Resubmissions
23/06/2026, 18:45
260623-xd5a6afw3x23/06/2026, 08:44
260623-knas3sbt9q23/06/2026, 08:15
260623-j5r81sbw9y823/06/2026, 07:58
260623-jvbtaaa16j8Analysis
- user interaction
yes - max time kernel
801s - max time network
1811s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
- submitted
23/06/2026, 07:58
General
- Target com.ionicframework.vznakomstve-302060.apk
- Size 67.4MB
- Sample260623-jvbtaaa16j
- SHA256 52519056338cba010ce77b0f273c4f7a9134987f483783465f7c6720bec147f2
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 17 IoCs
- Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 2 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ionicframework.vznakomstve1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ionicframework.vznakomstve/files/audience_network.dex --output-vdex-fd=140 --oat-fd=142 --oat-location=/data/user/0/com.ionicframework.vznakomstve/files/oat/x86/audience_network.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
com.ionicframework.vznakomstve:AppMetrica1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
GetStorage.bak
GetStorage.bak
GetStorage.gs
notify.mp3
0a2552221197fc33a2e50c98166d992cde6b662e.temp
1226c24988875d653d27b9a9cdae0c6b8cf13d50.temp
207580a65137e91853415c981b08bdc1cff0f3bb.temp
25511d7dfbcb15ba0bd125ff192bfd54433600c4.temp
2bbbb4beb4e5f32a1b49f4a93d65f13f30798ff8.temp
335d278417743125ac05dc26032e6cf4a19c0ace.temp
373a83ab33315421c445554a31b05a9e9122af19.temp
4b3466eb6258b3566bd284b34ece66422b44a490.temp
56e3df2fe882aaaa9440f61149da0f7efade2861.temp
5a551daf3d51192724478ed516c3602fe7474765.temp
5f5dd003eaa24005e7ab14db902f3efb7ca955ae.temp
5ffc79cf5681441fe86a3f18e8990894967d717c.temp
65e65fc318784441191590fe826a7ed3151c3e7b.temp
65f02243216342708c755dbdcbf41bb5ef761ec9.temp
6b6195ba1a69b3d10673e750c52f17f20834284e.temp
70d338766ae20514eca6f5d387445bc8d553f73f.temp
920aa0001cd58c560b80a4de9a32d38dad2e6ecf.temp
ae67dda6ab17be64e90251b8b5b579dc16e74891.temp
ba4b7dca38de1c153c531ea5faf5f62cdfbb1a67.temp
c2279a2a3e1ac049335a9fe18bce229d6f2b6f35.temp
cb091d8b9a57e5e0146eeaa1ddeea1b80f80f770.temp
d1e76c089834eb441d0b30fe79a43e0645f95b8f.temp
e1234e1ba0c3988004a1263cfe9750d4e17ef9a5.temp
efe321655a334a1d1a8a3def49c647d8f4de557d.temp
f17ec4e6286c3fb2ab7c368367a730d9712a1a4d.temp
f2557a1c67f824140f0291d468959a4e062a4f59.temp
f2e7e404f6ea2810caacb35fe02d076a7d3be67d.temp
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-shm
com.google.android.datatransport.events-wal
com.google.android.datatransport.events-wal
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db-journal
google_app_measurement_local.db-shm
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
PersistedInstallation1926923302814447665tmp
PersistedInstallation486791383659210790tmp
audience_network.dex
flutter_callback_cache.json
flutter_callback_cache.json
audience_network.dex.cur.prof
profileInstalled
profileinstaller_profileWrittenFor_lastUpdateTime.dat
temp294858409932316676json
androidx.work.workdb
androidx.work.workdb-journal
androidx.work.workdb-shm
androidx.work.workdb-wal
androidx.work.workdb-wal
androidx.work.workdb-wal
appmetrica_vital.dat
auto_inapp.db-wal
component_main.db
component_main.db-journal
service_main.db-journal
primary.prof
primary.prof
primary.prof
audience_network.dex
audience_network.dex