77935c53abc04610efe21b4fe2527f46d9bdfd884c61973f6483396797be84a2

Analysis

max time kernel
149s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
23/06/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SokaMax.apk
Size 21.6MB
Sample260623-pg3bzacy71
SHA256 77935c53abc04610efe21b4fe2527f46d9bdfd884c61973f6483396797be84a2
MD5 4946ae0a2c58cbf428f731352def4723
SHA1 447eb38812c0b88479cb783487cec61170e4b3e8
SHA512 dd5f03850afde95443dd65193beb7d05d2d62dff1aab0c00670242d6c55c79968a330e4a5f30030789897c91512cf6cde4be6e855075d80e00dcb2881682adb6
SSDEEP 393216:/dFl3+35Posupth8opizzSU9SnqXQJnhJK2oYl44T8dT6PzFXnvWvXYAOcDZYX8o:1fCPFuLizzR9TXShQ2ZMT6PzZnvSJDG1
TLSH
T1E937228EF7649A2EC87700B20C5A523122674D22B78297F7A97C335938776E40F5DBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.soka.max
/system/bin/failsafe/su	com.soka.max
/data/local/su	com.soka.max
/sbin/su	com.soka.max
/system/bin/su	com.soka.max
/data/local/xbin/su	com.soka.max
/data/local/bin/su	com.soka.max
/system/sd/xbin/su	com.soka.max

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.soka.max

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.soka.max

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.soka.max

com.soka.max
1⤵
- Checks if the Android device is rooted.
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4754

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db

Path /data/data/com.soka.max/databases/OneSignal.db
Size 52KB
SHA256 491c9687657ca71661a5cf42a763249f88fa222edaef20eaf552c4599458f99e
MD5 f1427539ecc4cedfa892efc1776ba3ed
SHA1 814607670e99768ae6212224860b0a1fb93733db
SHA512 c3ebbf63c4e876e471848f810e7ad7c0cb56a946230073b5196f7b3ce5d1f144c800ec5787992ff2ee057f712d7c7f1b92b47761294aede13183c796e5ab043d
SSDEEP 24:TLLS57ZBUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvJqrEqjUix5+xGTrOPjwVw:TE7AcrA0oJxqrKcrObMoOS
TLSH
T194338BCF4B862191EFC765B3155252E44E3B610E889317A63BF760245E83B16D72387C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.soka.max/databases/OneSignal.db-journal
Size 512B
SHA256 92071505384aebc6d4b08a19832b7adef1625a5d129ad9fc33a9ad5589b59fdc
MD5 3e8d9511f1a613b5acf8407f7772bab1
SHA1 9cde04162786b6088ed96122cc163dd6ac43a5c0
SHA512 9b9af23d3b151819b83eef67ed587eeefc59d744350f61555570c170f44e24453b790d047025f3a3fbf20b963faf6ef2101699f22c987651b5aec42278c2b2ff
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.soka.max/databases/OneSignal.db-journal
Size 8KB
SHA256 8d8bffd4c3e238bd339f60a0b2c8c94b9c7de064db5a60903475994360913915
MD5 4b8bb7215e52c1aa41486002225446ef
SHA1 4e980d310638066b1bf3ebbffc02f88db7ed39d6
SHA512 6418e56d77d2a7f811e5a4a8c1cbbf98ec6c29f5ba0ee116cd48762c9413e16d956d49dd54ab1f0dfada092e1e4c09d700dac06918daeb4affa89256738d540a
SSDEEP 6:7+/l9rsOn16IslXvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKp:7+taosxvqLiuWdYRmBEyPby
TLSH
T1BA022288E3800812C83A96F798D483501D50E7398171CF5726A008983C0B8CCA8A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.soka.max/databases/OneSignal.db-journal
Size 8KB
SHA256 17ba6168bbe469480cbf34172e5af4476a5401d899ae2149a22430a49683e02b
MD5 8b167adfd0a43c262a22d3ba12fff5d7
SHA1 b644c60e89b09f4519081f8612d2dc07355cfc15
SHA512 b5a54c04726ed3ff8d8f5142fc39985fa85eb0e6c1dbc53412d8d39d829a88e76d0f0b56c7b98de97bf5b9fe2d47a1728b8dbb27f2fcdaa1fee3d3b4a395b0da
SSDEEP 6:7+/l9/FPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKg0lvkt/u:7+tBBqLJdeWRmBEyPbjJu
TLSH
T13A02C09877410803C12D1777A0E883401E10A7289733CB0B97B208B43C0B7CCEC90E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.soka.max/databases/com.google.android.datatransport.events
Size 56KB
SHA256 7d25d6082b12af4c66894d8394819f498f14f5bfbdd6229cdafec28a4fa9249b
MD5 90f8e8eddb2e61540cc5aa5fa5caf161
SHA1 8eea243aad831a44f5a310af561e197a3065e3b0
SHA512 e1b7f38bce09ba189ae3a25bd058c2bccda0d6c42488b99c546850d7f0349c33f50bd148a9875472c49f9b597811683cc8dd4cb28d786a21ddcbf2fb3bd4ee21
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPS4:rAMEX0wIyNja4
TLSH
T1CA43839D1A3C2220C97E283ED7E143635B3C93DF172392223E908CF98DC206974354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.soka.max/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 ad4e6bccca33bd1400a33f1c609a51685b8679d536497c9ab1f6c9733aee4608
MD5 46d2f9574b9c398bea871b0497e4f6f6
SHA1 99ce5c4be0bf3b43307effe8c92c3e979117e60a
SHA512 60a0447905f759bdf672de8ad34acfb6fb952c3605cfa6033e086d545a87d786a0b54fbcac14d77613ac79fc1cef255a753c4b5f51b37c5fd3a174a911b8f5d6
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.soka.max/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 9da7ff0769f3ab55a23e1913579a549b6b220af38468112d367481c6d0e7e079
MD5 af0ee5960b39b0cf3a964cdc98f8090f
SHA1 4767db07ff6a94f13608c52c4f3c2d22a7185f38
SHA512 fd88a7816ef0d9fd19702c213426e22e11ce6ef5eecf6f38135f424da6df28af4ad7902eaf9bbcbc6aa30e5680c6cab97d487614aa1b211b4e03dc452d585510
SSDEEP 6:7+/l97n1gg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKnJ:7+tQqLiuWdYRmBEyPb6J
TLSH
T1C202228E63800822C82A1677A8D583400D20E72A816ACB172EA008E92C078CCA4A0D5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.soka.max/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 0427e045b43213995e46e37201de40750ee04297d5f0537a41313fbe40f8bfb6
MD5 84267d1d95666731fda2ae9cebe35335
SHA1 3cff2fa9dd861a6b84f5d43389ecc414c7f887dd
SHA512 1de48a9dcf60679667279f0737348876365fe84077bbf0c3fc05db2ae5b2df83e7cd7f08ac025e81ddc5272151b3a1ae851a86ecadde736eb5b3ea4989217aa2
SSDEEP 6:7+/l9tj4Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK2Zy//P:7+tEqLJdeWRmBEyPbHoP
TLSH
T1D00212CA67410A13C5295777A0D993651E24A73A9263CB573AA208946C8AADCA890D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation1507142516253125677tmp

Path /data/data/com.soka.max/files/PersistedInstallation1507142516253125677tmp
Size 90B
SHA256 d907d8c445c1a816feae30788dffdcc5ef1a65ddb50adae0e6ea951b0f5387be
MD5 6e0e935784c53b16ebb7b4e48bc88b93
SHA1 459d44532a073b4d312a20c709ed30f82faf8714
SHA512 298c3b408f17ab2c07cdc1fa82ca492191f6f13b17438df6d16714abc23a9ae542cc7e56b8e313eeb9c230eced494b337ffaa2bee9308a6bfed8d83437ce1eb3
TLSH
T13EB01294CA714181CC89F30B1C4D91012D84144105098A158B08B08080C31D393C3998
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation265410941133320249tmp

Path /data/data/com.soka.max/files/PersistedInstallation265410941133320249tmp
Size 568B
SHA256 a43d99444da32a189422e961993e4f362410c4300dd35e519764ac87871988ca
MD5 3a1888fec64a59e3979312535113003f
SHA1 5903715a5c2e36fcd879dd3a7f333640eddfd26b
SHA512 04b5d8a34a4e892ab556d8cffc49b45a23f9dc8c08622fa6958cb5d04ab96b8ca78c3e002dd4132f5218af3877d2732d8e1c9af11d8293a6f41146c7464c6798
TLSH
T154F0418C87E14824E4059B4A20066C538C8400A2434A0DE8FED6489088E629F729A088
MD5 SHA1 SHA512 TLSH

Submit Download

device_preferences.preferences_pb.tmp

Path /data/data/com.soka.max/files/datastore/device_preferences.preferences_pb.tmp
Size 85B
SHA256 949a647d0d015a68c7a2882fc167bd8727199a443ff41c51fa20ad6eebbd5bb2
MD5 b8e666d82154c4bf26a4e043a2c6c5e5
SHA1 7e64692ced3f9b1afeffa6df5d82e59e94fb59dd
SHA512 855519899cb155e5bcab670afa7b431dc7b7d9a4932e6c6af5f48385f1fb8285748b38a88a2eaefa914c942427530478cba57db908c8d4418a76d8587679507c
TLSH
T1D4A01204688A00E1645390902C308515880B3102A105AC9C0000C5A08E0153C092C082
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.soka.max/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 75c533af628dc805b7ecd85568b076f38a2f8dfa2efce5bfa43541f5fc3f508d
MD5 d32223a023a66244ffdeb78d19389142
SHA1 d473b19c395b422f6690a13d303f7bda6019bfb8
SHA512 e53781bf62895251d17d3939771f7e048cf03feedbbb5c5a39c4e2bf87de9d77b926f823ad7a39bafa455ddf6973bd66a88a65cf7cd2520cd38dad06b5f8d3c7
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.soka.max/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.soka.max/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 8fe421cb20a261302b813cfc443d6f5588dc796ded039effb4cfdd72e077b1e9
MD5 fd93eb492afa208cdd548a41b36892f7
SHA1 260388982ddce87532edcc553bb0e3dc5e219b7d
SHA512 faaede72fa03bf727d145fb043d842dc569deda3a3bf5bf52a7cbf24a9bc510310505ba766c488b1d32b652f235dd6b93feb2eec8206033277542e55ee906376
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.soka.max/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.soka.max/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 c43bdc2292691d654c32afae4f0740880b191208116075170d61ad909bec6e43
MD5 d17521b8fc9cfb98861209151912d79c
SHA1 a2fe72af82165d6a0fc5584e75af442afcb809c5
SHA512 59485a4b2a2b49664e55239050de2fd06f4afed84e2d83d39aefb75fd18de2a3487ea99299e3c9c271cf614cdb4c736efe1608c0f6123fc5eb8008836d2cf8c3
SSDEEP 96:+j1XjfWsDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:u7VndjnHt9S/f8JzSV+6D86T0ED
TLSH
T1C9B3238D0F9D2B01C0A964F0E6E10FB2793E416ED393E3D7A5914075ADD2921DE29CF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.soka.max/no_backup/androidx.work.workdb-wal
Size 193KB
SHA256 4cecdad47eb0f902d4dd15c231b7b3957236090af57c0d405cccea008c231972
MD5 331192186d17f1a6ae45b31dcbd4c8c5
SHA1 34c1f07f203e9fa1edc918b366569f2b709f26c6
SHA512 79675e840c1e2cc6827f569535fc7f238ea4bf9f5c9cb97bad99ece3d700b3203c2ee256d1f9542febc83495229e3cdf541dce48f20b5f27f3ba5fff89c3bbbc
SSDEEP 192:71DtY9lEwkKv6P1DtYBZY1DtYBh1DtYB:71DtYbEwkKSP1DtYQ1DtY/1DtY
TLSH
T13114AEDA733F5A22FF0B013BE9F380B315B709E96B9315C2D6AADA145486104C73BB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.soka.max/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 8f31c0d73c9602186245cc78fe50ef3990057a715e2de4fea0b65cf65b7160bc
MD5 812539c8db186179a87b5bc7e384c5f9
SHA1 313cc59655f502940193d957900588d6fb6263df
SHA512 6e53c19f45d4b80d2c96600419e5f090559712299e97fc28582d3e52c3c29ae34cf26ee97fc59855a6dcf208cb08819d40d4877e99fb06dac7b549ce25c5f06f
SSDEEP 6:KKKyB+KyrJ0v9FZde/kPlOERX4PBX4ogLugMBX4suuK+/wKyatuFPVKOw2:KKKyBHyrIzdeWRmBEyPbP/wKya2KOw2
TLSH
T13572C28593802F43D5180676D1E7C3521D72979AE253CBCB9A914C216C067889990EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.soka.max/primary.prof
Size 12KB
SHA256 62cc4b1a013040ff7346cfcafd41bfc1483010d7e24e308ccae713d3cc1df4a3
MD5 78d28c07d484e39c169677b41789f5b4
SHA1 f8f916f83d3bff15667d6e209381dc4d37b26b76
SHA512 49b0a1e314a3fa641b3752b7acf0b6354f9c6231125188b2d03351a0cf1c8b27a1070760cf5b79639648218923b46b47f091665b4a79d1397b2861291f2cdd27
SSDEEP 192:or9tnENrPMJtzfVIa6KhjBfmt/fkWaQxYCFl9/Wcv1VA4LfY19xk:onENbM9IaFRBfmJfnaQx/9Ocv11w9q
TLSH
T1FC429E0F9D7A7D4EEED97F08C2F7679513B14871C294008A2252C646B5C269FB7B3153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.soka.max/primary.prof
Size 26KB
SHA256 5ce8a8eab960ec56efa9c416ba92d2bc3c64e440391059a9fb3d1bcf0596aad1
MD5 72fdba039cfb922cf3da374382715ae1
SHA1 6a8b5672cbf0061a5e0d2840b13c0d2194e10b66
SHA512 3ddb8485f0f982729b41770cf04a1ddca78f13e4aaaed681d66e555c0768ccae74f29be1344f9b3d25ed450a1283120d0e31a0ab06010a18d47675d4e4cca32a
SSDEEP 384:xptZTBvkxVeuD/iK5UMuu9PNL2xf0AEbLR/FzDELGTSkp5xibmWU0G+Edwr7Ss7p:xpf+KuLOlANFzySnr0Gw17CMWcAIIm7
TLSH
T158C2E247B4BAA306AE9FF6997C4440B5BDAE84651E6E7368486D1F8CFE514433C0148E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads