36200ef02b917293c34f0b7308d7878a054ee3c1a12945af69ce28da07f2599c

Analysis

max time kernel
12s
max time network
164s
platform
android-13_x64
resource
android-33-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
submitted
29/05/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
toca-life-world-1.132-mod-t-5play.apk
Size 860.6MB
Sample260529-c2zelabt7y
SHA256 36200ef02b917293c34f0b7308d7878a054ee3c1a12945af69ce28da07f2599c
MD5 566fadeb570ae57c491b9ca6715480d0
SHA1 6bd8b3cacaae7dd0bcc9a631d01d3723c08e08de
SHA512 38bf303a637d3a452d8fe4afff85947498e536ade05bdb69398597284a333e43b90a3a9f5cd34bc84f3f8783fbda90635adb1cd50c9dd9b068606feb0fdd1db3
SSDEEP 25165824:eUknLTjAh+if3VI4DCvq4dujnXsqDLNMVcAt3SSvltLHO7Irt:yLTjAhDj54YAqDLSVckOUrt
TLSH
T1F19933D75A425B80CB6D1CB5C7CBCB518A522C80530A02EF1F31F155F8BFEA8A69E617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 5 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.tocaboca.tocalifeworld/files/f65906de/f65906de	4440	com.tocaboca.tocalifeworld
/system_ext/framework/androidx.window.extensions.jar	4440	com.tocaboca.tocalifeworld
/system_ext/framework/androidx.window.extensions.jar	4440	com.tocaboca.tocalifeworld
/system_ext/framework/androidx.window.sidecar.jar	4440	com.tocaboca.tocalifeworld
/system_ext/framework/androidx.window.sidecar.jar	4440	com.tocaboca.tocalifeworld

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tocaboca.tocalifeworld

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.tocaboca.tocalifeworld

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.tocaboca.tocalifeworld

com.tocaboca.tocalifeworld
1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4440

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.tocaboca.tocalifeworld/databases/com.google.android.datatransport.events
Size 56KB
SHA256 74349c731d20c42a863c3dfc80a143594382e1a9592efb66589098fa4d17a011
MD5 006f43a9ac07f6379402d32e2150fbf0
SHA1 17ee9f9c09f4484bfdbed0433089c2bae2d777f9
SHA512 89087a7964016340b463051983d2c70d6f2142f9a81f570fe94f94590cfeb21b599f2923f517207c87f9ea277a349b1fd7ec4b0def1ce54843be27b4a46913e9
SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPS5S:RMEX0wIyNjaQ
TLSH
T1D443639D1A2C2221C97E283ED3E143A35B7C93DF5723927239908DF98DC206974358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.tocaboca.tocalifeworld/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 76fddf0edc97901da1a3ab8b12b7ecaaf778cf6c6944eda1af28134b4d108fa1
MD5 64e21612125211768b1995615e826edd
SHA1 bc9878cd1987953528e1347740b8e79fb896a2a9
SHA512 f7dbbccc9fdedad6d6eda8060235a344ed10dbc524f294bb290b03bca85762242938c38bf1351fc7eac2aeab019206b78ce258ea526de234322c0254821024cc
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.tocaboca.tocalifeworld/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 2ba20ed5c713178288bd75152952998db4cb5ab37f658dbf983fc844e0af39f4
MD5 4a987997e504e0ed9931d875e9c35672
SHA1 83dcef0a371d6d3565d5e02498d40bdbf4f54ca3
SHA512 448ee141f9ff133e180c5427025962967cf37c015584491e176326eaa2b52b2a03888b2ad9ac903f35618065324717044a48855f666728a5adca9e7a844f2ee3
SSDEEP 6:7+/l9iUlgn16Ul/vg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKE:7+t88CnqLiuWd7RmBEyPbL
TLSH
T15402C09D63810813C91D567790F583C21E00E7198B76CB170A5008983D074CCE4E0E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.tocaboca.tocalifeworld/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 7e14a19c434493ec4dfa3fbcc5e505d97a857e927b8fa227f4f5eb8e96a180a9
MD5 5087cae473bd6bd3beb17bbd3f6fdc63
SHA1 7d64c5a88be6667c0465051247246fa360d9afad
SHA512 428a669d865dfc10cddc9f8ca77233c967915859302500383eef41ce53c0374929b832711fb641907400c97757c8ab8875a625ce7cf17a985bd41e73c1e18dd3
SSDEEP 6:7+/l90EOPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKg3a/jn:7+t5iqLJdKBRmBEyPbBqjn
TLSH
T14D0222A863400803C01AA77790D883401E20A718C323CB0B0D5008542C036CCE892D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.tocaboca.tocalifeworld/databases/google_app_measurement_local.db
Size 16KB
SHA256 45ba0f46c1e4eefed63b48ae37d6aa4695209e693589662b1386abe1ed788aaf
MD5 5450e5c689493a5414e649811f906dc9
SHA1 44057cb8e532bbc33deba2e244bc3d5d09797348
SHA512 e1af02287c8995e5ccaff3d6eefe7cb3c38fe3778e10061208b3eff89b89d57bfa2084b05d9228a61e0749a37a057489c40ca9aec680355b431930472bb242ac
SSDEEP 12:TLiEx9zmzrfRmBEyPbP/P+/0Fl6KiT9P7:TLfpmzr0GSP/PlFW9D
TLSH
T1217222CC6A109702D1774736B0CB93E11C20A2188327DA073A440524AC425889092F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.tocaboca.tocalifeworld/databases/google_app_measurement_local.db
Size 16KB
SHA256 d2765dc9c91a2b3a51bc91634283905e19521c9102ade4706aa3e4a09aca28cc
MD5 b12ce046f8a487d23233f5a3992e4ed0
SHA1 c22de4bfbe10a742fa443af99f076bbcf0fcf25b
SHA512 64092cd6096da844b553127bb1026dae7fecf3b7c5d06ccd28ec408ea0e7efc4a0764dff66464b9d1575c440184138439262d9c96bbc0a8f3cbedc419c949391
SSDEEP 12:TL1Es9zmzrfRmBEyPbP/hr/gW49blqYFldG8+/0Fl6KiT9P7:TLvpmzr0GSP/h1499FxlFW9D
TLSH
T1CC7224CD7E24D702E2374B36A0CBD3D12C3472159723D50639411B2C5D427C58062F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.tocaboca.tocalifeworld/databases/google_app_measurement_local.db
Size 16KB
SHA256 cb286c84a371b6b04792e04b288a9f5eb1aadf7ec9ce232b63738f76ecbd28f9
MD5 bf36b6fa0311d299ae626159fddd90cb
SHA1 eaec196fc2d7ffe0ffa9a84d7c39d61e7f6c9f16
SHA512 162d8a5a67c62e1eb0e5fa3113a9f18001a947c704cca1bdd4f26295fcd32624cc625d4dc3b91ada070d5b84c9c051a8cf105db4c81aa87ca4c1e6fc805cd79f
SSDEEP 12:TLIEsE9zmzrfRmBEyPbP/qFiOLaOS/yAU3KJUyWlD4Z49blqYFldG8+/0Fl6KiTZ:TL/pmzr0GSP/qsKaT6xpA499FxlFW9D
TLSH
T17772F2D9BAA8CA03F2774B3950CBE3E12C3472669767E6133D461B1C6D427858571F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.tocaboca.tocalifeworld/databases/google_app_measurement_local.db
Size 16KB
SHA256 0bf27b496a1d6635ae4e49b94bca85362269cdc234dd546d070b04bc277d9f10
MD5 057fceef49b543f2f7834eb39f1e5614
SHA1 abe2aacb3339f2fa264a1ccb719087cfa1e3149e
SHA512 a698a08e344ca36f772feac5b67c552a6bd4dec69c0661eaf780037044a7e315bebaedabf8ab6dd12ac894bb0404978e382e6653d5bbc5fd7296019b6f886c98
SSDEEP 12:TL6uEO9zmzrfRmBEyPbP/RFiOLaOS/yAU3KJUyWlD4Z49blqYFldG8+/0Fl6KiTR:TL6kpmzr0GSP/RsKaT6xpA499FxlFW9n
TLSH
T1727242C9BAB8CA02F2734B3AA0CBE3D12C3532668327D61239061B1C2D027C58071F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.tocaboca.tocalifeworld/databases/google_app_measurement_local.db
Size 16KB
SHA256 486eb5bec4ec277ea7b334a0d0e431e5e62881d3462903e8294640edbe96b2e3
MD5 e3f13c7d7678604e5b293f6672bc0ed1
SHA1 b16c998ac7ca1db79cd4983b207a292ac1d96e21
SHA512 b63bab85a373912587e78dfc9daf8b4168a223c7af08fb87de8140d66b9f35042052d2d25694e4ea7c9f2064107e5471318b6dcec39c4e3dc0aa352627fa09f4
SSDEEP 6:l9bNFlgls1gElO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WS//:TLuEgE9zmzrfRmBEyPbP/Wy
TLSH
T1AB722BCD9F102603C5B34F77B4CD93555E14622D8337DE476B980878AD835899092F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.tocaboca.tocalifeworld/databases/google_app_measurement_local.db
Size 16KB
SHA256 18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6
MD5 62ad4a05cbdca7f47b3206b7dbda487f
SHA1 4f4044cef7b7b1e5c6184ed9025267fc92bf0cd3
SHA512 0936531ed1b2b356a247123200739a43cfc765469ab47a424dcd6e3d1176092a212b0a28591d07f8c2d0cc9d2e0eeddfcea8dde314c2f9343783c61075b071a6
SSDEEP 6:l9bNFl4/Sls1BElO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEBE9zmzrfRmBEyPbBvOwk3
TLSH
T15972C2CEDF102606C6764737F8CAE3A05DA4A22D833BDA476B950460AE42559A8A1F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download