Analysis
- user interaction
yes - max time kernel
269s - max time network
269s - platform
android-13_x64 - resource
android-33-x64-arm64-20260325-en - resource tags
arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system - submitted
03/05/2026, 18:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
4.7.0.apk
Resource
android-33-x64-arm64-20260325-en
2 signatures
150 seconds
General
- Target 4.7.0.apk
- Size 67.2MB
- Sample260503-w2a7jsft5t
- SHA256 3fdbde37d50fea40f708fb6ca3051ac3e6d3751ead279813e38a3805dc0c6529
- MD5 35262cb2070ebefa96c201453cdb7834
- SHA1 a8075e455cf0f4260286213fc6041e60bd7e7ded
- SHA512 cab5bd71aadc6ae898c42e03903b68813e506a1f20d53ace7133120f7ca05dcbdfd2d902bfe7bc609d1a57d3fd55912e9f0eba750eb87d74830e2ffde75cb450
- SSDEEP 1572864:j30lw69OAhzmxd8cJ5dZmnGnhUvwwTuHLlBwprbIg11I:rZsO3WcJ9XnivwwiZ6pvU
- TLSH T10BF72396EB6ABE3EC43E51729C4A067125560E21CB07836778183B5C28F35F58EC93DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /system_ext/framework/androidx.window.extensions.jar 4253 com.lagradost.cloudstream3 /system_ext/framework/androidx.window.extensions.jar 4253 com.lagradost.cloudstream3 /system_ext/framework/androidx.window.sidecar.jar 4253 com.lagradost.cloudstream3 /system_ext/framework/androidx.window.sidecar.jar 4253 com.lagradost.cloudstream3 - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 14 raw.githubusercontent.com 15 raw.githubusercontent.com
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.lagradost.cloudstream3/cache/http_cache/46f4716a90b7de0053509cc97a6d7b30.0.tmp
- Size 1KB
- SHA256 93205796a59972bbe99d8cc414e07e890f48f98f4911684fd1030724d404cb69
- MD5 4956a1bc71539bb3d0f4bd39d3e32be6
- SHA1 36a08610954b269bce2471e30c6f385d9859273e
- SHA512 0c751c9f50826d70d5c93cd8a74f8e6b957ad5b0093f35e695be49113d41f6b99c217dea6f81715c169e6405a7bbca42150a9ed72c6e618c7c44ccf7cc0ad3c9
- TLSH T15A310ED9671114640FC01CD6F649D741E122F6DEE432E0DEF32216A482CA9EE115F24F
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.lagradost.cloudstream3/cache/http_cache/46f4716a90b7de0053509cc97a6d7b30.1.tmp
- Size 6KB
- SHA256 0ea716826179c9e01b2cdb36ea62535593c16be259df667619030d92a8cc4e05
- MD5 da116a339ace8b3c6b6936b6e05c9174
- SHA1 a26b45449dbd9b91ef8547aa1eb3f16a3282081c
- SHA512 0d1d7209075517bb1dcfcf8924e5027c35adec3fadaf84c9602b2fc9e66fbf940ef0d869611557a3d146506787a3b01e53345248fc404deb2239da125ebf4574
- SSDEEP 192:rGtHeS58URzGCCb0qsCtT3tLWLZJbhxwwkN:rGteSFRzSbtsCVdWlRDwRN
- TLSH T198D19F1007EA7486FAA24EFD9315CC746B487DD8921A7CFBB96480A0E718E8827CA095
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.lagradost.cloudstream3/cache/http_cache/4da1c91e0b0e685262a3b696516acc53.0.tmp
- Size 1KB
- SHA256 190da0f85a99fa6475115484b4b37e7c8b34400aa99344adb1d601aaa2f7a5db
- MD5 924b438a43056b712f72932c5b79e7d7
- SHA1 3726e54491fbbf9c5cc3fc185f5741bfa3458538
- SHA512 b624ee84ea65a5ba33ac972495881c1218c42178022a54d84a56abe18d31ea9d5341f2181c75d9376d5868a891d98b65f9bb378a737822a47f2697106400c5cc
- TLSH T13A2123B59B7156941F91A1818968AB896132E759F722ECECC311826C41F53FB02C6388
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.lagradost.cloudstream3/cache/http_cache/4da1c91e0b0e685262a3b696516acc53.1.tmp
- Size 23B
- SHA256 6d854456defca287eaf23c86e1b9aba7cd12f188262e332f120919660d0cfb47
- MD5 352ad4f535245055a7703cd8dbfd7760
- SHA1 c352a409f73d910bdc018d754e36d84341f69fb6
- SHA512 a996fa6ef366d43a900949efa2a34791904d246b3900b20fbf4bd35c59f2674724c501641de8e36d7045b2c27aead6865ab93795dbb82e2ffbb012bbdfa610f0
- MD5 SHA1 SHA512
- Path /data/data/com.lagradost.cloudstream3/cache/http_cache/journal
- Size 210B
- SHA256 2ad5630d5a511b943338cfde0423acf94ddc4821006a9eb98d43dd150137c9f7
- MD5 93001a110e8109a6020994f3d8b776f4
- SHA1 d2dae174e2a4d086c283fba7f1651387c5516fe4
- SHA512 6fe4cbb5794d39201af9cba3cdac06bf71cabad6ddf34f323412f3d90ec2f3997064c5eee2d882eb3df501ee8581ed253e57410a66dc9918cff84a2e54b37659
- TLSH T132D01288102B0133E9B8E4B203F82B82F639A002B340EB0A8A0020EA1EB1E642C22201
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.lagradost.cloudstream3/cache/http_cache/journal.tmp
- Size 36B
- SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
- MD5 37e8e716e0e2f4a0b05cd9571d95b84d
- SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
- SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
- MD5 SHA1 SHA512
- Path /data/data/com.lagradost.cloudstream3/databases/com.google.android.datatransport.events
- Size 56KB
- SHA256 24221dea2d70f40c8eb115337888d3c6725f4e6c5d1203ae2261564edc5ac91b
- MD5 00b7634d336197c2613cb09f1e1681b8
- SHA1 b047e204c4e944492968d48e8a26ec8b3c564090
- SHA512 4c0a6ee146be1643691503f56854df75d71b163396a5ad3d1be5c9f4059d5d03a97fe0e9add7744ba5351cb35cb218ee11e8df76c2a7372d07bd3816e1e75b9f
- SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPS4:RMEX0wIyNja4
- TLSH T13443639D5A2C2221C57E283ED3E243635B7C93DF5B23927239908CF98DC206974359A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.lagradost.cloudstream3/databases/com.google.android.datatransport.events-journal
- Size 512B
- SHA256 b518dde2549dc0fd16ecfc2f26e6a351cfc5bf8a9418c71720ae210054dcda94
- MD5 e927f8d46a9b68efdc15d28250855763
- SHA1 1eed98b0c4069cdcc771115feaaad7962e70850c
- SHA512 0f1ab85bf42fd4e2ecbbf0b68ea6df3d140ad8343538ebad339f3ba1da085bdd8aebc3c57443915a53ddc3b516e5386289d729be11a0d3be8c035be725f90928
- MD5 SHA1 SHA512
- Path /data/data/com.lagradost.cloudstream3/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 4dede16d5b0125f4b37efc523e46c4a85591914ba376160b9de7bd6bbc9577dc
- MD5 b22f55974ef993eb2bf5f68173889cbc
- SHA1 5b769d896c42d7eabb6b483e2725adc80a97ddc1
- SHA512 a203f4b9373cea645eab645cfc0ef83bda16468240ed2a3480610e68af03a7d53574bc8f1658e41644ab5621f412b5792ab294b1e6ae92e170f37ac2e187fafc
- SSDEEP 6:7+/l9jGaOn1yyg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuK4/:7+tBG1qLiuWd7RmBEyPbZ
- TLSH T1770222A8A3C01823C81D5677E0E4C3600D00A7198263CF07055108A52C836CCA8A0D08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.lagradost.cloudstream3/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 53e2840ad1552cd8cc914ed64eb25bc1a34327784aa833f0790efb3cf0d7127f
- MD5 49fc4f682356536c00576d3c47e83278
- SHA1 aff689745b47104195351c35cc34aa582a8da092
- SHA512 529250c61b3b8124a0b7c3865e7f804641dc6e3f18b05b2579df46d16675e3121a5e16d66d908a242e34622c6e3f69ab2d83abee3a458dc8ecf7a8569ea1e9ae
- SSDEEP 6:7+/l9HQOPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuK9a/KEQn:7+t1DqLJdKBRmBEyPbj4
- TLSH T18D0222CA63400913C41D5B7BD0D9C3501F18A7248323DF07166128543C02ACCE8A0D48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.lagradost.cloudstream3/files/profileInstalled
- Size 24B
- SHA256 8aded9471bb83badf8aa042414c7566be3fad47a0be4ba4f3e86a7668de53e78
- MD5 b30aa1d8bb5b5c3ee8d1a368769f75ba
- SHA1 95eb70b442e5f0ab66b17e654cb75dff65af68b6
- SHA512 d99333b085d678e8b16a4d089cc2fcd80b08c20a44ed32f7396fbdd32a9a0dbfbea6a3508340d4bd958022df2a88bebe4f02d92d29700e5405e779ac2f8795dd
- MD5 SHA1 SHA512
- Path /data/data/com.lagradost.cloudstream3/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 e132b7b6ddedd3977d72137472afb0a5edfe16185d5aaae087c5e2f5d9065aa4
- MD5 4dd56b020d6809bcbe4b87a38d790595
- SHA1 60f2a2bc456081c31482c047640042bb96806e21
- SHA512 bcb54ae4cec236fcb6476476e4ce5bb6e06c058e02dce7b4f8f55eaa03361d0ce701e4f571a9e4eb92d7b295a16101871a127c80f2cc2c6d0a263a4244ceaaf6
- MD5 SHA1 SHA512
- Path /data/data/com.lagradost.cloudstream3/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
- MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
- SHA1 fee434f784e73cc7916322e949f727caf8363102
- SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
- TLSH T183810250534000E1D05446B354E113080F06D19496428B03550100428C415440C60E88
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.lagradost.cloudstream3/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 89ff1a36a748b73bf1a5f9b9ba61d2c32ed01404920c860d74070ccdbbfc703e
- MD5 50e95b5336501d7b0e9c34f117f458c0
- SHA1 deff7d0c115c77ac6ebb7a5181dd57789d234b6f
- SHA512 b5d15d18a614dd3eae0c08bb3e72bb5964397a1c442e77fce5ed71e3ed30936333e78779d4e5b34ed6f37a99d0d4a10ebfb64d4e73d10d1a232ca9602a803a89
- MD5 SHA1 SHA512
- Path /data/data/com.lagradost.cloudstream3/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.lagradost.cloudstream3/no_backup/androidx.work.workdb-wal
- Size 116KB
- SHA256 bbccde9e2b6d6b4034c80cc749c658e7a74fa66b22841927e526b0e9c1deb6c9
- MD5 ad853e1f9b211f8705a1d3bc951b5a4d
- SHA1 a32e27b9e0e458a9d06e68ef7448eab26a51b449
- SHA512 ed7ee10c3b332edb460f8f3494ae98dba0620075aabedc56ad55c78c7d6e97c9d324ea4dc1b4df690028ed58ba3cac9f83f020c0f285292f5750049e8cd4b5c5
- SSDEEP 192:3mquRAhJ3DqNw/rhofYbNVNyvMJMv5d745htidjnfWzzb83zS1D+XD86u0ED:kghtidjnfWzzb83zSwXD86u0ED
- TLSH T1AEC3228E1F993E00C0AD54B1D8D00FE17D3E41AE97A3D3966D9104B5EDD2922E929CF9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/misc/profiles/cur/0/com.lagradost.cloudstream3/primary.prof
- Size 15KB
- SHA256 43d96f70b2b05d718749719ec4816b586ec74abd09329647a3c243c0de770b06
- MD5 9e876c844d410b06986897c18064a984
- SHA1 ef63f18f0b673e210c76b7a2af87f7f023c9c5d4
- SHA512 382825f8ef473fe35e1814f87e3d3d73f17c8d2f7f1cbe94680192b08fba71bda227d21aeece8081bf4b59e61d703715cd0f253f212a26198fc3969ad152e35a
- SSDEEP 192:6ofPLI5d1KwoXP5++jIkSxb2TuUHW590ei2XRuHv1R8kI2azPfqVvAh1jf00/n4j:XrIrgBXP5+lbEd804XR+vBEz6klsGJnc
- TLSH T1EC62B0255D783E5EDFFC7F18A1F53BF562696E044378842E25814A05A7A10BE3BE3183
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/misc/profiles/cur/0/com.lagradost.cloudstream3/primary.prof
- Size 36KB
- SHA256 6a2791291462ef6f5ecbb13828fcea58e59a2a92119c6ed823eb3d5f699c4a70
- MD5 bd2ff104bb6adbf65780a85d64865182
- SHA1 89ac02db30bde2a1f39d259e12bb186265609875
- SHA512 8512605a64dc948a9126970148c80e14e720ed531c2aa43ad88e05f598616bda780d65618c35411e6932bb469ed80b3f9b3efbbeb963f0ad02e7d93377b593b9
- SSDEEP 768:EumRBUk95sJodwNQKjWTL3fuqKhEkkicUpNVbPtNfbBqL:EueXqeTLd9iHpNxPHE
- TLSH T1F2F2E13E02B403A13D6E4E53D6F53221A03871A5DFB7F3DA0B200C58F697C5A44F46A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /system_ext/framework/androidx.window.extensions.jar
- Size 123KB
- SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
- MD5 3056e1bdb7d4e19789d0319eff484bd0
- SHA1 6791ae47aa9466fe0bca27ad6643f846853bbee4
- SHA512 c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658
- SSDEEP 3072:8Pmsa8v0v8FYNMhpjLXZ/pziNQdysk4p26PQ:Qmsa8vXhRLXXOQGJ
- TLSH T19DC31951FA4159A1DEAE933B959B1301AB30A648AB2383137654D0BCFCD73C39F87AD4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /system_ext/framework/androidx.window.sidecar.jar
- Size 25KB
- SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
- MD5 29469324e59dfcc052f24b5af4e7b2c4
- SHA1 10c1e17ac6f598037bb51baa07945663645de4eb
- SHA512 5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2
- SSDEEP 768:bjydnTmp8WNAupUuvkg5NrtsESOMXIpc3dRwQA0:bjydCpF0uhtsxOQIqdSj0
- TLSH T1A5C2F716E7400C63E9FF9A3B6A5B13009F35E3A4AA43471B640585A4BDC63D3D9EE7C8
- MD5 SHA1 SHA512 SSDEEP TLSH