Analysis

  • max time kernel
    125s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    29/05/2026, 18:17

General

  • Target
    app-foss-release.apk
  • Size 9.3MB
  • Sample260529-ww622acv21
  • SHA256 ad1691a5af1b25e135aff18f99d31cf0696e5704f4482945bf509132958762bb
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs

Processes

  • com.jntx.retune
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    PID:4980

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        50fa1c4ae88356da10708120d24dc967097f5d61d094f41836ec3e01e70dc5ea.0.tmp

        • Path /data/data/com.jntx.retune/cache/coil/50fa1c4ae88356da10708120d24dc967097f5d61d094f41836ec3e01e70dc5ea.0.tmp
        • Size 555B
        • SHA256 5a2d32f48215748d3542548f6cc35640f002c56f596efe47374617907080b9f5
        • MD5 SHA1 SHA512 TLSH

        50fa1c4ae88356da10708120d24dc967097f5d61d094f41836ec3e01e70dc5ea.1.tmp

        • Path /data/data/com.jntx.retune/cache/coil/50fa1c4ae88356da10708120d24dc967097f5d61d094f41836ec3e01e70dc5ea.1.tmp
        • Size 78KB
        • SHA256 77f23df836af36878a18d82f3f9f9c4815a8d0c08ee36a6aea76a3da5c96b4ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bea7f2ce4311564bb79b6dee8a755cc74ca032dfb37dd8b192affff5d3e97b4d.0.tmp

        • Path /data/data/com.jntx.retune/cache/coil/bea7f2ce4311564bb79b6dee8a755cc74ca032dfb37dd8b192affff5d3e97b4d.0.tmp
        • Size 556B
        • SHA256 d513fce5f859d93afa78b6326e989f8428367444ec5cebf560384917134af980
        • MD5 SHA1 SHA512 TLSH

        bea7f2ce4311564bb79b6dee8a755cc74ca032dfb37dd8b192affff5d3e97b4d.1.tmp

        • Path /data/data/com.jntx.retune/cache/coil/bea7f2ce4311564bb79b6dee8a755cc74ca032dfb37dd8b192affff5d3e97b4d.1.tmp
        • Size 106KB
        • SHA256 f950e4578630575e49a05d313d18bdcdfae74e34a757fd8b887fa6c71b23abc3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        f053997088959da13d64f29e77c213df1e12a952fcc2af9e9330b99494b70953.0.tmp

        • Path /data/data/com.jntx.retune/cache/coil/f053997088959da13d64f29e77c213df1e12a952fcc2af9e9330b99494b70953.0.tmp
        • Size 556B
        • SHA256 328cdac673782d3ec47ecb56552c2fe171f8305a44966f8774aa837f82f45fa7
        • MD5 SHA1 SHA512 TLSH

        f053997088959da13d64f29e77c213df1e12a952fcc2af9e9330b99494b70953.1.tmp

        • Path /data/data/com.jntx.retune/cache/coil/f053997088959da13d64f29e77c213df1e12a952fcc2af9e9330b99494b70953.1.tmp
        • Size 236KB
        • SHA256 26ad64c93818c887ad6dcd3f42fc2687511436ca6cca102912b4c4e76c63faa1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        journal

        • Path /data/data/com.jntx.retune/cache/coil/journal
        • Size 629B
        • SHA256 17c7c4febd18c86c5396054b478b7b90ef38dbe84e1ca8dfe91ae40a52953c7e
        • MD5 SHA1 SHA512 TLSH

        journal.tmp

        • Path /data/data/com.jntx.retune/cache/coil/journal.tmp
        • Size 31B
        • SHA256 8f22a32cd8de58916041d1097976f2b9c80f7e9a18593d5a6b058bcaed17e22a
        • MD5 SHA1 SHA512

        exoplayer_internal.db

        • Path /data/data/com.jntx.retune/databases/exoplayer_internal.db
        • Size 52KB
        • SHA256 3af5bbe213927dba9195f8597e2ca0111572b7bdf3f6e56ee1317330d478be1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        exoplayer_internal.db-journal

        • Path /data/data/com.jntx.retune/databases/exoplayer_internal.db-journal
        • Size 16KB
        • SHA256 4700fc86e8902779f531933063e5575d1cd861a4f51fbabea0a08fbe3d829109
        • MD5 SHA1 SHA512 SSDEEP TLSH

        exoplayer_internal.db-journal

        • Path /data/data/com.jntx.retune/databases/exoplayer_internal.db-journal
        • Size 512B
        • SHA256 8f230f9e1f393abce611872668362b55cb0589be59a1c93b4bc88dd588d5ef50
        • MD5 SHA1 SHA512

        exoplayer_internal.db-journal

        • Path /data/data/com.jntx.retune/databases/exoplayer_internal.db-journal
        • Size 8KB
        • SHA256 18d9e9a8c5a5dd24cc0fba218e8e395d6b8247ef54762a3d9d1d468a2b1d7e4f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        exoplayer_internal.db-journal

        • Path /data/data/com.jntx.retune/databases/exoplayer_internal.db-journal
        • Size 4KB
        • SHA256 ad9b82e65c71e35d8d9b09745fa95003647d16fe10079029a4f7d421123feaa6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        exoplayer_internal.db-journal

        • Path /data/data/com.jntx.retune/databases/exoplayer_internal.db-journal
        • Size 8KB
        • SHA256 84e2c2afd9a5ec349ee83ea59b721571cad223013b61e9747b4dea6b9dc3af6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        exoplayer_internal.db-journal

        • Path /data/data/com.jntx.retune/databases/exoplayer_internal.db-journal
        • Size 16KB
        • SHA256 872bc75f9885f5a083f3c481400b6a28ab0ae07b9c2affe1d203c535f92bb1e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        song.db

        • Path /data/data/com.jntx.retune/databases/song.db
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        song.db-journal

        • Path /data/data/com.jntx.retune/databases/song.db-journal
        • Size 512B
        • SHA256 398f7884350db15e05453ee89cf328d07f78d7b054935089edce53a117decf73
        • MD5 SHA1 SHA512

        song.db-shm

        • Path /data/data/com.jntx.retune/databases/song.db-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        song.db-wal

        • Path /data/data/com.jntx.retune/databases/song.db-wal
        • Size 209KB
        • SHA256 15b6f7780ab9c8963862a23bc01845aecd681c5421427ff13661998334b899d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        settings.preferences_pb.tmp

        • Path /data/data/com.jntx.retune/files/datastore/settings.preferences_pb.tmp
        • Size 563B
        • SHA256 7e3f3d48234df519e844aafe10dd01f0b7d683b5c7c549b855403fc4bb7ffe5b
        • MD5 SHA1 SHA512 TLSH

        settings.preferences_pb.tmp

        • Path /data/data/com.jntx.retune/files/datastore/settings.preferences_pb.tmp
        • Size 540B
        • SHA256 1eda2b15a3c36c4d52419fb45ae848c834a9403a723ae387a9f65f8cb655847b
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.jntx.retune/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 b5b9cf26bf038d5b9e13efb0bed59c12bc1a31659da68c32bda64c0f5853f718
        • MD5 SHA1 SHA512

        primary.prof

        • Path /data/misc/profiles/cur/0/com.jntx.retune/primary.prof
        • Size 7KB
        • SHA256 96876d0f4a8320d2d0b03f446f8bbb3df6575e5a92dab53e35da2e574c7c194d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.jntx.retune/primary.prof
        • Size 17KB
        • SHA256 24b8ddf91a4c167c51eff01435c79f98177f5b9692a35d0c321f31ca6d92d7e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.window.sidecar.jar

        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 12KB
        • SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
        • MD5 SHA1 SHA512 SSDEEP TLSH