Analysis

  • max time kernel
    21s
  • max time network
    152s
  • platform
    android-10_x64
  • resource
    android-x64-20260325-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
  • submitted
    04/05/2026, 00:12

General

  • Target
    chalmerslunch-1.0.2.apk
  • Size 7.7MB
  • Sample260504-ag75wsav2w
  • SHA256 748badb3a99531e6f70e899ee656274ba9cf70e0d97cd268b6ca8f5c8eec9dd0
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • se.gorymoon.chalmerslunch
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks memory information
    PID:5082

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        google_app_measurement_local.db

        • Path /data/data/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 a0f4c1240c2ecbdc78a86f055a9217fa4b3a086dc9fea73289ec1525855608c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 e96482c86cad0314f9bf8234a86be5a659c1ce0150534f416e221c24783f84dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 81e0298dfdeb18c615fd22ad4bb9ed6af686e9927656257660b1a6dcdfc399b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 4eacc482dbdb487cd135719b7937848e6384bb9fb9669c8e06be37401a1dbfc8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 03dfc7f092325998ed0de7e06a67c184b0040fe1c13023b446912d206602af27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2d32fe86a5af6cafd815f2566a68709f8133564d8f8adaa8ea4266264e0906eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 c6887d1c37a8aee9703e268d301b2311221149f908f2d4d5fc3fde9fc29674ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 4d40d741363b8845dcd79263a5b4b29d688da18ed098fff1c339324bf7c76c21
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 57d25c42efe5afa832e4e9acbaf91600389d34b014b0b8b8113df4f342e8664c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 cd5372698de2cc600d0d083b3e86c5fc8070004243bd86e357a6bc9b28f3979f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 721e3bf6acc00b3715960b36c5d5a1da7d71c5153c241cf943ea6740374e9fde
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 fa65aeaeffa97147bd13a7933407cfe6412f0784874beb3db3b4eb33ab00c662
        • MD5 SHA1 SHA512 SSDEEP TLSH

        69F7E45E007B-0001-13DA-B37E9467F848BeginSession.cls_temp

        • Path /data/data/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45E007B-0001-13DA-B37E9467F848BeginSession.cls_temp
        • Size 77B
        • SHA256 762581b50cc97de9e6278c17298e25bb8a3a09b4a4c7d853d334878d1ebe0256
        • MD5 SHA1 SHA512 TLSH

        69F7E45E007B-0001-13DA-B37E9467F848BeginSession.json

        • Path /data/data/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45E007B-0001-13DA-B37E9467F848BeginSession.json
        • Size 132B
        • SHA256 8ecfb84b343078a84ebb6c9027494c7b9e8355e396bb2d350c48370aabc978d3
        • MD5 SHA1 SHA512 TLSH

        69F7E45E007B-0001-13DA-B37E9467F848SessionApp.cls_temp

        • Path /data/data/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45E007B-0001-13DA-B37E9467F848SessionApp.cls_temp
        • Size 119B
        • SHA256 01681fb96aaa9e9b99752d00137c7a80fd465d811b2dd9e6915b3bab47c7ac6c
        • MD5 SHA1 SHA512 TLSH

        69F7E45E007B-0001-13DA-B37E9467F848SessionApp.json

        • Path /data/data/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45E007B-0001-13DA-B37E9467F848SessionApp.json
        • Size 233B
        • SHA256 2f865c6d40d125856d8ab7373c84375281fcc603264be37924f4fa9dd08a396d
        • MD5 SHA1 SHA512 TLSH

        69F7E45E007B-0001-13DA-B37E9467F848SessionDevice.cls_temp

        • Path /data/data/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45E007B-0001-13DA-B37E9467F848SessionDevice.cls_temp
        • Size 49B
        • SHA256 8103c28e4cddc0f3581e6189c4fc01bdce57c4c4ed292222989d5d1f765fb20b
        • MD5 SHA1 SHA512

        69F7E45E007B-0001-13DA-B37E9467F848SessionDevice.json

        • Path /data/data/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45E007B-0001-13DA-B37E9467F848SessionDevice.json
        • Size 203B
        • SHA256 ad84853a5603914d57ca3bcd4979a64c35a750e0be0b504f10dc92dc17ec388b
        • MD5 SHA1 SHA512 TLSH

        69F7E45E007B-0001-13DA-B37E9467F848SessionOS.cls_temp

        • Path /data/data/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45E007B-0001-13DA-B37E9467F848SessionOS.cls_temp
        • Size 15B
        • SHA256 e78068dac7c1adce8676a309d60abb8be4d31ab3dd5c6bdce85284b7ca8e8761
        • MD5 SHA1 SHA512

        69F7E45E007B-0001-13DA-B37E9467F848SessionOS.json

        • Path /data/data/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45E007B-0001-13DA-B37E9467F848SessionOS.json
        • Size 56B
        • SHA256 64d3a7187919847c88d444cc98ef3c113a63e8d7ca641fb259f4e9d3548327b4
        • MD5 SHA1 SHA512 TLSH

        session_analytics.tap

        • Path /data/data/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
        • Size 406B
        • SHA256 e8b14b6902f3805992c3685fb901891fb4a70a246aaf52dcb412ca792e74b009
        • MD5 SHA1 SHA512 TLSH

        session_analytics.tap

        • Path /data/data/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
        • Size 2KB
        • SHA256 335e5b528dd806cc099e844c3c6b73a52057340b2792389ea209f5311cc2afed
        • MD5 SHA1 SHA512 TLSH

        session_analytics.tap.tmp

        • Path /data/data/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        sa_8c862739-ea41-434d-b993-799ec2574560_1777853534665.tap

        • Path /data/data/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_8c862739-ea41-434d-b993-799ec2574560_1777853534665.tap
        • Size 330B
        • SHA256 eda28e59587a3d9285a28332c4607bc69c9424d630f85e102ebcf17c408e26e4
        • MD5 SHA1 SHA512 TLSH

        com.google.InstanceId.properties

        • Path /data/data/se.gorymoon.chalmerslunch/no_backup/com.google.InstanceId.properties
        • Size 2KB
        • SHA256 cbdd80ff8b7abc6620c9476617d4156210c29834be5b1749fd9060b3a1f56ede
        • MD5 SHA1 SHA512 TLSH