Analysis

  • max time kernel
    31s
  • max time network
    153s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    28/05/2026, 00:21

General

  • Target
    nickel-an-account-for-all-2610-arm64-v8a-armeabi-armeabi-v7a-x86-x8664.apk
  • Size 35.5MB
  • Sample260528-anef6aby2n
  • SHA256 6ae198cc11be662fcea5e5f4bc4f60529c67fb5d4e86195a257b62b9c333e866
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • com.fpe.comptenickel
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Checks memory information
    PID:4959

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        PwInbox.db

        • Path /data/data/com.fpe.comptenickel/databases/PwInbox.db
        • Size 20KB
        • SHA256 8d2732e051736aa06e8f02658cb2899fa596f493ba4c9545db3b5ce92ecb83d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PwInbox.db

        • Path /data/data/com.fpe.comptenickel/databases/PwInbox.db
        • Size 20KB
        • SHA256 c857f13cef243a386acbe82db6fffc41c3b51899f364423e49131ddc5c7959ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PwInbox.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/PwInbox.db-journal
        • Size 512B
        • SHA256 e319e3d5df3cf8fb38b45a3eaf441781fb8f99b2adb73bd3e5aa3707c6a8631b
        • MD5 SHA1 SHA512

        PwInbox.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/PwInbox.db-journal
        • Size 8KB
        • SHA256 0bca39bb29903c1532745abedd5dfe92796e11d3daa01e2fab4dcecd0b8aa307
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PwInbox.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/PwInbox.db-journal
        • Size 8KB
        • SHA256 4b7acd1dc695621e9ab69131734d296b0a4e67a5e9d2d420e0328e0e3c453efd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PwInbox.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/PwInbox.db-journal
        • Size 12KB
        • SHA256 319a492aa53d6b2d8f351db9aa5bf69cc801ce41121aa94ca1c62170beb73994
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RKStorage

        • Path /data/data/com.fpe.comptenickel/databases/RKStorage
        • Size 20KB
        • SHA256 b8e5c0aed3a6b7f0ebcde3ccd0a0e3181ae814837aab4beed261f0c7ac4f1506
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RKStorage-journal

        • Path /data/data/com.fpe.comptenickel/databases/RKStorage-journal
        • Size 512B
        • SHA256 4a80b2d4539462e869344a4a6a50456322b26a6c4e48969a5a35d24cb0425dea
        • MD5 SHA1 SHA512

        RKStorage-journal

        • Path /data/data/com.fpe.comptenickel/databases/RKStorage-journal
        • Size 8KB
        • SHA256 38b1f4fbfe7e69f950658db4bcd37bbd643f9ffdf67cde877597a7b968fafaa7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RKStorage-journal

        • Path /data/data/com.fpe.comptenickel/databases/RKStorage-journal
        • Size 8KB
        • SHA256 d570e13fa3713004c40d693e69044b946adf557d697aa16cd395b61ea8c38af1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RKStorage-journal

        • Path /data/data/com.fpe.comptenickel/databases/RKStorage-journal
        • Size 12KB
        • SHA256 17fa41c5f27c038611044de5944536f59d6a5ec38a1d106e0e7e9a710b2e71ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RKStorage-journal

        • Path /data/data/com.fpe.comptenickel/databases/RKStorage-journal
        • Size 12KB
        • SHA256 ff88fa902a8e71d1f7367c7ec21d3bd161e1309b1a4450d80f59b841dfa82f9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RKStorage-journal

        • Path /data/data/com.fpe.comptenickel/databases/RKStorage-journal
        • Size 12KB
        • SHA256 ba23cd54e67a1875e89b5d47d186961ec68f2de7faaec3d0eb3a5d7a6c23978d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StatusBarNotificationIds.db

        • Path /data/data/com.fpe.comptenickel/databases/StatusBarNotificationIds.db
        • Size 20KB
        • SHA256 342014441d0ddfe6eeab0725c48ad6701bee79e3c323d6dd86e9acbd2bde3245
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StatusBarNotificationIds.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/StatusBarNotificationIds.db-journal
        • Size 512B
        • SHA256 ae27de2ad2aa2af7a3d13eff555bf59ff1ab0f10892e4b430760eaaa3269627c
        • MD5 SHA1 SHA512

        StatusBarNotificationIds.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/StatusBarNotificationIds.db-journal
        • Size 8KB
        • SHA256 faa2bfda259dbbfee9e7f8a0b6f070210a1db52c49545929b3589382071b4a84
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StatusBarNotificationIds.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/StatusBarNotificationIds.db-journal
        • Size 8KB
        • SHA256 517c81106709c9522afc0a0ca75d30df0da943fa30f83f51e2daaceaf1b9d57a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StatusBarNotificationIds.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/StatusBarNotificationIds.db-journal
        • Size 12KB
        • SHA256 88c43a29818e93a84aa01d7a97239058a9fc63ba0769a47a0fc03ccfbf602f2c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.fpe.comptenickel/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 1bfb28db5726aa612040c7b6865210f717cf535f908a68d3861ba6198f43581a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.fpe.comptenickel/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 4297b8df7508c4fcf929ecb38197d0bb9285d08c78562f40442b08cbcbc67ac6
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.fpe.comptenickel/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 690cfcb4220f2885d3d05df86ad5d681e7dc3c2c6c3db78cf236cb23d58e8205
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.fpe.comptenickel/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 342c2addea8ac76fb72a3e4e9c4efdf4fa4c60f3fad23b4328c9922d2db9096e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        request.db

        • Path /data/data/com.fpe.comptenickel/databases/request.db
        • Size 20KB
        • SHA256 e5902c9ecddcced3d4d1e91d25c5d70dda1045c13e2b5276fca9fae4fd0ae987
        • MD5 SHA1 SHA512 SSDEEP TLSH

        request.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/request.db-journal
        • Size 512B
        • SHA256 715f059be4f3d06c5ff9fb66ed5666d7838adbbee2429d197e9de00db7efb08a
        • MD5 SHA1 SHA512

        request.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/request.db-journal
        • Size 8KB
        • SHA256 ea35413016ea09c53388f7f757cbb472998aa4fd9e4518234e7a50a59fad4487
        • MD5 SHA1 SHA512 SSDEEP TLSH

        request.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/request.db-journal
        • Size 8KB
        • SHA256 c8c9bc24353802fd928b890280fa4243f4298cb1bcd245c433d39db593b62ec6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        request.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/request.db-journal
        • Size 12KB
        • SHA256 fd98f75b716bbb3fa2b70fbbe4f1e1620ee29d39719b3a058ebd7fa6712ed226
        • MD5 SHA1 SHA512 SSDEEP TLSH

        silentRichMediaStorage.db

        • Path /data/data/com.fpe.comptenickel/databases/silentRichMediaStorage.db
        • Size 16KB
        • SHA256 18da276d65be5ac32b8b55a7db44cf11f8eb0becefcf40786df6a00333902eab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        silentRichMediaStorage.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/silentRichMediaStorage.db-journal
        • Size 512B
        • SHA256 255807c95c6343eec6190c255ce971655e1a87d71bb74903db997c198d3ca81f
        • MD5 SHA1 SHA512

        silentRichMediaStorage.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/silentRichMediaStorage.db-journal
        • Size 8KB
        • SHA256 6ee097e519178be708c49e075ea7327a4294ff1f372b86dfd336b5dd5b4383dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        silentRichMediaStorage.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/silentRichMediaStorage.db-journal
        • Size 8KB
        • SHA256 139736bd7527dfc21b269b8c0a94e8999891172be51504a840a7e010a64b6dde
        • MD5 SHA1 SHA512 SSDEEP TLSH

        silentRichMediaStorage.db-journal

        • Path /data/data/com.fpe.comptenickel/databases/silentRichMediaStorage.db-journal
        • Size 8KB
        • SHA256 3aa27e7fb1d7213b776e54209c7234a6b2a689c97a4e5d1bb59b7625a15cc918
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snowplowEvents-mobileAppTracker.sqlite

        • Path /data/data/com.fpe.comptenickel/databases/snowplowEvents-mobileAppTracker.sqlite
        • Size 16KB
        • SHA256 a6f6f87b38a9622402f234eb40c242c573d4a2d48274d38ca1c55b07aa0543e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snowplowEvents-mobileAppTracker.sqlite

        • Path /data/data/com.fpe.comptenickel/databases/snowplowEvents-mobileAppTracker.sqlite
        • Size 4KB
        • SHA256 8769f5de6cf0a63c0469e2ca393e534ef467de2c9d085e5dee995812d023e315
        • MD5 SHA1 SHA512 TLSH

        snowplowEvents-mobileAppTracker.sqlite-journal

        • Path /data/data/com.fpe.comptenickel/databases/snowplowEvents-mobileAppTracker.sqlite-journal
        • Size 512B
        • SHA256 7aa08385f781337728b2f4811cdc96f34810ac88a8e3d6e9708da77bcce1bc01
        • MD5 SHA1 SHA512

        snowplowEvents-mobileAppTracker.sqlite-journal

        • Path /data/data/com.fpe.comptenickel/databases/snowplowEvents-mobileAppTracker.sqlite-journal
        • Size 8KB
        • SHA256 081fed0ec22b09cfc7e5a803a6f948f854508298fba5ece73e80f89e678fd2ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snowplowEvents-mobileAppTracker.sqlite-journal

        • Path /data/data/com.fpe.comptenickel/databases/snowplowEvents-mobileAppTracker.sqlite-journal
        • Size 8KB
        • SHA256 74c0bbda4bec451ae5eff5ca19d5bb36d3883f638a840467544af1d777109451
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snowplowEvents-mobileAppTracker.sqlite-journal

        • Path /data/data/com.fpe.comptenickel/databases/snowplowEvents-mobileAppTracker.sqlite-journal
        • Size 4KB
        • SHA256 d537f8ab9cd9db35334c8d55caae05e478bad4df3e300bb971f4625f8c996853
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snowplowEvents-mobileAppTracker.sqlite-wal

        • Path /data/data/com.fpe.comptenickel/databases/snowplowEvents-mobileAppTracker.sqlite-wal
        • Size 16KB
        • SHA256 1a70e67f6b94a136dd036336f037026406a4898f47b1fc70a2201d8ec2601bcc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.crashlytics.settings.json

        • Path /data/data/com.fpe.comptenickel/files/.com.google.firebase.crashlytics.files.v2:com.fpe.comptenickel/com.crashlytics.settings.json
        • Size 769B
        • SHA256 87e175794e6fb9fa72183aa49f5bf189ef2534bae6115cbd7f4389d87e1aa2ec
        • MD5 SHA1 SHA512 TLSH

        keys

        • Path /data/data/com.fpe.comptenickel/files/.com.google.firebase.crashlytics.files.v2:com.fpe.comptenickel/open-sessions/6A178B45007C0001135F3E16F9F20B3E/keys
        • Size 33B
        • SHA256 e71b5023d20e4b623e1fe53fac9ba38f14ec8fd6ba0e604e9755e038ea5b4275
        • MD5 SHA1 SHA512

        keys

        • Path /data/data/com.fpe.comptenickel/files/.com.google.firebase.crashlytics.files.v2:com.fpe.comptenickel/open-sessions/6A178B45007C0001135F3E16F9F20B3E/keys
        • Size 57B
        • SHA256 5d3fab8e4be91f85821112e869fd54971fb107ef799234093dec0b3ea541362b
        • MD5 SHA1 SHA512 TLSH

        keys

        • Path /data/data/com.fpe.comptenickel/files/.com.google.firebase.crashlytics.files.v2:com.fpe.comptenickel/open-sessions/6A178B45007C0001135F3E16F9F20B3E/keys
        • Size 74B
        • SHA256 7f478616f5b3c42da290cac69788995ebdb2a153bb4b0a8f389a00d54e248051
        • MD5 SHA1 SHA512 TLSH

        keys

        • Path /data/data/com.fpe.comptenickel/files/.com.google.firebase.crashlytics.files.v2:com.fpe.comptenickel/open-sessions/6A178B45007C0001135F3E16F9F20B3E/keys
        • Size 95B
        • SHA256 d43c67041772dffb2023d744dc7dc306b8ff4fea967057c6b76821640fbcfbda
        • MD5 SHA1 SHA512 TLSH

        app.json

        • Path /data/data/com.fpe.comptenickel/files/.com.google.firebase.crashlytics.files.v2:com.fpe.comptenickel/open-sessions/6A178B45007C0001135F3E16F9F20B3E/native/app.json
        • Size 222B
        • SHA256 393f3d8904981c70b979bfa15c6409e6839aba71e596d09b33ab7777e71ce06c
        • MD5 SHA1 SHA512 TLSH

        device.json

        • Path /data/data/com.fpe.comptenickel/files/.com.google.firebase.crashlytics.files.v2:com.fpe.comptenickel/open-sessions/6A178B45007C0001135F3E16F9F20B3E/native/device.json
        • Size 194B
        • SHA256 63bb6202ec02ac07270d6bd125ae960113118950861109c8947a711600f32c88
        • MD5 SHA1 SHA512 TLSH

        os.json

        • Path /data/data/com.fpe.comptenickel/files/.com.google.firebase.crashlytics.files.v2:com.fpe.comptenickel/open-sessions/6A178B45007C0001135F3E16F9F20B3E/native/os.json
        • Size 56B
        • SHA256 3a5df913db77290768c5dfbdfd65b218dfa34b7999441f5cc87797e4b65e445c
        • MD5 SHA1 SHA512 TLSH

        session.json

        • Path /data/data/com.fpe.comptenickel/files/.com.google.firebase.crashlytics.files.v2:com.fpe.comptenickel/open-sessions/6A178B45007C0001135F3E16F9F20B3E/native/session.json
        • Size 127B
        • SHA256 72c2a7f67fde8d2775ec7b545930f45fc0ee258540bfa468447c4beaa4e204c5
        • MD5 SHA1 SHA512 TLSH

        report

        • Path /data/data/com.fpe.comptenickel/files/.com.google.firebase.crashlytics.files.v2:com.fpe.comptenickel/open-sessions/6A178B45007C0001135F3E16F9F20B3E/report
        • Size 755B
        • SHA256 322c115beef5ed3e4839e386b177f99934c2d67e4bd1847fa6f2271a09039c31
        • MD5 SHA1 SHA512 TLSH

        user-data

        • Path /data/data/com.fpe.comptenickel/files/.com.google.firebase.crashlytics.files.v2:com.fpe.comptenickel/open-sessions/6A178B45007C0001135F3E16F9F20B3E/user-data
        • Size 22B
        • SHA256 7008db65085729be628c807ffd19ad65c0c59e1fe0200896fa40aa62e1aba184
        • MD5 SHA1 SHA512

        PersistedInstallation145634101812550692tmp

        • Path /data/data/com.fpe.comptenickel/files/PersistedInstallation145634101812550692tmp
        • Size 565B
        • SHA256 a98ff67fc6ea6697c17dd6fbe49dffcb8a54f541c83cf21581787c1d0966d746
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation996769896196671994tmp

        • Path /data/data/com.fpe.comptenickel/files/PersistedInstallation996769896196671994tmp
        • Size 90B
        • SHA256 e70d3ef11eab457446355c9c90222e5f26a08e9daab9cafc14f764fb10611a50
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/com.fpe.comptenickel/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.fpe.comptenickel/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 367ff5f6757957289bae71cd901d7c5415d56079845efb276d025e1e097b35ee
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.fpe.comptenickel/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.fpe.comptenickel/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 b1470f9abc3fdf1b0c0ccc2bf9460d7c63bb08649652264058efceee539ad1d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.fpe.comptenickel/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 46dbc26853f8fc8748a59cd2e4c452641ed8d7660b2f97cf22ff642afbda6f27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.fpe.comptenickel/no_backup/androidx.work.workdb-wal
        • Size 273KB
        • SHA256 6106d938cc20b49c3511645fdf9f053b6df4b9e58dd85e3b9ecc19472d690ad6
        • MD5 SHA1 SHA512 SSDEEP TLSH