fc573f1fb518617cf1f525e0a498bcd86591765d48e87b131db25180d2c8b6aa

Analysis

max time kernel
149s
max time network
150s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
20/06/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Premium_Icons_v2.5_P.apk
Size 65.4MB
Sample260620-nt85lsfy51
SHA256 fc573f1fb518617cf1f525e0a498bcd86591765d48e87b131db25180d2c8b6aa
MD5 6ad30d24afb9252a30b40b7bab1b5bd6
SHA1 ac5865d3f3e56d525f6932adaac62159c646630f
SHA512 52738467269ce2b477114e5d597fd9e1ad836143d4a3ab53777fd0f27d7df08b54d1f11e1615a630cc0ad4c462b8b4785ed0ac9b3be44450cfba9a2c5885b74f
SSDEEP 1572864:QQ2IzzjZ1yVKGkqN+JWhH6+R1FoZBSdFjdxZCPcMA90cMlGJ2:QQnd1yVKGz+sHD1+ZBSf8PcMo2I2
TLSH
T1E7E72392D388EDA7D4F3A333423112A270AA0F7A9793D6995805F53C58F7ED68105FE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.maxpatchs.premium
/system/bin/su	com.maxpatchs.premium
/system/xbin/su	com.maxpatchs.premium
/data/local/bin/su	com.maxpatchs.premium
/system/sd/xbin/su	com.maxpatchs.premium
/data/local/xbin/su	com.maxpatchs.premium
/system/bin/failsafe/su	com.maxpatchs.premium
/data/local/su	com.maxpatchs.premium

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.maxpatchs.premium

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.maxpatchs.premium

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.maxpatchs.premium

com.maxpatchs.premium
1⤵
- Checks if the Android device is rooted.
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:5060

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eb8594c9f2de238ef63bd1b538680b1e02b8b478c03c74c34e3ec8beaf06aa53.0.tmp

Path /data/data/com.maxpatchs.premium/cache/image_manager_disk_cache/eb8594c9f2de238ef63bd1b538680b1e02b8b478c03c74c34e3ec8beaf06aa53.0.tmp
Size 6KB
SHA256 6fbaad545bbc7a29dd3f1c0d88f1c1db00ee1e9b1515ed16e5a76dffee6ae0b6
MD5 83b4dd7aab08f6803fd66b6835551e64
SHA1 465fe89e4354625a3c02569c6befa6be1526f0d1
SHA512 89cad1e6617a0971229969180474be900d7f34cb20f530edff0a496dd08ef1958fdb310a68fd47465748f866262519ef6495183a08852403f7694f3b74688ea7
SSDEEP 192:9jHzEcGFJBihJpBkIXX6iqvRoDdVbhK2l:9jzEcGshJrkIn6iqoDdVbhfl
TLSH
T1DCE16D2443B407C2F5317775AD944DE0E7C6792041CACBEFC9E507242B8DA886E8C5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

journal

Path /data/data/com.maxpatchs.premium/cache/image_manager_disk_cache/journal
Size 178B
SHA256 9fb26a4b799cff4c8350ad89ff3ea9c6a556bb62f982013331ba61291347d3b1
MD5 acec59cbe934b73e78dca51fd4f77787
SHA1 5e76ec0b5debd5d426daadc03f04bb1a295c63e9
SHA512 f24c1c9559c0cc293ba98a15034350adb16ca3c20afbbe2009a3f7f1aa89ff8fd0f89568098bf4c6a6903ae0fab3c18453ecaa2ce8f2923458593bc907bb6e2a
TLSH
T1F0C08CA8080E782CC7FE303BCC7D38C208B8127743C641C9E360B0E98A82A08C03AE01
MD5 SHA1 SHA512 TLSH

Submit Download

journal.tmp

Path /data/data/com.maxpatchs.premium/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

OneSignal.db

Path /data/data/com.maxpatchs.premium/databases/OneSignal.db
Size 52KB
SHA256 ab03de5564295f5ec34e2fccba9811cff818911b07798e9e456a58309deeb3a7
MD5 e1941e84ac2269c7b1b8bb7041b14001
SHA1 aed569ddb068a94e893702c297683c233d841f6f
SHA512 99124fc5347f6a7e19e0e30330c4e2f0f2d9074a0fc6a0ab7be25c5bd90d8dfdc66e8abeb1852be871dadb7a5945d7046d2e72ffb4f179c385ed7ffded33c2b7
SSDEEP 24:TLLSRZBUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvJqrEqjUix5+xGTrOPjwV+x:TeAcrA0oJxqrKcrObMoOS
TLSH
T11E338BCF4A862191EFC765B3155252E44E3B610E889317A63BF760245E83B16D72387C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.maxpatchs.premium/databases/OneSignal.db-journal
Size 512B
SHA256 d4d65fdb81b6bd1dde14b56b7331c49f62121c0cd3d2b907c7958a0b65a6bd28
MD5 55ff40d437a5ff433920952ea7537733
SHA1 63f78f153fae1aa109f0862609a490d0f4961e61
SHA512 0a06403448772f7defa23f89553d1fe668f853e362755cc3cfc7c076da4e6791648510052d32a5e1efbe0bffa077989adf41af2c341491cf923b4bedc4813448
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.maxpatchs.premium/databases/OneSignal.db-journal
Size 8KB
SHA256 1492742123adf6687098f35e9649456bc9034da0637283be45bea95d195c4ad8
MD5 c39aaeb4923c03c2b255b95d278cbd9a
SHA1 799c18770d21a6a65055e1a243da87e917c4441c
SHA512 105cc08ee99e660ba34967736c2b849ceacb708f273dc79d34fec6ae6034e6403334a4ebde574f03a099dd8e5649563765c76bee9002de9f41b78869cd3b7d2f
SSDEEP 6:7+/l9in9/mHn1sFkWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKqg:7+tonckqLiuWdwRmBEyPbbg
TLSH
T11D02228977840933C929A6BBA0DD83540D01E729C961CB07157008983C074CCA8A0E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.maxpatchs.premium/databases/OneSignal.db-journal
Size 8KB
SHA256 90ee8d0dc50aa1cd5fbfe62304c08863611f6aa9172e77d078b10446bbc45e86
MD5 fb95cbb40792f4d897e4741cca2050fd
SHA1 7b4277665a0da62d4ede9f0da2355140b27c822f
SHA512 26853d145f30c85f051e2315d99d103b1a7c1f1a2ef461c1505e862486c16f76f18b400a03665ea965cabe2bd7e872c72f89f8e6903c748f29d8ee6666b70b00
SSDEEP 6:7+/l9cygPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKks//B:7+tKqLJdTRmBEyPbKB
TLSH
T19102228967800833C51917B790C883802F90E71A8223CB8715A008B83C036CCA891D40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

candybar_database

Path /data/data/com.maxpatchs.premium/databases/candybar_database
Size 48KB
SHA256 48433ee5c20b949ca9745d95850a10edfe3a54b123fdf626aad0d6aec8a10ea2
MD5 988178efcb7ac2362d88fb8e9a648fce
SHA1 a3446eae918b03fa678ad5e7d4a1727a747729f9
SHA512 882e5ad9b0458873c9a99197a1a7367a5acad0418d13e6358f5b4409b42871aec11c7fbf2c47f3d9cfab17792332814a53e545eb82a20b084f3dd9bae9f35c7b
SSDEEP 48:T30Y0YIUY8oiFY8YIovc4ez0t5MOtmAVEcoQ5S:AY0YIUY0Y8Ye65HEv
TLSH
T1E123FE8FAB143614C9E40131CCE117B35DB8B75E2B100BE25AB030E9FDD5496C97582A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

candybar_database-journal

Path /data/data/com.maxpatchs.premium/databases/candybar_database-journal
Size 512B
SHA256 2cdf92ebb419f291b82833ad26422dc5721569d4958b9acc7d772a7171b6837e
MD5 ef6a27b4f47f0ce30010cc88af2deea3
SHA1 9674bc474e8df6099363dd79b517472d3be59429
SHA512 670678e37d495ac653201a9b6704b081969635c1b58bb985443724f3fae2ede3b823696a7ee0db6c9e3570a8d01e1a536c44a3c43b98b273da18e115277f4a10
MD5 SHA1 SHA512

Submit Download

candybar_database-journal

Path /data/data/com.maxpatchs.premium/databases/candybar_database-journal
Size 8KB
SHA256 a294e7ed09ca0b8ddeef484cfd6ec6e4ed1d04a978cea05fab2173b482e2d3da
MD5 7b20f9e176cb0dde8c6ca993724a5ec6
SHA1 6c33f1b79fb97eb991b6f9ae6abd928e30b417de
SHA512 f57f5694724c0d33676e9eff658d9987b286aba04facd94f7c4d3c65b73bea95cf9d47312818d7479815aa264485298db219b190c9fb287ebf17cd35180468a3
SSDEEP 6:7+/l9w9n1vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKc:7+t0qLiuWdwRmBEyPbv
TLSH
T17902C0CD63800923C81D5AB7A8D483400D01E71BED71CB171E6008D8FC074CCE4F0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

candybar_database-journal

Path /data/data/com.maxpatchs.premium/databases/candybar_database-journal
Size 8KB
SHA256 1c6f333f7ada1d6ae4b320d66e41ca7b8c991b23366045d5adea8ebb7893a56d
MD5 be54bb1e780f51956cd4590fe8918caa
SHA1 22ecc3898e7e57eb7f667f5fee48e37f3c2707dd
SHA512 8c3ba5d85be9c72b6a68d4787092fc5ac860cf0db141c1beb7a1ecae776be5d985944083d7f8a75c475cd96fdf59a6fa02647d1bf7c3c87f26c5be06ccbcd0b7
SSDEEP 6:7+/l9cFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK6vkt/P:7+tAqLJdTRmBEyPbv81P
TLSH
T1F20212D9EB410A13C51977BFA0DA83653E50AB1D87A3CB57156038987C46ACCE898D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.maxpatchs.premium/databases/com.google.android.datatransport.events
Size 56KB
SHA256 b033e6125a22a16f9276bdf7f5ee2f9a6c91c6ff8507f9c317ffefe7d74e4707
MD5 b72a8d7c18711c9b53a9c26b6c076ce0
SHA1 a1ea142475152117de7c47c3b647abc86533146b
SHA512 8fc70e861cf2611e61b0250604d3ce32777735ae70613520ee794d16c81651b3006da8c5e790753ae0e66bbe801cb6fafc9c3cced02a32fcab0856874116b3ae
SSDEEP 48:T2cg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSubVFH4FT:ihMEX0wIyNjaCW
TLSH
T1ED43619D1A3C2220C56E2C3ED3E243A31B7CD3DF4726936239948CF98DC20697825969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download