36200ef02b917293c34f0b7308d7878a054ee3c1a12945af69ce28da07f2599c

Analysis

max time kernel
18s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
29/05/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
toca-life-world-1.132-mod-t-5play.apk
Size 860.6MB
Sample260529-c2zelabt7y
SHA256 36200ef02b917293c34f0b7308d7878a054ee3c1a12945af69ce28da07f2599c
MD5 566fadeb570ae57c491b9ca6715480d0
SHA1 6bd8b3cacaae7dd0bcc9a631d01d3723c08e08de
SHA512 38bf303a637d3a452d8fe4afff85947498e536ade05bdb69398597284a333e43b90a3a9f5cd34bc84f3f8783fbda90635adb1cd50c9dd9b068606feb0fdd1db3
SSDEEP 25165824:eUknLTjAh+if3VI4DCvq4dujnXsqDLNMVcAt3SSvltLHO7Irt:yLTjAhDj54YAqDLSVckOUrt
TLSH
T1F19933D75A425B80CB6D1CB5C7CBCB518A522C80530A02EF1F31F155F8BFEA8A69E617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.tocaboca.tocalifeworld/files/325b5ed6/325b5ed6	4755	com.tocaboca.tocalifeworld
/data/data/com.tocaboca.tocalifeworld/files/325b5ed6/325b5ed6	4755	com.tocaboca.tocalifeworld

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tocaboca.tocalifeworld

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.tocaboca.tocalifeworld

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.tocaboca.tocalifeworld

com.tocaboca.tocalifeworld
1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4755

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.tocaboca.tocalifeworld/databases/com.google.android.datatransport.events
Size 56KB
SHA256 16dbc5b1dd7e2f7bf1cdf07f034c0f11014aa108a002546d18125995b424e2c6
MD5 76f82200e865f77f88a1ba0a2f1b8500
SHA1 395b6faf759c7fcb30e4c4a43ebc12359f560cc9
SHA512 75e86df92e7da6cdd004d4c73d534b2b30eb8d747948509e4b3bfa613ba4d2fa782744082fdf99586117c0eba005cd4641c1bdbf937f8b4f9974304145a7c789
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSo:rAMEX0wIyNjao
TLSH
T17843639D1A2C2221C5BE283ED3E143635B7C93DF572393723D908DF98DC2469B4358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.tocaboca.tocalifeworld/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 7119b9c8c4fcf02d0ea06050317689ea860a64120e71e49c9b68715054f9c5cc
MD5 de8feb276a98e9a0fa30c7468c247683
SHA1 e08a288bb37e7b125320c9dd00840f273c845949
SHA512 849554e944eeecabb5521472290ac8c41cdda6b33d209bfc2c56d47a54f27fb402826f10acb345c966bb262f320a992dea630e21cbc6012a5b0308b1b13836a8
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.tocaboca.tocalifeworld/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 47f08582b922a8d9059c7dd4b63672402470ee321171f81737950bcbe2659484
MD5 0b731ef91dcd47cf5fdbf02adc0d0dae
SHA1 3e5bb95f60636c1b7373d5e761ed92a3a0aa93ce
SHA512 4084cdf3120317f28a121e101effac5d04d40d685e7675f5222dd04b55739f3aa8106ac97e81daaf29581ffc04751b0338e81b719d4a3e31e8b37bc30fdd9142
SSDEEP 6:7+/l944n14g9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKYUT:7+tm1qLiuWdYRmBEyPbq
TLSH
T1F90222A873810812CA291A77A0D483C00E20AB288D72CB1726910C98BC074CCA4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.tocaboca.tocalifeworld/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 a9eec2205048f1c5c3449ecef6c4a6356d3393d9a71bd29ee7e0d8e8915f3482
MD5 40527dc940941fde89129bb842b296ee
SHA1 c380e6ffedf13f2e84a22cca39e4b34c8d045b27
SHA512 533830af1a7e00d1a65ca601e35e8a2932ff458613058d63999d470e063d5f34e87afec7db1116c6d90dcd9b6e06cb581fb0300e460a9f035d8a841ca1d3af56
SSDEEP 6:7+/l9mPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKGa/3n:7+tYqLJdeWRmBEyPbdq3n
TLSH
T1A902228863804C03C42917B7E0E983C42E20E739A223CB07269208642C066CCA891D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

325b5ed6

Path /data/data/com.tocaboca.tocalifeworld/files/325b5ed6/325b5ed6
Size 264KB
SHA256 72e77dcc4a53670972bec9c892b4fb744330992afcc9fc7d3a145a1d038c61a8
MD5 8351e440c2306d4602116f35d4d24ac7
SHA1 c2a0e2c7c0e3e07a395ad9f780b5b3821da69141
SHA512 73c31e1fffff1f846eefed6598ebaf69fceb9c6cf58525f3582254d902de5561ffea202cbd76c5e134d2fd514f323236c698c0c48efcb901cb46d402d8a5014c
SSDEEP 6144:tm/7LqZIFE1+UXhP+KCJiHbJo7BsLGkrvjJbbkRjd:7mS1+ChWKCct0BsLGkrvNbGd
TLSH
T1CD445C53FD82AE15CC7A863A19F35B166332F9B83A47DB071189D56ABC972C50FC3188
MD5 SHA1 SHA512 SSDEEP TLSH

Download

PersistedInstallation148734035863055718tmp

Path /data/data/com.tocaboca.tocalifeworld/files/PersistedInstallation148734035863055718tmp
Size 570B
SHA256 b56ac62409ac5d81a2ee4aac8e3dcc548d87f80ae0f58a699b4d6b80877c0c58
MD5 1e9f79ba07e842540ef8c5b343e39f2f
SHA1 faa8b16637c36b6e71b1f5a0fe35ff4415cffeed
SHA512 0a8cb92fed3ffc8819c515dfa21df0247cbfeff0829ad340fb6619b5b254f1ca4ab7fd88da1b3da9b169f2c2abf4fd6dff95bb72b2c181ebe7ba4e97b25d4cf1
TLSH
T139F0966F56700200C98E8312520D3E408E3189FBABCB16B17F0F4070265B03AE23370C
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation384477298500957926tmp

Path /data/data/com.tocaboca.tocalifeworld/files/PersistedInstallation384477298500957926tmp
Size 90B
SHA256 85e3f1dcecd666618b390fd147e79c6b97f346e6f4caa2da6de96706deac1acf
MD5 c974e447213fc18f1ad34169a8014241
SHA1 5bba4450f018bf474923cffbacf60687ed161eae
SHA512 fea22ecdf9e7c24d725a7e1ae7bccfacd8d8c0399e8d1959bd0ed236fccc36891dee49aa4ab1baf692ff63b5a09bf780e59882a36b00c8bc02969ea2fd1e796d
TLSH
T1F5B0120256714141848EA2065C4CA5801F921C92840F8A060E08A09101921F5C113E9C
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.tocaboca.tocalifeworld/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 c5a295fdb8d71b401047aeaf35f9d6ac4d52ef25849b9e1ae52e42d626467572
MD5 f6a653f9fb64aa7fd08fc4b304391b35
SHA1 56531ecad295bfc92d687d5304072edc600c089d
SHA512 f706ed28097e661e965c7aadae5baf7430aebd48734c7630a7b15b5cd4ebc517bab5914f1a3858b125c5e7e562748a3027132f138d72caff6691ec469035b8e9
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.tocaboca.tocalifeworld/primary.prof
Size 2KB
SHA256 512d787f769c32d24a527cfff204b8ac69a67da0f4d291f06652bfd164aa175b
MD5 bad21bfe922f91e467d650947e47e3da
SHA1 5966cac441ac9e3de936556e6c0055b3c0575a48
SHA512 f3687ec9515a24bae01f5f4f8da6449546a2eabeb0e1a54dab29f247097e5ed856c1284514ee991dbf11bfa769af8b0f14d576da19d8b2e6590602916cdc9b3b
TLSH
T16D510AC79D7658048BFC1F429751CD83F818E1275548C29F72B45079DA0F8B1A7798BA
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads