Analysis

  • max time kernel
    22s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    04/05/2026, 00:12

General

  • Target
    chalmerslunch-1.0.2.apk
  • Size 7.7MB
  • Sample260504-ag75wsav2w
  • SHA256 748badb3a99531e6f70e899ee656274ba9cf70e0d97cd268b6ca8f5c8eec9dd0
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • se.gorymoon.chalmerslunch
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Checks memory information
    PID:4745

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        google_app_measurement_local.db

        • Path /data/user/0/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 dae219c352efd307f05808419ebd0752bb5e9a65d2cb00caf964e086efb16d4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/user/0/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 246dc742ba2986997a8f688d4b05e813d902b1d921841c3a047337e5bbb3b3dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/user/0/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 97e81a0f149358f0eafb73ed423492676a474b4bd98564744d36ecd758addedd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/user/0/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 5573b9a975ac0dd118577bd862b71b02be6d109318453131bcfa9f46f12ac618
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/user/0/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 f3a1a35758eb38dfd3256882054ff172bc29133c6bc26e15c78fed8b67e68da2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/user/0/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 49f63ace06996c90373b0a838b275d6cba84f8a5a311516834f30cf4e6f64c50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/user/0/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 2b54c9222556943822ae092e4a3b4042201dd344c7389db7f43b0cb0522337b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/user/0/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 2b9a6ccd00147ceefc4e265de3ad6243c2bc5550751a791cb915a63184629121
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/user/0/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 8bcd5001c64f9ce148451f4d14dc27cee2f55e17a6f3a3bfe4e70882fcf09632
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/user/0/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 9aab54f863b22f9b342bda74afe966e6c94abc32755892af17cfaecb853bf960
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/user/0/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 3a0d18f5e2611403d321d4ac365fbea3a0b7b97b9f070c8377378b25b98dbb91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/user/0/se.gorymoon.chalmerslunch/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 2cbc3ca20af1e7d0446e5ad04e58fe284b4f52e4d5dd8b9760bf47a1a4d086fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        69F7E45F0119-0001-1289-6B1A15A3A50EBeginSession.cls_temp

        • Path /data/user/0/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45F0119-0001-1289-6B1A15A3A50EBeginSession.cls_temp
        • Size 77B
        • SHA256 698eafd7d429b4f27db5176321ef68355fcc8be03f4b17dea2e20ba605c75fff
        • MD5 SHA1 SHA512 TLSH

        69F7E45F0119-0001-1289-6B1A15A3A50EBeginSession.json

        • Path /data/user/0/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45F0119-0001-1289-6B1A15A3A50EBeginSession.json
        • Size 132B
        • SHA256 d273077ab8fa871119e7053d235155e74e9a158a3424ab205cb001b19b2c7f48
        • MD5 SHA1 SHA512 TLSH

        69F7E45F0119-0001-1289-6B1A15A3A50ESessionApp.cls_temp

        • Path /data/user/0/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45F0119-0001-1289-6B1A15A3A50ESessionApp.cls_temp
        • Size 119B
        • SHA256 8835b4eb1d17b7baf486a80a3593b30b2356a2265c7b02ecfe983713b70c8271
        • MD5 SHA1 SHA512 TLSH

        69F7E45F0119-0001-1289-6B1A15A3A50ESessionApp.json

        • Path /data/user/0/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45F0119-0001-1289-6B1A15A3A50ESessionApp.json
        • Size 233B
        • SHA256 9645c904d4341a3d5565caf42b27cec7e66e13ee4aa5bbc79c34bd700c201e73
        • MD5 SHA1 SHA512 TLSH

        69F7E45F0119-0001-1289-6B1A15A3A50ESessionDevice.cls_temp

        • Path /data/user/0/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45F0119-0001-1289-6B1A15A3A50ESessionDevice.cls_temp
        • Size 49B
        • SHA256 ec664092a3596d487e39269cc43b1c24502473f0c666e4f91b808394a974a60f
        • MD5 SHA1 SHA512

        69F7E45F0119-0001-1289-6B1A15A3A50ESessionDevice.json

        • Path /data/user/0/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45F0119-0001-1289-6B1A15A3A50ESessionDevice.json
        • Size 203B
        • SHA256 17cfcb8518203529de6e288ea03820ab37b30b226e335de7ff507a0c4a945a23
        • MD5 SHA1 SHA512 TLSH

        69F7E45F0119-0001-1289-6B1A15A3A50ESessionOS.cls_temp

        • Path /data/user/0/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45F0119-0001-1289-6B1A15A3A50ESessionOS.cls_temp
        • Size 15B
        • SHA256 94db7df32f7024d43abbedd5433d0a39a8dfe652621d40e7647af527fb5a2150
        • MD5 SHA1 SHA512

        69F7E45F0119-0001-1289-6B1A15A3A50ESessionOS.json

        • Path /data/user/0/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/69F7E45F0119-0001-1289-6B1A15A3A50ESessionOS.json
        • Size 56B
        • SHA256 3a5df913db77290768c5dfbdfd65b218dfa34b7999441f5cc87797e4b65e445c
        • MD5 SHA1 SHA512 TLSH

        session_analytics.tap

        • Path /data/user/0/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
        • Size 406B
        • SHA256 c3a365cf7b4f67a21a1ca6c989764c6f855ad5dff1eee9f7efce40c1c847a387
        • MD5 SHA1 SHA512 TLSH

        session_analytics.tap

        • Path /data/user/0/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
        • Size 2KB
        • SHA256 1ff0d253d4dbcff51b89ff94e5699d4518104a98b5001e43a6a7c888ee46ca77
        • MD5 SHA1 SHA512 TLSH

        session_analytics.tap.tmp

        • Path /data/user/0/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        sa_82900a98-ddb4-41ea-93f7-64dea4d3926b_1777853535839.tap

        • Path /data/user/0/se.gorymoon.chalmerslunch/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_82900a98-ddb4-41ea-93f7-64dea4d3926b_1777853535839.tap
        • Size 330B
        • SHA256 ee9d5546c618d77b26473a37da22f9c4683db45a34cae557918de27adc8eee6f
        • MD5 SHA1 SHA512 TLSH

        com.google.InstanceId.properties

        • Path /data/user/0/se.gorymoon.chalmerslunch/no_backup/com.google.InstanceId.properties
        • Size 2KB
        • SHA256 b89f669e987c4cfd8a3cad3f6b81e5375626274ab6906e66e22c847d101ae133
        • MD5 SHA1 SHA512 TLSH