Analysis
- max time kernel
15s - max time network
153s - platform
android-13_x64 - resource
android-33-x64-arm64-20260325-en - resource tags
arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system - submitted
04/05/2026, 18:29
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
sagawa.apk
Resource
android-33-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target sagawa.apk
- Size 3.1MB
- Sample260504-w448eaav6x
- SHA256 c2f48ade958e99d173867a0236d6c9f7eabef64235a3e422b89cb7c43ecda1e4
- MD5 c5341bf17a83b7c45340f263fe05a2bf
- SHA1 183acf140debb77c4f7750f561689a3cd1e269bd
- SHA512 66182d67addf6ef1b8993d39a05c19dd6fc9ed798112bb4604fcdf7256ddd36e7ee007d1feedd51b92d4b793dc73f0559d3e95cedd60b68f912a4aac0c49af74
- SSDEEP 98304:knF0hTQKbz55/qaydtSLVyzy8IRNX0Tj6:WFuTQKbzv8G+j6
- TLSH T1D4E5BE82EF95DE5AC8F74333093B963655194C2D874392839ACCB77828B76F00EC66D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 3 IoCs
ioc Process /system/bin/su zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn /system/xbin/su zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn /sbin/su zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn - Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/app_picture/1.jpg 4426 zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn /data/user/0/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/files/b 4426 zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn - Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/app_picture/1.jpg
- Size 3.0MB
- SHA256 d3bb5247e7030f6dad98a271eb87a8bc6cc2425f5870fafc8acaaf60b6ef0ca0
- MD5 71432a83827312aa1ba51e705d9eda7b
- SHA1 b02920069d48c8307e144dac368c3b9f82adb626
- SHA512 c44787800be422634fc0daafb61f9ca87a9c4768694473751c4c44c75cb3ad439b56328aeba172000a0a7cf77cb427070efedf0b6997698428394d6188b70c68
- SSDEEP 24576:OreuYB80b8pTsa5nqrGK0mqEFBVh3uDT/l:nZb8pTsa5nedZu9
- TLSH T1D1E57D11BE025A25CD8E533E64AE27503F3AAEC5ED8787023405B77B6F462D9979338C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db
- Size 284KB
- SHA256 665ebf7e2131ac5a3f009148ed97d7437c8d369fc6caffca4fc8912bac0bacff
- MD5 84bbc6df53f1240c34c7d705116efdcc
- SHA1 166073ebbda6751475e1296272da361030a0513e
- SHA512 16dc7095c5f9a0e5474e334c4e950882a34625b03f04ad1ca011a6e52a1abeb308404850e492aa9edeb2a53582e0e7be52fb903243f84488961eff3d3ca78795
- SSDEEP 6144:hqp63dJEGbfG7dL2PNdqRy8SX46OwY/+l:hqgNaW2LC/qAz8+
- TLSH T15D5402C3AB715C76D6FCAC75503E1564BC3C758C1708E6A84B0EF4636E0EA04A59ABCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db-journal
- Size 512B
- SHA256 3eed207fa77ae51538b4df31355eb4f40acbaa04d21e0da2047b8067ba446c4a
- MD5 fc3250c694197e8913231b59e184d7e9
- SHA1 a32ba46222b0cc0f094bd33953037ea6067903d4
- SHA512 c139b43be720d959ae703510265095bccf347f76bc4a0616ad4f2c0e11407f68294cd98fd760896d0b8cd093d2134152c2164807ab322fc01280389f84e66488
- MD5 SHA1 SHA512
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db-journal
- Size 8KB
- SHA256 0f61f4361acab0577e1c54dc008fb49908d5e0e3e8582cff23a6f2febe0adc5f
- MD5 d1717f3ffb9fd488b0e4796b6d06a5ec
- SHA1 8fd620d02ff8432e38a944102de001c2b166ee91
- SHA512 156568793ad2322dea96881e51a06fc7a6b0c637d65f06d522471a86ca872443639cc42c8e886260e1218c12331d8d286f3ff312c2880e203f11d2682230390f
- SSDEEP 6:7+/l9thn1oxvg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKF:7+tHwRqLiuWd7RmBEyPb6
- TLSH T18E02229C63810813D81A56B7A8E483424D00E7698262CB072E600894AD435CCE4A0E88
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db-journal
- Size 8KB
- SHA256 5ddcbec6bdce46e9a578b622bfb332993ffb878cc944a4b166272dbcb1ada577
- MD5 e649efc5a269b7e0e4d26ccd5d6731ff
- SHA1 422a9d7c190f5b56c917d2d7944a853caf4ac96e
- SHA512 db3dd82fe2d3a833259208bcd4449faaf82ae33f92811179c374bd5b26f164af62b623042fa4bfe64a2cbff20983257f34a2c061413d3382e5ad915101798dcc
- SSDEEP 6:7+/l9wAPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKS/O:7+trqLJdKBRmBEyPblO
- TLSH T1090222C863830803C33DA7779CD883401E10A71483B3CB1705740C5C3C476CCA890E00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db-journal
- Size 16KB
- SHA256 1420d0ce2b007be6ede017ad58144986c6f04279d068bf6062dd1abbc493227a
- MD5 84626694968b2cc5f75fcb24e7ac622f
- SHA1 95f5c8756cdabb94c2c9e00d239e35ad25c2dde6
- SHA512 227f300986ac32cde7c90c18cc429c5bd8085d32ea40cedfd9869689c47592bb629e3ab9efc45cc0de8ba049115b15282a15a3d2d67cac9d0ca12b92e2b8f730
- SSDEEP 12:7+t7dI8tqLFrU5ZN2gtFO+4gE8YXOgyUQmofBxDiRmBEyPb4E:7+tZLqLFgxtF74B8Y+gmDpx9GSr
- TLSH T10872EB8D8B005303C1A4A2F5EDB602AB3D7C631D8F52C752359804A0CC73A95A1B9E9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db-journal
- Size 16KB
- SHA256 e99aa8e1ee02a8876107718a7c1a2a42d6fbc65ae9a963b072b31cc51dbcde25
- MD5 46029c16d87b6337498ace7646a2ad3e
- SHA1 7eb6997157294c8d68d7210dc894e585939effc0
- SHA512 0b7cfd0795bc30e1ac0ff7b5c47f75811a06938d4f13967408ef32b9a4f41d7abf8547f57c2420b0997b74e7621b745c258c2795c641a7aa59ec1108f3e56bea
- SSDEEP 96:7qWJXR7X3iX13Jy8xBXFnUPt+8Sn1w6RNgdy6ia:7qWzWhJJ7Rc+8W+SiUc
- TLSH T1DC723C4F87988356C1FC4CF9469377172C3C114B4214B2E3234A5552EF73C659AA2B9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/app_icons.db-journal
- Size 16KB
- SHA256 20c5852ef821346564f7ae79c37a2b4a71bddae6251d2b1c5bbb348c44b88b27
- MD5 cef4435e5969ba5a08559014c22f2fea
- SHA1 8befc5b4713c1037123d240be66821ca64a94ce8
- SHA512 48fe5c7f15fb03b1234576134b92b99f5b4e68e51d2f7333bdadd28bc4bfd754b5703c6f3c02c6eb25cd69a3dc28a8459149634c64c2164228b8a2cf66c1f447
- SSDEEP 96:7R7tfyn3y4KIigyGxBe5xwEGe2GbJXR7pWfVhp7Nv1tyzYt2KF8OwTOnPhzFw:7Jn8GbzJOte
- TLSH T1017206D7EF74D727E03C8974B93D29822C309AC61239A6E36B4A54EE7C6780505E0DE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db
- Size 20KB
- SHA256 4903623a209b7e1be8a72531d357ac73ce7ff87440db45aa575ead856fadca7f
- MD5 aa0332eaaf346fb5f85412665ff7296a
- SHA1 f73ca71af8f6fb8d6689ced1df7d137bb5bf675c
- SHA512 83f6b4ed3afc182353d49b227c9682d8c424e015cb0a70ce93f4b158b2e071b31fc1c8c22e711542eabb4a7e8003988b08fd7c247b921bbb17dbce9d45c62822
- SSDEEP 48:TQq0ek5t9JhROkLXUGS5l367HliodlliHLklia0lioVQlid6:V29hfir6IodCVM2Fd6
- TLSH T1F392505E37781106D32C95367D6974983F3436BC86F338C2284558EC5EE3E8810A2FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db-journal
- Size 8KB
- SHA256 6157cb3b85e3a0be580857dce44a88260de354f1c5a9791646b6ce51d41ec049
- MD5 ab5ba05b0c1e1def2f9be6777229b335
- SHA1 97de17330f5ac25c71bb7590161d7747582d65a8
- SHA512 81d460614f375fa8d8accfe9ab9d7ca269b648f2045637345d0115dd87fcfb572253ba188235139051ae62f9ce2113cae1e0646d8eca234a0ab655bb242f790b
- SSDEEP 24:7+tXx+WqLyhmAX60cjk7vi+QzumeJhROkLKCUnGSo:7Mh+Wqetq0ek5t9JhROkLXUGSo
- TLSH T142028C9E4F212210C23275B3BE7281562C3CA56F8BB770A12D5444B64CB3D57E622AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db-journal
- Size 8KB
- SHA256 a24bd17a920003da9e02f2ac330046e57ceb184e0fd06ab40b2a08acbba2fdc1
- MD5 d31e60cfb5724da335c07be15c55b470
- SHA1 5460132d92d860614660aeae2b01a2477462159b
- SHA512 3b1af2a8367e9b71c103bd218615b205855e43a684d9ff7ffd1bb48c79c684d302c33e94ad3ef004704d59fd2f137f4769b49d26d90d766a52c02da7bc4bea30
- SSDEEP 24:7+tkBfqLUCHAX60cjk7vi+QzumeJhROkLKCUnGSw:7Mk9qHgq0ek5t9JhROkLXUGSw
- TLSH T1EF028CAE4F212210C63235B3BE7181552D3CA96F87B770A12D6400B64CB3C57E622AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db-journal
- Size 512B
- SHA256 3946a0e885b93ff16d735cf5f6260e094c88225c8724503fcc9617d9b2ff5274
- MD5 95c785826b8b8f7e6b967b36ca3f6e1e
- SHA1 5ab3f80cc1183e09a4b0ce5d68e1651cb5084211
- SHA512 3152f20da208bf016e0a8083ecd16b405461fbe043cc64cf41370195d79e9d0fbdd8d75f88616f1d8d21d27de7d5d73f886bf35d06ef9a8043cc8e18e55adde9
- MD5 SHA1 SHA512
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db-journal
- Size 8KB
- SHA256 2ebbe0d7c8b1dbc0069f6994bad8f351ba287beee7b80b22d3d7e23460384fb8
- MD5 be25e3f46ececeee0e21884e496188da
- SHA1 023c9d569888be322cdd6a225b8ab4ba29edf19f
- SHA512 4d0ee6f3e2ed3b4e22a095ba8d4821911587c8458de2bb1fffbfa6b3a0b123636ced49676e0277caa668791961b1392f4d876e4dfbe0360db95badd5da935c94
- SSDEEP 6:7+/l9/Hn1V2vg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKV:7+tV2vqLiuWd7RmBEyPbi
- TLSH T1E602C0AC73800A13CC1E5A7790E4C3400D20E718A27ECB2705500CB83C038CCF4A4D08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db-journal
- Size 8KB
- SHA256 712e713f587bb828bfcaef5fa1df2e4146a1e4d00b7fa09f953ec403dec17c85
- MD5 889f3e24c538144cbb99a2c25eed9ddc
- SHA1 ed2f81fa60f738b49d690adb3e48ee39ee044636
- SHA512 ca027e6af7b40a8e4c9ec96731db286dafa074113bc651e42e2ee73fe6da085b8d6671be095eafa139a0fb8a4d8782bd3140d82e483b80b465a4e9f3a8389f89
- SSDEEP 6:7+/l9POPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKf//H:7+tIqLJdKBRmBEyPbUH
- TLSH T1A402C0CD63410A03C21D97BFA0DC83481E10EB14C333CB0706500854BC436CCE890D08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/launcher.db-journal
- Size 16KB
- SHA256 d9691096103cca53a6580d0c89053cfdb5890194e03c61b052ab56c0da1bb663
- MD5 5e5e664194f738b9822001d7f13e5453
- SHA1 e7267a22d0ffefcc6bb6d069ee451ed6cc1ad85b
- SHA512 3cd84ed01afaab7c95336223339271573a4e78df153696836e9b539d9948a60d8ceae0afa6f224304d385aa973b9da2eb53ddbb98c9e2bc79b849147ed910ec7
- SSDEEP 24:7+tPqLpRAX60cjk7vi+QzumeJhROkLKCUnGShcvSj:7MPqEq0ek5t9JhROkLXUGSoA
- TLSH T18F729C9E5F612210C2253577BE7281552D7CA56F87B771A22CA400B68CB3C43EA22EFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/widgetpreviews.db
- Size 20KB
- SHA256 75bf43f77c9f262378dbf19f64f16b844ba47d692114e653eb4873a9f6e2a3b5
- MD5 5fc7d5ee9100abb05cebeb0493a34ba2
- SHA1 371e6a7a8fce09c72c923de6aa6e0b3ba36891c6
- SHA512 9b18e9fa25f429f900ca786bf9ba521b92562e1ddbc10ba86008e657813e1fb13ab23fb747dd190e4e4763d58ea63ac35ece6d511030ed761d1dcd3d3f39b59e
- SSDEEP 24:TL/2UtUCcvtF74kD7YqFE8YgDbgPHGSE:TvCCc/7F7BrYegPmS
- TLSH T14C924EAEDB006302C05E4239ECE0A3C26DBE365D83638F42DD9028A86D238865526A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/widgetpreviews.db-journal
- Size 512B
- SHA256 7064fe81dad533523c97a98e9e1f1efc4d4c13f28561222a8bc9dddf25406668
- MD5 7256f88fbbb0fba3b6034cddd2f3ef88
- SHA1 c32b54faf7c09e9a562de107f09c6368fed8fc38
- SHA512 91615dacb78d777350d9789b60d90f09fe2590b97430a2bba73551a4c7ef57d95326ca237a8afcbff30a2ceabf7767ef18b6639e8d1b701ac5db6e5c91ac23c5
- MD5 SHA1 SHA512
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/widgetpreviews.db-journal
- Size 8KB
- SHA256 4564c1ab3a9f64c295d7fec23e83e14112bd5c63fb79361b488c6ffbe12034e3
- MD5 13fcfcdffcb9a490b8eae882bb00ce6f
- SHA1 537ac3b58e5383afe0df343c7ce311de48ab1fa2
- SHA512 075ff560c76df095cfa6cbbd61dc97adc68af3749cac2656332367b1293d391861f20da302ff2f4175eed93ea13e8a40b1fdee91bdbbee385b7b54a614a2d3ef
- SSDEEP 6:7+/l9+n1fxvg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKTG:7+t0qLiuWd7RmBEyPbN
- TLSH T1F802C0DE63800C33C81D56B790E483C00D10E7188372FB27077008943C474CCE4A1D08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/databases/widgetpreviews.db-journal
- Size 8KB
- SHA256 b9c39d1c2d4e2e47c99fc8889b87c603ef861793f7a666b56ea4db6d331a4621
- MD5 fcd1ace3298846863ae628cf5598e18f
- SHA1 0f907b9dbd7e700704cb89f51410ade16b92f04e
- SHA512 000e9f2a0d2106be9686d0bf2db91cd995f55f8c7e6fd6b91d7c4393f4fbd5c5fcfca6c094468310fab3ddfced0b0d529eb27b1d1d32fe222f01bd9e7906a308
- SSDEEP 6:7+/l9N/gPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKQvM/SI:7+t34qLJdKBRmBEyPbXvsSI
- TLSH T18602228863400823C019577790DA83801E10A714B363CB4B95600C542C036CCA890D80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/files/downgrade_schema.json
- Size 1KB
- SHA256 73353cdbb7fbf2ee224948f35a950ad7bbaad5269b59471e690b34988ecc19e2
- MD5 70435833064f71228d8d001901b56873
- SHA1 2d68b64360bb323366fadab675f387c74b42a23a
- SHA512 fb7642c1c01aeacc3d5748b8be977ef272e7e9325cfd9e64b8638d4be84ff030cab8483a92ea677ffc246223df81e4b2c544e121943ac9acc8e79b6255b5b55a
- TLSH T16221CD9A562012304B617652BE50D1008E3C8A3F8D73A5106C1A40EE69F7C1ED26A7FF
- MD5 SHA1 SHA512 TLSH
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/files/profileInstalled
- Size 24B
- SHA256 176fc493a2ea112ec7f0eadadacea9cecec290e0f9ac5a3149138b07621a0cd9
- MD5 c3fc424b1c54ab630eedefed73873c12
- SHA1 2c6742c58f0630af3c1bcb63bf48a4671faf7b9c
- SHA512 9e78b7b3b53ea99ff110564cee20db1b231116b5a66062051c824c7356a73def5a89adb806a198a99723062a6b9f349fdfbbf54c533bcaf03ce48925976d8095
- MD5 SHA1 SHA512
- Path /data/data/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 f86a0ebeb2461f9057cd52479455fb58804dac3c3784314cdd23d546b33b0129
- MD5 901d188718a2b09df1c8849cd5675c10
- SHA1 54771f3582877e23a74f0d9779d31d0c6e3a5bca
- SHA512 8a51fd5f150d06023fc5a41cee8cfe7d97b8e8947a27de5ac8fc7dea873ee893ca5d98ea789796a1c5b2de21b8b41f361af244860d5e099e0c2725053c402da7
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/primary.prof
- Size 1KB
- SHA256 358e30b1ed8477152ca8bb1a41f9de1f3154497ccdadc26d4bf1fda52efcfb38
- MD5 859f630e0f9c611d5162783f3726174a
- SHA1 198ef7bba36e3c285b8b6f9cdbfe4bf2e7ca188a
- SHA512 35a998a92829c5e3eafab0e73df21f8865f0812854aabc2316c989fa3c1d9c813e10972989b95a7d217a13a08c95a0afb8df635de1c7a53c4bac3f6d32b34a4b
- TLSH T16C312CBAE4F87CA4C0CDDE7E707D5062036417A8026D4F1A3DF0F0F00502E24B5A098B
- MD5 SHA1 SHA512 TLSH
- Path /data/user/0/zwlkddxvhr.a45maj1f_t.pkkop1b9fcxn/files/b
- Size 246KB
- SHA256 8e5fc64f5d05182c5e736bd07e03889b35c5a7c0f6bf6b661fcb4a701ca5f0bc
- MD5 bc6efdad930709ecd2909ee16e55d712
- SHA1 6136d48a98458fc4304a0ac914bb37bc44e25239
- SHA512 b0fb6e1f9fa8cfdfd048d8a187fbe65c8dc5fa07e74e5d53c90548d51d08f1fcb55142cd20fad97fff1802756de7a79f42be38872b501173d6f6c783bed66cbe
- SSDEEP 6144:UMMZATFSLi9sXIJsK1tSNAPSRJlW3rQRhVF6WtPL:Vd9sCLWP3VF5z
- TLSH T1D0344903EF955E27C8BB463999A31312F331E8297713D3574648D8B97C8B3A91ED6AC0
- MD5 SHA1 SHA512 SSDEEP TLSH