Overview

overview

8

Static

static

6

com.lodhi....ns.apk

android-10-x64

8

config.ar.jar

android-10-x64

config.de.jar

android-10-x64

config.en.jar

android-10-x64

config.es.jar

android-10-x64

config.fr.jar

android-10-x64

config.hi.jar

android-10-x64

config.in.jar

android-10-x64

config.it.jar

android-10-x64

config.ja.jar

android-10-x64

config.ko.jar

android-10-x64

config.my.jar

android-10-x64

config.pt.jar

android-10-x64

config.ru.jar

android-10-x64

config.th.jar

android-10-x64

config.tr.jar

android-10-x64

config.vi.jar

android-10-x64

config.xxhdpi.jar

android-10-x64

config.zh.jar

android-10-x64

Resubmissions

07/05/2026, 04:07

260507-ep3btsex6v

07/05/2026, 04:05

260507-envklaay5m8

Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    android-10_x64
  • resource
    android-x64-20260325-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
  • submitted
    07/05/2026, 04:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    com.lodhi.apps.savetheballoons.apk
  • Size 34.8MB
  • Sample260507-envklaay5m
  • SHA256 03dfac1610e8d0adc7260fd5c069e860ea3ce77b2d31464835191eadd304a2c7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
collectioncredential_accessdefense_evasiondiscoveryexecutionimpactpersistence

Malware Config

Signatures

Processes

  • com.lodhi.apps.savetheballoons
    1⤵
    • Checks if the Android device is rooted.
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5027

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events
        • Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 f6c054a20b9f46d3cd504b4b15f31f6c17705533fd72d9f88981308cb9aa69c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 65155d78b1902a5332455e03a97371b2db285c237f0ec2531c45417ff5eb3247
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 eafe6eadca54bd285fc7f521f4c73b7677b1571b3d0c10f74ccf0ef986e71dc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 60294c4d914d538ec50b8b2f9d6712980acab35d37bf7a89097f8154de8730e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events-journal
        • Size 20KB
        • SHA256 c82d1b5878045789c67e111bc0d1d12e463228f9dfab396e5e5cded202243a97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 28cebba6181329895362a795ca7b3d0e0ab835ac0b72c0fdd958d197a9227292
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 fb40ee792819a342cbaea4d8c0bc5d5d4966dcc9a1c49db58c4bd2ec3c686505
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.crashlytics.settings.json
        • Path /data/data/com.lodhi.apps.savetheballoons/files/.com.google.firebase.crashlytics.files.v2:com.lodhi.apps.savetheballoons/com.crashlytics.settings.json
        • Size 778B
        • SHA256 bb8b51b2c2e14ba278fd17b637a1ab87cb95ff9b6f8371463a426399f952c5c1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        report
        • Path /data/data/com.lodhi.apps.savetheballoons/files/.com.google.firebase.crashlytics.files.v2:com.lodhi.apps.savetheballoons/open-sessions/69FC0FC1008D000113A3F5CF40E55339/report
        • Size 796B
        • SHA256 6ba7a12ce97c204bfae0a3803e8dbff1fc3d66007810ce1c5fa0a2af903e306d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation861022993600112644tmp
        • Path /data/data/com.lodhi.apps.savetheballoons/files/PersistedInstallation861022993600112644tmp
        • Size 562B
        • SHA256 e1887c04ecf322f062d05919e4ae276f367df0859d76b77311870135a79db74f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation8870597641656557861tmp
        • Path /data/data/com.lodhi.apps.savetheballoons/files/PersistedInstallation8870597641656557861tmp
        • Size 90B
        • SHA256 2352509872b1bc8cae243ba86625106b93f5bfb3c502789aa9361e62646d3cf5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_settings.preferences_pb.tmp
        • Path /data/data/com.lodhi.apps.savetheballoons/files/datastore/firebase_session_settings.preferences_pb.tmp
        • Size 33B
        • SHA256 af5b3362ec35985974c6b73eeba53e5063861f2491252d61d8cd42168aa5ed6b
        • MD5 SHA1 SHA512
        Submit Download

        firebase_session_settings.preferences_pb.tmp
        • Path /data/data/com.lodhi.apps.savetheballoons/files/datastore/firebase_session_settings.preferences_pb.tmp
        • Size 75B
        • SHA256 ba8f4af0e35f93cc15649f4c51969f5279421fc12deeafaddec5e5c48aa58dab
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_settings.preferences_pb.tmp
        • Path /data/data/com.lodhi.apps.savetheballoons/files/datastore/firebase_session_settings.preferences_pb.tmp
        • Size 121B
        • SHA256 a21d3bf2cca0951e9e7b3fed43cafe9f89a4cf9d844c82279b260852d0ee473d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_settings.preferences_pb.tmp
        • Path /data/data/com.lodhi.apps.savetheballoons/files/datastore/firebase_session_settings.preferences_pb.tmp
        • Size 163B
        • SHA256 ba0830617929c78abca9391c2059f89c78049911f502ef5525d39341e4da2b91
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_settings.preferences_pb.tmp
        • Path /data/data/com.lodhi.apps.savetheballoons/files/datastore/firebase_session_settings.preferences_pb.tmp
        • Size 212B
        • SHA256 451e2fc5ede34553abccafd308e176f5f42138ef0e6e108f4e77f50bb71bbee3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        profileInstalled
        • Path /data/data/com.lodhi.apps.savetheballoons/files/profileInstalled
        • Size 24B
        • SHA256 277e41dc60dbaf96687423fc4569e797d242932715c16fab55bf79464153c72f
        • MD5 SHA1 SHA512
        Submit Download

        profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Path /data/data/com.lodhi.apps.savetheballoons/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 c9dfa4848b7b2a164518c39c7aaa821a8656d81dc0cb990f9b11b2b1ee295609
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb
        • Path /data/data/com.lodhi.apps.savetheballoons/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/com.lodhi.apps.savetheballoons/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 bdf6d15ce5fd10b2946b8125eb2bb0f053be1a80041382b1780542769037d482
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/com.lodhi.apps.savetheballoons/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.lodhi.apps.savetheballoons/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 d01fc7bba007fe4bb7c7f80340a58784c28ac8645b4187feaa98ca337bad9ee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.lodhi.apps.savetheballoons/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 661276cd0edc68c84b65e5275c8a96969c974668f4a50d2bb647f00e0f69f112
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        primary.prof
        • Path /data/misc/profiles/cur/0/com.lodhi.apps.savetheballoons/primary.prof
        • Size 1KB
        • SHA256 41c18e79822d0fb997dfe18269efcd87f4a59e0a813815895f3a93d06d08e2ce
        • MD5 SHA1 SHA512 TLSH
        Submit Download