Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    21/06/2026, 20:37

General

  • Target
    Synapse_X_Executor.apk
  • Size 42.8MB
  • Sample260621-zedwpsft2n
  • SHA256 404ad80eaf91010eafd7a105c035554d5564fadd829e26f07dd4e5f49820b010
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 8 IoCs
  • Checks Android system properties for emulator presence. 1 TTPs 7 IoCs
  • Checks Qemu related system properties. 1 TTPs 5 IoCs

    Checks for Android system properties related to Qemu for Emulator detection.

  • Loads dropped Dex/Jar 1 TTPs 21 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks memory information 2 TTPs 1 IoCs

Processes

  • ru.pravradost.andrey
    1⤵
    • Checks if the Android device is rooted.
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Checks memory information
    PID:4748
    • getprop
      2⤵
      • Checks Android system properties for emulator presence.
      • Checks Qemu related system properties.
      PID:4850

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        res.apk

        • Path /data/data/ru.pravradost.andrey/code_cache/res.apk
        • Size 33KB
        • SHA256 c0eacc4d209723c2f8b88dace12a3d03cf96934a608997d1ac2c40a0b5519d2d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        res10.apk

        • Path /data/data/ru.pravradost.andrey/code_cache/res10.apk
        • Size 93KB
        • SHA256 8561932fb36432e3e3edf1d984157156a98aadfd167d664ac112fc3e71b122d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        res11.apk

        • Path /data/data/ru.pravradost.andrey/code_cache/res11.apk
        • Size 316B
        • SHA256 0e5c4c7a6c98937352acf48380a3f7565076ab7f739d420304e1a0a374adac52
        • MD5 SHA1 SHA512 TLSH

        res12.apk

        • Path /data/data/ru.pravradost.andrey/code_cache/res12.apk
        • Size 419KB
        • SHA256 f826fef11000e95c084985d1c48043770f2d1cbf6b51d4dd3bc8cff25baec131
        • MD5 SHA1 SHA512 SSDEEP TLSH

        res13.apk

        • Path /data/data/ru.pravradost.andrey/code_cache/res13.apk
        • Size 88KB
        • SHA256 ab40c49941e8be5052777714d55031ede168f9fc72d19f1be86007e0edf76106
        • MD5 SHA1 SHA512 SSDEEP TLSH

        res14.apk

        • Path /data/data/ru.pravradost.andrey/code_cache/res14.apk
        • Size 447KB
        • SHA256 f41bc044e7fc5547083da741bf16853e8d0f464fbe3b703c07c991603317e694
        • MD5 SHA1 SHA512 SSDEEP TLSH

        res2.apk

        • Path /data/data/ru.pravradost.andrey/code_cache/res2.apk
        • Size 20KB
        • SHA256 b7f3834fc99e6e2ca2c39ad2427f2962598a46d773136ceb45d09e44deb282e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        res3.apk

        • Path /data/data/ru.pravradost.andrey/code_cache/res3.apk
        • Size 22B
        • SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
        • MD5 SHA1 SHA512

        res5.apk

        • Path /data/data/ru.pravradost.andrey/code_cache/res5.apk
        • Size 49KB
        • SHA256 9d1b958752eca5f0e21814b7a1de4584586e023d2ec8396db52369accc95b16b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        res6.apk

        • Path /data/data/ru.pravradost.andrey/code_cache/res6.apk
        • Size 27KB
        • SHA256 94336794359f087ea909787060778955f809c7a31dbb4486cf1cb414b75b2245
        • MD5 SHA1 SHA512 SSDEEP TLSH

        res7.apk

        • Path /data/data/ru.pravradost.andrey/code_cache/res7.apk
        • Size 202KB
        • SHA256 ab2818cf123952cd360a5775daa5a6024e35f4fb207c6a062b1b48d7ff86328e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        res8.apk

        • Path /data/data/ru.pravradost.andrey/code_cache/res8.apk
        • Size 395KB
        • SHA256 bba66c0a487de0877d5e7584a65da4944298da893e8d84b95e44a1a0b148b6d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        res9.apk

        • Path /data/data/ru.pravradost.andrey/code_cache/res9.apk
        • Size 495KB
        • SHA256 4f8230e3d3003bdfe20e03e46f45915c8611b2bc2fce45bc399a266e0d3b1c15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EZXhXSEcbb

        • Path /data/data/ru.pravradost.andrey/databases/EZXhXSEcbb
        • Size 16.9MB
        • SHA256 eadbbc4080d1b12e886fe4dcd26b5226f21811049e285e0627c3cd34fcbd842e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EZXhXSEcbb

        • Path /data/data/ru.pravradost.andrey/databases/EZXhXSEcbb
        • Size 16.9MB
        • SHA256 7fde25f4dfc5add9ccd8ef36743bda37bf64627e626fcc1ac2d1b24d44537938
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EZXhXSEcbb-journal

        • Path /data/data/ru.pravradost.andrey/databases/EZXhXSEcbb-journal
        • Size 4KB
        • SHA256 24929877c1a87cc03ed8cda876a1fe52914042be4609653ac9f11b4158f92f13
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EZXhXSEcbb-journal

        • Path /data/data/ru.pravradost.andrey/databases/EZXhXSEcbb-journal
        • Size 8KB
        • SHA256 7c6c66c0d8bcdfaac60c940f173915d65180104e396741cd8b36dedfd5440835
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aAlPmdt

        • Path /data/data/ru.pravradost.andrey/databases/aAlPmdt
        • Size 15.6MB
        • SHA256 9e8f9c095aaa98d73ab18418337f8031eb3b8f1e497f281291728ecfed000b40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cdat

        • Path /data/data/ru.pravradost.andrey/databases/cdat
        • Size 12KB
        • SHA256 8db2b7f175d63b082c12f01d2626e6965611b96a830b86641b7071b766d99581
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nZgaext

        • Path /data/data/ru.pravradost.andrey/databases/nZgaext
        • Size 1.3MB
        • SHA256 c5ed0b81dfa4aecb95bbd264991aa01dec11b70cd90ad754a10d755df0eee559
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pcJact

        • Path /data/data/ru.pravradost.andrey/databases/pcJact
        • Size 354B
        • SHA256 f2d86ec87f42e8f80fea0f58f4511cdfd40c86d27f5e8df2c306fd348e974316
        • MD5 SHA1 SHA512 TLSH
        • Path /data/data/ru.pravradost.andrey/oat/x86_64/[email protected]
        • Size 577B
        • SHA256 f7c505cb0f756a18191078df5d9ba34c8e03606f2c340d9556b8b9141d794a1c
        • MD5 SHA1 SHA512 TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 1.4MB
        • SHA256 8a5ad5180fb6f5e357188b3c5e9c95436e70f9dccd4f07a03eb444c7646ffd37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 1.4MB
        • SHA256 ae38c1d4de3560441d90a85c5813ac9dbd4078fa27d43c0082e30b29ce20a4f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 26KB
        • SHA256 c3914868edd673e112aef3f4d73d81b6b922eefe03b5fe8649e49c2246222fec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 1.9MB
        • SHA256 a8161c6f899e434c8c8be3794ea91e9a5147831d04018e23c5f30a0a2f1ac3ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 2.0MB
        • SHA256 1207e76ae8e7f8c3a413730a50d3c3ab7f66413d23c79f0a9a212339bc99dde5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 998KB
        • SHA256 438a97d3c7dbd944b534b2d6680089efc71f4f813163fd307c7c80a999542e45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 3.7MB
        • SHA256 50c1ad4bedd179b72145414b52c41983e3ebc52c4c831c9ef5236599005d5935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 4.9MB
        • SHA256 a95dafe245d6514230e77edcf6f4dc243664fd5124936054d56ba8bb84d4a6ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 3.2MB
        • SHA256 80b1718acd1ef3c3ce864df1cc49fb55ad934702d31b42c75a0145dc5e7e0ff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 4.4MB
        • SHA256 791d5821ddbdbe9e448d9fa0ff4ae9a51e79b9aba94fe3c0cfbc4c543da35d9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 403KB
        • SHA256 d64398c44a8990c6185583d323e4ccdae765aef21f104c3ebc8eff79ce4d137b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 3.1MB
        • SHA256 350a2bf9bf929697da4238be32b3d0bb76d4d1d2263c69c645774aa4e7f43c3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 180KB
        • SHA256 ef47172ebb8df8c9174663554691fc16df6e2469646f7079608e8d74a6c66100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 1.4MB
        • SHA256 68615a6efcef84164d4692876397587691fb4f2e94a9ceeda7ae415f81200444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 3.8MB
        • SHA256 4ccc44bdaf294ef3f9b9ecc78efd7255ea5c58c350daed3d5372287950d4dcb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 2.1MB
        • SHA256 db6b338739f1b757440594b6ba46043ec5d6fce49547a385ca0f411b533a6a83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/ru.pravradost.andrey/[email protected]
        • Size 8KB
        • SHA256 a06d71b6b9a2a489f28d72313429178956567f89d03ca528464662200457e43c
        • MD5 SHA1 SHA512 SSDEEP TLSH