997c6ccceba6507
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 813074ac01b11ba61109ab3e029be6441522e1ad37f83a155849adc76d94bfea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 566adb37690ef863c38ebf1c503bf7cd46ee940b3d31a10ce79f8dc94b26c172
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 2bb1779311e412b564c5b593d9514215e665992ad846d3c0aad8ed83bcd23995
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 8dfb8d683c12b8cda11982b54b3440e1dc828ad08b327b1737c2401d89f110d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wheres_my_droid

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid
        • Size 4KB
        • SHA256 7e417167f83c40dc493b9f3f371e395d8dae49775d4d1060ddecd4c2edf6ecee
        • MD5 SHA1 SHA512 TLSH

        wheres_my_droid-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-journal
        • Size 512B
        • SHA256 bb4e5459234f6cd4e8ad035ab001af52d7e58c2607a06d44534321297d40b48f
        • MD5 SHA1 SHA512

        wheres_my_droid-shm

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        wheres_my_droid-wal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-wal
        • Size 321KB
        • SHA256 fd3778931399f69da64f7dc0b42043b2248ae879ca1710a1ac6074e5ed04e5ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation6879860003965106184tmp

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/PersistedInstallation6879860003965106184tmp
        • Size 558B
        • SHA256 ee2e3d2a4b2d889e78a2dd3705457b39d96e06a73e17f9900a46963e0c7f341d
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8080253458018924531tmp

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/PersistedInstallation8080253458018924531tmp
        • Size 90B
        • SHA256 d4d72ffaffb90d9388f8fb73d2d8527776e93e0790df657672e0036617e41d84
        • MD5 SHA1 SHA512 TLSH

        coverage

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/coverage
        • Size 65B
        • SHA256 00268464acf89cc333b9ca8e0ef01368efb1f73e16ac66831104ef8fc3f28a8d
        • MD5 SHA1 SHA512 TLSH

        coverage

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/coverage
        • Size 54B
        • SHA256 b2c3de313ddbe97841fa2256287f0b03a7b86ceffe6056c4402eb6a114efe24b
        • MD5 SHA1 SHA512 TLSH

        gaClientId

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaClientId
        • Size 36B
        • SHA256 e5a2439a61a49d783070843d3760fe4fd2ea9706ad93d05d616af1040787ebd7
        • MD5 SHA1 SHA512

        gaClientIdData

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaClientIdData
        • Size 32B
        • SHA256 fc94f64994d5d1537f750f5a9159a9ef483b3b90d90874e037f64ed7091e509c
        • MD5 SHA1 SHA512

        gaid

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaid
        • Size 85B
        • SHA256 4da8790eae77fb6aa1060cb0f41e336cfeba3591eb33b6b261fc4b338119fc93
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 2535d0f7ad2241235c06759682594e8c2fe38e6bb94a121c0f3d7bd6db386224
        • MD5 SHA1 SHA512

        regulation_consent

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/regulation_consent
        • Size 1KB
        • SHA256 daf4adfb6557707a4e04fab5961060f6d937155abc9e3cc7da1f2f7bb14cf91f
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 113B
        • SHA256 f91c4758326194d12adaa31e40111eed67827c442d7118e37aa5e6e828946c02
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 98B
        • SHA256 94363d4079068c5b103f3d7fd19942f69d783974e7b97c50feffd75aa8621c9f
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 161B
        • SHA256 54dc7360e4f3c0045ce8ab87e75120b1015dbc38611437bd0c11b4f3971bcc16
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 160B
        • SHA256 75285ea6e5a478c9f496911781f9b443a88c468ff26e75cea50fcf42f31c98e3
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 602B
        • SHA256 de1ef3bf255414323689a019375f9c4c04b8c1c523bbfec739630cb600d88f08
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 602B
        • SHA256 94dee8c991212dc903a43f1364af25a0d875e7c0c3df67bffab053870b57c00f
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 695B
        • SHA256 b6d06a1e4dec51af01ed25cf13c2619a88d754a7cfeb2bf9a02fdefa0eca19ce
        • MD5 SHA1 SHA512 TLSH

        should_attach_if_allowed

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/should_attach_if_allowed
        • Size 31B
        • SHA256 53ade896a4b756ca5058942117acbe4b3d069c77c64b75662da74d2fcc558e3c
        • MD5 SHA1 SHA512

        primary.prof

        • Path /data/misc/profiles/cur/0/com.alienmanfc6.wheresmyandroid/primary.prof
        • Size 2KB
        • SHA256 4fdb914bbb522d296fcb021cb703ab975e3d3eb44a016b9c1a17696a9e1d563e
        • MD5 SHA1 SHA512 TLSH