b44b4c9180d39590cc73435b2d95dad2550e6f4e73c88268cc754d429ddfbcdd

Resubmissions

09/05/2026, 14:19

260509-rmwgqahv3t8

09/05/2026, 12:19

260509-pg9faagv2z8

Analysis

max time kernel
46s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
09/05/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Free%20Fire_by_GARENA%20INTERNATIONAL_69e10aa6e9b34.apk
Size 9.8MB
Sample260509-pg9faagv2z
SHA256 b44b4c9180d39590cc73435b2d95dad2550e6f4e73c88268cc754d429ddfbcdd
MD5 ebbd17666c7259cc7de5006e67e38730
SHA1 e1a6ead17af144c0297b91957abfe56a47f806b9
SHA512 6e0fabfb642b9a5238a10ef3b1dea8cac6d97a62f42206aba7be7914063b6ec18bb79ca311b295fe40a00af85fece764136c127a8f79b136b443c56a6151388e
SSDEEP 196608:9FFHt70gsd6vhmXfpr3r/avk1nRZFMb1mo4G:9Fz0L4hmX9yM1RGN
TLSH
T1D3A6F15EB7285E3EC4BB10B70C5A32B123565E229A42A7DB6444339C34F3AEC4F497D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

banker defense_evasion discovery evasion execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.uptodown
/system/app/Superuser.apk	com.uptodown

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4957	com.uptodown
/system_ext/framework/androidx.window.sidecar.jar	4957	com.uptodown

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.uptodown

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.uptodown

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.uptodown

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.uptodown

Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.uptodown

com.uptodown
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
PID:4957

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uptodown.db

Path /data/data/com.uptodown/databases/Uptodown.db
Size 544KB
SHA256 856c98369cfbf483f605a0e82b892caa8dd0b1c7ca8ac4e43b852f226a31a661
MD5 5f4d6934ff46225980209266f76dfe4d
SHA1 08b5ecc03f16cdbff1a0a34fcdfe0ae9a421c7ea
SHA512 081d5534d3c87b15f92b7e2079adc1d728a5f3716c212a5071cb4c58ec78d171ff006af4913be49d197132198ba26b2940f49ac05ee67585504cd0bcf27ece10
SSDEEP 12288:QX2ftElcokIDWJpVP/+FTj5Iq+YlRoDT80:QXwtElcZIi1P/gTj5F+YlRYT80
TLSH
T10EC4080FE7508778C3530271BE1E269DAB314069227504E65C7F80BC63FA769D1BBADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uptodown.db

Path /data/data/com.uptodown/databases/Uptodown.db
Size 148KB
SHA256 6254a90383d417a3b2a9c45805296200796f4d38480351c17b92698e235fb7f9
MD5 0145cd54fa698862c036df89ee58fbde
SHA1 e4e3ce0dbd4dc84825afa59915ee41678e97fe12
SHA512 1017d4412554fb27a3cf096fee893ab0845c3fd4f7e7a6c226aaabea710bcbf62161e04fb53a09488f7d14a48b8c5900f46415a32a4b44290f5436934c93da12
SSDEEP 96:e3K3xy/kpvkfvhtalEPe/efYeBJ7ngJkmfcH6v/4WJo2kX:e3KhyXQMMTT4WJo2E
TLSH
T1CFE30032F3B405DAD56CC4727E1C6889AE7685C851F894D28A941CDF293F92807F8EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uptodown.db-journal

Path /data/data/com.uptodown/databases/Uptodown.db-journal
Size 512B
SHA256 926b916f2e01795dfa85bb6f4c420470bbb8578fdb68f00ba19406088d0385cd
MD5 820c387a7b6687b4e9ffbca7884fc4d9
SHA1 23e8fa2c24ba54b34c3e0f1076956d4cc31c5b46
SHA512 36084b347d2ce73df585b85563726a012373d4fdba743d062ed55241b1904a4be613cb325c75f7116b14602365874460e6983785b1a7f81feeecd5f48349a58f
MD5 SHA1 SHA512

Submit Download

Uptodown.db-journal

Path /data/data/com.uptodown/databases/Uptodown.db-journal
Size 8KB
SHA256 9ad60fa4f85fd9499e0dd9ec878b6c6b69562a00ba6b9060a1f9e8228d42d393
MD5 0d6bd963410bf960907908cdc3fd13e9
SHA1 589eee486a59beb7920f45777c40b01da4087aba
SHA512 d745c9dff685bc2b7582a177fad26aa02fa063a56f30a0526c13e74fc9c07ea78c33fc321d9088b48cd8095e39d5f347f6ca14805a28691097bb80d3edfb07df
SSDEEP 6:7+/l9CUHn16/+Wg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKz:7+tvMpqLiuWdYRmBEyPbE
TLSH
T17902C08CE3840813C82D967B90D483480D11EFA88171CB1717D00CD47C074CCE4A0D0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uptodown.db-journal

Path /data/data/com.uptodown/databases/Uptodown.db-journal
Size 8KB
SHA256 7002fb06e4edbdc06889aaa325250f1c8d84a0aaa3f6db72a451ae91aa63293b
MD5 52a09d45af5488fc27ef860bc9c5c41a
SHA1 2964eb9992ee1c7b7cfc22bfb0feb81f0125aadd
SHA512 c0e15e06660902e4dc91b0d65cb52875e1b8a941db48a25aaa197b092f6b0887efdee2999feb3e54f369e0fb73ccfd2d071b0405ade2f2766698e1e0e78603ba
SSDEEP 6:7+/l9BOPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK3B/pn:7+triqLJdeWRmBEyPbWppn
TLSH
T10402228A63402A03C2291F77A0C883502E10B72A9223CB0B56A208642C866DCA890DA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uptodown.db-journal

Path /data/data/com.uptodown/databases/Uptodown.db-journal
Size 12KB
SHA256 3aed522eaa65b91605aa54f9473a6b4e068d2b5720040fb364f25638cd8c830a
MD5 af7260bd57127606b4debdbe6916da7f
SHA1 6d56ac992202b36036c1052a07f63d5c6b662c7c
SHA512 e3d384f73543a4b2f54caa02679e8c30f0fd9e72dd6b212c42cd418b5c049365d0989420d12984bffb10110cc3c0a54fe1264cf5fb9f2b61663b479dec98457a
SSDEEP 3:7FEG2l8W/wn3ll8FllyB/fllyypMRgSWbNFl/SwltNll/llkl/BllVel/b/lO+:7+/lfS1B/iRg9bNFlqQk/TL0/lp
TLSH
T12B429BC86791353AC42D5FFDD8712168195CDDD45DC59E17598403190D440C640F0DD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uptodown.db-journal

Path /data/data/com.uptodown/databases/Uptodown.db-journal
Size 12KB
SHA256 db9995b4c5c2a681ee11910aa7138efdec062f59dded6868962fb7ec96e94e40
MD5 7ec78ccae099a9e5c5c1639330467e41
SHA1 a03393ccbfed9bf39b65671c157f91a366864a38
SHA512 bfef2e7e7bb2a08535727595815352d031fb96e41711d8ce2ed0edd9f9c8fda6b66c5992ff86e4a3bfa31ef955fe04cc0d8ff7d8a4542bfe3bc03f9c034eb833
SSDEEP 6:7+/lJi9VwwCeDicAzKXeid9EPy20kY9g9bNFlkl/k/Q0/l9bn:7+t89V5HzAmXeihR9qL6cx/Xb
TLSH
T1C9422BC83BB04126C05C5FFCD552E3FC18E6D8AA559A085BAD860207198E18516B4484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uptodown.db-journal

Path /data/data/com.uptodown/databases/Uptodown.db-journal
Size 16KB
SHA256 a5c687224ebc0e4487ae038cc34a973cfceca2431392958fe5af70ec89c62ae3
MD5 575042ff7fb4f94d959b15f63cc57fbe
SHA1 ca825a7d9344c3f0e05bd22fb2ef25cd31839e38
SHA512 2d075fc86a53c289faeedbaff877fcc4655dad4fd286c2e7120dfd5b81d8039a4d51357fda2c47cb31da409454844e9a7489e484acff0d8aa3f2ed928edff25e
SSDEEP 96:7dTI/kpvkfvhtal5uPe/efYeBJ7ngJkmfcH6v/4WJo2kos/oSWpa:7dEXQwMTT4WJo2Rs/oSWpa
TLSH
T123721162F3B505DAD56C94727E1D68886E7685CC11FC94D286982CDF292F92807F8EC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.uptodown/databases/com.google.android.datatransport.events
Size 56KB
SHA256 56ae3212d73d2260f54e802ca507ae1171527b0de802240ff4f7f52dfe4acded
MD5 d72c8c4b69ab4a96890214de0b47e412
SHA1 a965e672f024cc39a963acc5e6b618c3f9f2dc01
SHA512 d9c13e060e4c838ecf21cd5d826da98f0887c25cc151d2c6c517f3b4726e3363e2f3dbae881d100bc9afb795d7762523ce0bcf63cb6407a4fbab638280850678
SSDEEP 48:TG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSQ:WMEqzAiwIyNjaQ
TLSH
T1D843549D5E3C2220C67E283ED7E143635B3C93DF5722926139948CEA8DC246974355A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.uptodown/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 12027a878e5b58cc7ba9f8a7ab2c233b9a73cb0b843eb34d8619c8d816dfaa68
MD5 772ae2dcabaadf955868423b2e94f72c
SHA1 29db7c461fe6f643120b29e6b23c5f2823002a4a
SHA512 7b5ec106951508a50d1cba0ccb54c434a41da221338fe8883ff544b077034462a115ee62cc4916022374bb93a7e584a9508f8e4997560433ecf3250ff11dbe0b
SSDEEP 6:7+/l924n1Cg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK85s:7+tsqLiuWdYRmBEyPbrs
TLSH
T13302228863800812C82966B7D0D483600D08AB28C5A1CB1F97B008A42C078CCA4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.uptodown/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 f1bd5074da48e100bc8a148a5459a7ccd34f207c2eadd308c26957bd95bc9786
MD5 242ab56097e59657e53e2b3b165b147e
SHA1 1d33422d667d77c481422bf012549837117de936
SHA512 49f32b77f8c64110e97ab8b8146fee196d9e570f96c40100cad6588bdc718f297a8b9762c3a7146210e49e1802768188411114c84039b5df2b53eb7d2ac58516
SSDEEP 6:7+/l99DHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKG//q:7+tzDvqLJdeWRmBEyPbJq
TLSH
T19602C088B3400803C03D1FFBA0CCA3401E14A72DD333CB071A9118A43C077CCE898D40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.uptodown/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 800b63a578eb05b68ad7a0ccb5e195df8afb77daf9d4a8cca193bb7bd4c6faa3
MD5 83256ab331c384c23737dad971a460ef
SHA1 076c5fc3cdd4403769ccff9afd0cc2620816fb31
SHA512 1980074ab760bd7ed7ec45c6bae88043795640b17ef6bdc7cebba53e7b5606a5c0030f65812a28732e8f142aa4bf572b17a61a1010f11146d2be58e4fe77363b
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/data/com.uptodown/databases/google_app_measurement_local.db
Size 16KB
SHA256 fecda2e650a2cbb3652d60ee1843b2e8fa9858bab765aee964b59b80a73d5c97
MD5 db36daef009d2615bbd9dfdb4f4d871b
SHA1 48f15ced1db6f00a2e1082ff632fb87d27b4b8df
SHA512 bb61280afeb208d4ef43224b9f871d09eeb24a4660c2b6691f5893f459871eff4ef4a537a3d0df268fa51e74bc55a76ade599d398f6d58fde4975adb8e8b70d6
SSDEEP 6:l9bNFleLIls13FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOwa:TLDE17LzmzsRmBEyPbBvOwVQ
TLSH
T1E272D8CD8F10A206C5270337608AD3954F78551E936796472BA408615E52198B051EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.uptodown/databases/google_app_measurement_local.db
Size 16KB
SHA256 75ea1f90a19a9e0901cffe1315e1840c7678bd5a889ff195b0f4276ce115c87a
MD5 3ae104cc13e8f5d4fd745adbdb70342d
SHA1 6d27397c250dabcf9ca6e8df5cde8b5e02ded677
SHA512 1c03b9b406907cc110b659bc31f1a3a98e1ff3c20e137cdf26c038fadc783992639eefe121886797af348a1d849ce2a2028cfaa464960c778fe9438b59babd3b
SSDEEP 12:TL6Ee7LzmzsRmBEyPbP/DvJ+/0Fl6U3XL:TLwHmz3GSP/DvJlF17
TLSH
T1CB722BCC9F10E607E127073A60CF93E61E3C611E43779A5B3AA409699E531D8B152FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.uptodown/databases/google_app_measurement_local.db
Size 16KB
SHA256 67bb9f6ff680fa405b9597a08c04161e82e76485e9163a63c9b277bfed07fb29
MD5 2870bfa3690bdec186af7425ea9c99cb
SHA1 73d5e344102fd188e8fa84bafd4c0f0a08b4f63b
SHA512 966a31a0122d0cd236ce3b48587b25638879046bfab62322c537a0bd1933a7917f38d3762ee1c817f5c6c40b43b74df555afc6228999c172006801672396fee1
SSDEEP 12:TLUEs7LzmzsRmBEyPbP/d3WV49blqYFlWWP+3vJ+/0Fl6U3XL:TLQHmz3GSP/d3WV499FYNvJlF17
TLSH
T1037246C9BE24D607E277073960CBE3D62A3CB02A0773E6063AA40F2D5D87398A465F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.uptodown/databases/google_app_measurement_local.db
Size 16KB
SHA256 7bfa8e84f88849354e1429628a0e2de4e020eb10c2be24e8aa8ec223a07f8dd7
MD5 ef499c82b4744ee660d5ce375775b6a1
SHA1 ead25f21fcd26f3db89d1bc3f56be827002c33b4
SHA512 44b3e3dac68e4136f94d6d2eca67ded2cab0a2aa28766e16c78c73db0ed8ead79aefe0beed73182522ba080532019281323b982d06c33b2f189f17c94cb5e063
SSDEEP 12:TL08EB7LzmzsRmBEyPbP/JrP49blqYFlWWP+3vJ+/0Fl6U3Xp:TL0tHmz3GSP/FP499FYNvJlF1Z
TLSH
T1C07224C9BA24E607F33B0B3960CBE3E62D3C71270363E6563AA51B6D5D47398A061F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.uptodown/databases/google_app_measurement_local.db
Size 16KB
SHA256 9eec5c6dc6b93d492724e437296594b791f61d8550f3f6e0612abbaa27178b70
MD5 c9b55cde9f8b38745c9756df49c69a2d
SHA1 858dff52f509d8865078aa99ce9625e2b68cc7de
SHA512 07fc4774dc321ab56b2aca5a1c9f63d52a241e5f0c4661003248b0d7cc0e0b56f2035a1edb00ed19aeb814f73055573a85d83cb46ba23c56325306133fabb5d8
SSDEEP 6:l9bNFlgls10l/FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/W2Z:TLuE0l97LzmzsRmBEyPbP/W
TLSH
T15E72268D8F10E216C127023674CA53951F2C511E437BAA572BA40860AE5319CB091F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download