Analysis

  • max time kernel
    15s
  • max time network
    153s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
  • submitted
    04/05/2026, 18:29

General

  • Target
    sagawa.apk
  • Size 3.1MB
  • Sample260504-w448eaav6x
  • SHA256 c2f48ade958e99d173867a0236d6c9f7eabef64235a3e422b89cb7c43ecda1e4
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Checks CPU information
    PID:4426

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1.jpg

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/app_picture/1.jpg
        • Size 3.0MB
        • SHA256 d3bb5247e7030f6dad98a271eb87a8bc6cc2425f5870fafc8acaaf60b6ef0ca0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db
        • Size 284KB
        • SHA256 665ebf7e2131ac5a3f009148ed97d7437c8d369fc6caffca4fc8912bac0bacff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db-journal
        • Size 512B
        • SHA256 3eed207fa77ae51538b4df31355eb4f40acbaa04d21e0da2047b8067ba446c4a
        • MD5 SHA1 SHA512

        app_icons.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db-journal
        • Size 8KB
        • SHA256 0f61f4361acab0577e1c54dc008fb49908d5e0e3e8582cff23a6f2febe0adc5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db-journal
        • Size 8KB
        • SHA256 5ddcbec6bdce46e9a578b622bfb332993ffb878cc944a4b166272dbcb1ada577
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db-journal
        • Size 16KB
        • SHA256 1420d0ce2b007be6ede017ad58144986c6f04279d068bf6062dd1abbc493227a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db-journal
        • Size 16KB
        • SHA256 e99aa8e1ee02a8876107718a7c1a2a42d6fbc65ae9a963b072b31cc51dbcde25
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db-journal
        • Size 16KB
        • SHA256 20c5852ef821346564f7ae79c37a2b4a71bddae6251d2b1c5bbb348c44b88b27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db
        • Size 20KB
        • SHA256 4903623a209b7e1be8a72531d357ac73ce7ff87440db45aa575ead856fadca7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db-journal
        • Size 8KB
        • SHA256 6157cb3b85e3a0be580857dce44a88260de354f1c5a9791646b6ce51d41ec049
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db-journal
        • Size 8KB
        • SHA256 a24bd17a920003da9e02f2ac330046e57ceb184e0fd06ab40b2a08acbba2fdc1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db-journal
        • Size 512B
        • SHA256 3946a0e885b93ff16d735cf5f6260e094c88225c8724503fcc9617d9b2ff5274
        • MD5 SHA1 SHA512

        launcher.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db-journal
        • Size 8KB
        • SHA256 2ebbe0d7c8b1dbc0069f6994bad8f351ba287beee7b80b22d3d7e23460384fb8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db-journal
        • Size 8KB
        • SHA256 712e713f587bb828bfcaef5fa1df2e4146a1e4d00b7fa09f953ec403dec17c85
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db-journal
        • Size 16KB
        • SHA256 d9691096103cca53a6580d0c89053cfdb5890194e03c61b052ab56c0da1bb663
        • MD5 SHA1 SHA512 SSDEEP TLSH

        widgetpreviews.db

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/widgetpreviews.db
        • Size 20KB
        • SHA256 75bf43f77c9f262378dbf19f64f16b844ba47d692114e653eb4873a9f6e2a3b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        widgetpreviews.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/widgetpreviews.db-journal
        • Size 512B
        • SHA256 7064fe81dad533523c97a98e9e1f1efc4d4c13f28561222a8bc9dddf25406668
        • MD5 SHA1 SHA512

        widgetpreviews.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/widgetpreviews.db-journal
        • Size 8KB
        • SHA256 4564c1ab3a9f64c295d7fec23e83e14112bd5c63fb79361b488c6ffbe12034e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        widgetpreviews.db-journal

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/widgetpreviews.db-journal
        • Size 8KB
        • SHA256 b9c39d1c2d4e2e47c99fc8889b87c603ef861793f7a666b56ea4db6d331a4621
        • MD5 SHA1 SHA512 SSDEEP TLSH

        downgrade_schema.json

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/files/downgrade_schema.json
        • Size 1KB
        • SHA256 73353cdbb7fbf2ee224948f35a950ad7bbaad5269b59471e690b34988ecc19e2
        • MD5 SHA1 SHA512 TLSH

        profileInstalled

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/files/profileInstalled
        • Size 24B
        • SHA256 176fc493a2ea112ec7f0eadadacea9cecec290e0f9ac5a3149138b07621a0cd9
        • MD5 SHA1 SHA512

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 f86a0ebeb2461f9057cd52479455fb58804dac3c3784314cdd23d546b33b0129
        • MD5 SHA1 SHA512

        primary.prof

        • Path /data/misc/profiles/cur/0/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/primary.prof
        • Size 1KB
        • SHA256 358e30b1ed8477152ca8bb1a41f9de1f3154497ccdadc26d4bf1fda52efcfb38
        • MD5 SHA1 SHA512 TLSH

        b

        • Path /data/user/0/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/files/b
        • Size 246KB
        • SHA256 8e5fc64f5d05182c5e736bd07e03889b35c5a7c0f6bf6b661fcb4a701ca5f0bc
        • MD5 SHA1 SHA512 SSDEEP TLSH