03dfac1610e8d0adc7260fd5c069e860ea3ce77b2d31464835191eadd304a2c7

Analysis

user interaction
yes
max time kernel
35s
max time network
55s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
07/05/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
com.lodhi.apps.savetheballoons.apk
Size 34.8MB
Sample260507-eqa9qsay6p
SHA256 03dfac1610e8d0adc7260fd5c069e860ea3ce77b2d31464835191eadd304a2c7
MD5 1bf74a6a84f170001aa550fd205d532f
SHA1 23e7b13e0cbda96c6ed6479bdbd766b4b980e1ba
SHA512 88548917b97ef3561081a18d127ee4698e5bd1165f444e22e011444625bd8402bb17a698e2c21bbdb3238ae74f03025b9af948e940ffbeae9389508d89469c07
SSDEEP 786432:bGD0iDeit31iOO0a0bzIGKj0l8wHCbRfsrv:bGDJDem31zO0NzIGPl7Cb2L
TLSH
T1E9873386F35C839BE4675B720C1EC6688B823E4706937BD174D5B7082B771847F9AB82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.lodhi.apps.savetheballoons
/system/xbin/su	com.lodhi.apps.savetheballoons

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4994	com.lodhi.apps.savetheballoons
/system_ext/framework/androidx.window.sidecar.jar	4994	com.lodhi.apps.savetheballoons

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.lodhi.apps.savetheballoons

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lodhi.apps.savetheballoons

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lodhi.apps.savetheballoons

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.lodhi.apps.savetheballoons

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.lodhi.apps.savetheballoons

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.lodhi.apps.savetheballoons

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.lodhi.apps.savetheballoons

com.lodhi.apps.savetheballoons
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4994

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events
Size 56KB
SHA256 935ab71b000465221cce375ab98a766d181c7f17858c68be3f0f5a43835f4e3e
MD5 e28e517d0206c8dfef4b34a3b974a423
SHA1 4978b6a5169d263bd03fdae591fece193018884f
SHA512 e2a46fe42e2e6e3b651c78581af2f7eea403e35e9acaa37409e1d118801c4d22d82e4db9ec3e589dd706ce7c5879229f500b77e45141e5443d0a2e3009276348
SSDEEP 48:T2w3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSK9FXfbjtFXfbYn:iwAMEX0wIyNjaKTbjjbYn
TLSH
T1FE43959E5B3C2221C66D7C3DD3E243A31B7C83DF5722822139908DF98CC20A57C654A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 62b92f03c867810ea224dbdf8b666afd435055b375d5940fe82dd0c7739e20b9
MD5 5388888508f891915e5a4b27dacbf5fc
SHA1 d9560b40ebdc16bb3b0dad99484554ebcf50dea3
SHA512 2a02b96b55fcdd47adc5fdedbae43411b32b019f68581abf379760630cf4fa75c262d65c663511e99d44afe9ac19055c57be1c125dbf3edd438603b9582cad72
SSDEEP 6:7+/l9x27Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKqHa/Bn:7+t6zqLJdeWRmBEyPbbHqBn
TLSH
T1C202228A63410813C2291777A0DAC3401E18A728A227CB4727E108543C07ACCA890E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 7b01e2584568a8003c9532ed2c2a25d3c49030d4f9269101a1dd4bc5c49e36b5
MD5 078cb0f8268b01faf89f685508144271
SHA1 4527096c679c3285af6585cc0ff376f3776f262c
SHA512 88f7dc45614ef564074ea30a95197f2c2b804701d411a64e11dc011817dcc877ae6cfa2f56240fb16e3052fc7833bfdda7fa48f3dcec9288708c7493ad10a43c
SSDEEP 48:7M8Vq/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSr:7NV0AMEX0wIyNjar
TLSH
T188B2105D5D2C2621C5BE283ED7E10253593C53DF972391703EA48CFA8DC6469B0365A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 8732a619f9084673ae1559cd42632d6ec28de27870ebb01d2318242e674dd5fd
MD5 80b88c232870894759751e2be2c090b4
SHA1 55850f316579f5fb2d6e8bd4b8bab37fe202f6d5
SHA512 0499395f5a75f60ba329a620d61047d80e13074847ade792d0ccff562f4739e5bffd7c1f97682e25b20c1688a517215c8d81ebdfd3cd6c088e6bc0a27bb3d1bc
SSDEEP 48:7Mj27tDlO9L/nw6v+W6QWXmqP3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSX:7+27fO5/nnGp2kAMEX0wIyNjaX
TLSH
T18072859E6D3C2222C5BE697EE7D203A35A3C23DF5713A0313E948CE98DC606970355A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 46c02685f0f927bc0a0f632151326e01aa1290f13ef00ee52974c8cd06aff75d
MD5 7392759ac1522c95e7f58b84cb918718
SHA1 088533ecc42a1598c87b616d8b166a10cdb911b5
SHA512 7b258b1e517ca5e7a1d029c82d63334979006cebbf9eefe048a7914bb643f33c4a4609a99e217b34504da7e33b1638c610cf1ff1d548c973cc3d3c02091bd158
SSDEEP 48:7MMVFXfbWqP3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSzVjq/3g59MENZBdU1:7pbWkAMEX0wIyNjal0AMEX0wIyNja7
TLSH
T16492639D193C2311C6BE283ED3E247A3597C53DF672391703EA48DEECDC246AB0255A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 613a9e6b711b411135a8e194b3aeae21a98aab82e8fce1ca21d2308baf98f9a7
MD5 55d3be5b14715856198047b6be76ea95
SHA1 f83b0f5afd204ddce3710bed506060fb91f59969
SHA512 4c9abfe79668bd3bb3117a02841be4602d8314bdb79370375d500276599d023028ee23147bd8a1a748fb9c2f8457f92bc838c4971e4e229ae5d26815a5aac120
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.lodhi.apps.savetheballoons/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 96765564afa9a26e070979c888201de975ae5c85df7ad2d891771711c1c91f56
MD5 15d5dcc5386129c5099d7be23bcf4d09
SHA1 84f5cdfb8f137c2d45cdd7d2b16b8380721e9c2f
SHA512 f4735887cd08781508c74c7a8fdee618279b27290422f27e2be12f538ac98f8ba06f33acdcc61035ef570978c7c81cea18210d98677b50a9a8443938a9b8b801
SSDEEP 6:7+/l96Hn15PlsWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK4n:7+t8nPlfqLiuWdYRmBEyPbX
TLSH
T17402228863801812C8293A7790E483400E00AB389171CB1717A028943C874CCA8A0E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.lodhi.apps.savetheballoons/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
TLSH
T16D72C2CEDF102606C6760737F8CAE3A05DA4A22D833ADA476B950460AE42549A8A1F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.lodhi.apps.savetheballoons/databases/google_app_measurement_local.db
Size 16KB
SHA256 0082f7ea45f8dac8432c082ebaec1b97b16d91e17c6ab96c165e98b802f648d4
MD5 2e1ac14ca13e3e0e02ca8b17bb102c39
SHA1 9cc441073cecf13ad7e85245160b9fb941c2ddd5
SHA512 f11ab181f0a6b6af6797a110a55dc6e9d6ae94937984aba791ca66fcd305bc00bebf643d33642c4be066ae73e9b7587bbf10f3c61974ecc1b4642d28a2d35d64
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6H:TLiEq9zmzrfRmBEyPbP/P+/0Fl68XIz7
TLSH
T1D57268CC7B105703D177477670CF93E11C34A2198333DA173B550428AD421C46042F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.lodhi.apps.savetheballoons/databases/google_app_measurement_local.db
Size 16KB
SHA256 6dc581e369c1d791820af34c623bbc173b8c583422c354c57578a96d15c73e23
MD5 6ae459b6039ccfe4a1def8dfce9c9326
SHA1 1a485416071deb59c03781124cf89c28b029566c
SHA512 418de469ecc7f18553ccf2489ddc5a82c4dba5be29b8dd1943609bd301aa974f61b30e7ab4dc040bf7cbcf462e0c53aa361a7034166037ae702c8ee08fcb8753
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFlpkYUQ/+/0Fl68XIz7:TLopmzr0GSP/h1499FIQ/lF7XI/
TLSH
T18E72E9897A10D707E67B4B3560CFE3D12C39B2269723D5173A561A2C6D427D55052F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.lodhi.apps.savetheballoons/databases/google_app_measurement_local.db
Size 16KB
SHA256 7840f698d99398b2eedae477a3dd64cf8eb2c0197665e5dd07f3eeb5cc235e6a
MD5 d470610cb210a874d6b8b01f400444ac
SHA1 d4447c408e9dc446da1f82121e07358710e5a78d
SHA512 b5fee8a17cae580f45bdc9d23d75fd398732ca4634d3af509a58852717c04b2f5afbeefb8bf2f3e503a4708f561c61d8efc4f5b3fa66ba97bee8ebee50b5b19a
SSDEEP 24:TLYpmzr0GSP/nhKamNZ2tR499FIQ/lF7XI/:TcArSP/ncamNote5IIDI/
TLSH
T10E72F7897664DA06F27B4B3961CFE3D13839B1665723D6233E061B1C5E427958161F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.lodhi.apps.savetheballoons/databases/google_app_measurement_local.db
Size 16KB
SHA256 b86e5c19d143779f84312deb845375df701d8e8d67eb7f73fd4fccd7312a8b77
MD5 b03764dc8bef1633bd53e7674b99c70d
SHA1 92eab41981e2d2078bc59bc74d4c5e3eb4b0dace
SHA512 c4099cc5b9e73084e64fe18f06508f06dc2cc493a7f025535e69bada7637fd0a5d91e018af71a4b3757a92b4cae3810fb89282b62c29746a0217a7bc9a8dc20d
SSDEEP 24:TL6vpmzr0GSP/M9hKamNZ2tR499FIQ/lF7XIb:T2vArSP/M9camNote5IIDIb
TLSH
T1E372F7C9BA64DA02F2774B3961CFE3C13C3DB1664727D6233A062B1C5D427968061F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.lodhi.apps.savetheballoons/databases/google_app_measurement_local.db
Size 16KB
SHA256 b48b72f36c30e4ebe0cc22bbe453a1b28970e96bda950e2f97184865e390f6f3
MD5 7125339283562b267f96f6db39a00d96
SHA1 bc9375cab8db99af9c6ec87a60b524c87507b464
SHA512 5ad8e93670baa8007c9592fa9514452230b52477662a36ed64974c532ce9895f81243b78b4dfa235e544b9b12726ba1f91e28b4a79f9cd957edcf0d4ca36d6ff
SSDEEP 6:l9bNFlkls16/nlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WIzvCvllll:TL6E6v9zmzrfRmBEyPbP/WIullll
TLSH
T16F72C28E9F102603C6764672B4CD93A15E14E229833BAA972BA50460AE4258AA492F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download