Overview

overview

7

Static

static

6

Telegram_1...re.apk

android-13-x64

7

Resubmissions

22/05/2026, 16:00

260522-tf4kvsbs4t

22/05/2026, 13:12

260522-qfp6paev6x7

22/05/2026, 13:10

260522-qeq2laev4s7

22/05/2026, 13:06

260522-qccq7aet4t7

Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • user interaction
    yes
  • max time kernel
    2s
  • max time network
    45s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
  • submitted
    22/05/2026, 13:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Telegram_12.6.5_APKPure.apk
  • Size 47.8MB
  • Sample260522-qeq2laev4s
  • SHA256 7d44e0009d251ae4983f5bf29f7d8aa9af668df88dba05a17a7a314f6780ceff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

    defense_evasion
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • org.telegram.messenger
    1⤵
    • Checks known Qemu pipes.
    • Acquires the wake lock
    • Queries information about active data network
    • Checks CPU information
    PID:4199

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events
        • Path /data/data/org.telegram.messenger/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 e1f1466105b5fd2b66447583e38d2cdccff191b93857bf8e820c8309de9d06ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/org.telegram.messenger/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 5e04269932e93b9fea1e18d1ea9a3ff61943eed55ba3c65195ce60a2a4ee0b66
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/org.telegram.messenger/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 9c264e00c3f114088072d613dbe83ce86d4bf9f012d45b7eb7ba50ca6d93de6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/org.telegram.messenger/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 d7f555a55a07b24d29ec441a67ae173af7a1df528bbf888213543a81e184801a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PersistedInstallation1269823165269293251tmp
        • Path /data/data/org.telegram.messenger/files/PersistedInstallation1269823165269293251tmp
        • Size 114B
        • SHA256 d8e66d3f9a3699e7fd077897da5d5297f141548e252a3fb0e4404c59709cdb34
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation3108055931278632298tmp
        • Path /data/data/org.telegram.messenger/files/PersistedInstallation3108055931278632298tmp
        • Size 90B
        • SHA256 61c70eb16b45f6fa9fb2e76a83b899a4b16afcaa9e72b66c26f2b7d26488e449
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        000000000_999999_temp.f
        • Path /storage/emulated/0/Android/data/org.telegram.messenger/cache/000000000_999999_temp.f
        • Size 1024B
        • SHA256 5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef
        • MD5 SHA1 SHA512
        Submit Download