f9c69912a37123398a2c2602fb6d1a5e1420cff4f2ff93b49da2d6dd30dc70d4

Analysis

user interaction
yes
max time kernel
89s
max time network
796s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
24/06/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pib-64-64.apk
Size 2.7MB
Sample260624-rvmvjscy7w
SHA256 f9c69912a37123398a2c2602fb6d1a5e1420cff4f2ff93b49da2d6dd30dc70d4
MD5 5bce260f47b2831a39a10562b1cc3334
SHA1 84b81137b890da015333ab5834e015bc22b41e9d
SHA512 66c4b7c04a727e373e3e46d923f15397a1f05be4c14258abc5d2bc455813cceb5d2b3896ed184e716cbda34ad9ec9db97aa946d2d44a58fc5b26f59f9489780b
SSDEEP 49152:+S99tfspNZyvGrovLfoPqAXpkxvNggrSJly1Z1B3xHyq:+S9Xf8oGMboLX6xKy1Z1B3xHyq
TLSH
T1C5D59D9EB748582FC0B7007A4C66A231174B6C1B7A439BB37568731C24B72D85F9EBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4907	it.eldavo.pib
/system_ext/framework/androidx.window.sidecar.jar	4907	it.eldavo.pib

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

it.eldavo.pib
1⤵
- Loads dropped Dex/Jar
PID:4907

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrity_events.db

Path /data/data/it.eldavo.pib/databases/integrity_events.db
Size 44KB
SHA256 29780657356e6530f760b02dc9182022219ef97cdca88f27f4aa853aeb1f53a5
MD5 ccd5a2399967d4d8c7ad0fa334c68c54
SHA1 9d324db87df8c4e22d7b3fbf4d8b6e2589d306bc
SHA512 e374874c6d2addf469464b4d6fcbd10a38c19de7b78b9f6ad06697970c0576e0680f1566af8d0c9760c1ce4a638c9804bbccb63033a297373878bee53e17fb0a
SSDEEP 48:TzLKAuFxHMKbQuYJG9ZSbBOX1MC3H+vLTLLa+nKySS:f3/BaHo
TLSH
T19C13BDCA4BA42202C95C543F8A720123777C18EE6E522FA631140DA64FCE40CE4F07FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

integrity_events.db-journal

Path /data/data/it.eldavo.pib/databases/integrity_events.db-journal
Size 512B
SHA256 208380e7803384fdf7934bb78f058b14a6160c87c89f2ea3c4395cc507195df6
MD5 a6dedcf368488a8792955008e60f008c
SHA1 3cae42101c2097e4fb1300cf8b4282dfb0ba0b92
SHA512 b950d2ccc4fb2d943e587d4ea33a4071334782c99d51cb93adc13012a3941052028e062db2ab4ee008f93069d2a103457e89d26cf923ad0aa98b4cb83d026cda
MD5 SHA1 SHA512

Submit Download

integrity_events.db-journal

Path /data/data/it.eldavo.pib/databases/integrity_events.db-journal
Size 8KB
SHA256 9ccc73480bcdbb743e50fff2d4863a9f5945a410ed4960eb19c55542b44c4f75
MD5 81d608d1c70dc38ae62b3e8d40992355
SHA1 ef594b06121fc21a886a880fb01df6263e66d6c5
SHA512 aec82df4c74b20ff025c55e103e441831aeb4e3dd83b90187d8bfd51840b32a577dfb5ba96c6ec86be5f953564906fa10ada06fe0d0167781f51166dfd585462
SSDEEP 6:7+/l9MmlFn1Cf/kWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKyy:7+t6m6nqLiuWdYRmBEyPbDy
TLSH
T15502C0CC63800813CD2D16BB94D583A00D00E7288171CBFB1B9008A43C074CCE4A0D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

integrity_events.db-journal

Path /data/data/it.eldavo.pib/databases/integrity_events.db-journal
Size 8KB
SHA256 d55fca3288180e4918928afc244ab2c066faca0bda033856e034d0696b17e1b3
MD5 6291064fca0780aabcb0fb73d73546c5
SHA1 c13c1664c94f5f1c3556e75e81c2ac09e900ae5a
SHA512 4e679cfa8a433b02af99e73ee5de740aa8cdafc31ae2737dfdec56e08595ea6253abc6ed600aaf8cea54dab8f585495e194cc075e24fa4c22e1474b53f91f925
SSDEEP 6:7+/l96NOPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK1VM/Yn:7+t0NiqLJdeWRmBEyPbSVsYn
TLSH
T18402228C63801803C02D1777A0E883482E20A72DA323CB07369108543C066CCB890E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path /data/data/it.eldavo.pib/files/config.json
Size 760B
SHA256 737f816e7b1e4dec9196c169248466a409049013bbc6f76afe392084e661e6f3
MD5 45b7a042bd258059f404d498c985790f
SHA1 972ccda70f4e19cc9a8ebf9db25ef4c57c525274
SHA512 87da4f8f704a245865cb612486a01165b9a964af5088a5c4a4d30b96317e6866a2f51f75c490d7f997b752fa2677507622020ca6bfb72929f0fb7718b56ee51a
TLSH
T16B01C0456B5494B96D27C77AC2B2EA0117B89C3720843058FDEDC20E6BEFC8A3165A07
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path /data/data/it.eldavo.pib/files/config.json
Size 795B
SHA256 00c6078a4426b73bd0bb1038175a91cab54cffd0d095454f194d9798aa1255c1
MD5 0cc834a3d3ff2997da48c8ada2c605b9
SHA1 055daaf64efd65c9d9ec0943435f50d38bbcd8b9
SHA512 bc946816d3b78573903adb06bd63e831eb8c4b52ad89dda71a3cc213a9de0b4ce6b4b747793820dba4b8a100a4d15909babd6a449c03bb4ea185629b62df52bd
TLSH
T18901BD41675464B96D2AC77A82B2EE1117785C3750813008FDEDC20E6BEF85A3055503
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path /data/data/it.eldavo.pib/files/config.json
Size 866B
SHA256 081c5b75993f6605b20d9fa3e08adb83f9dc11a7437dd58b0677cd3560ca836a
MD5 0b83065b4f3b0e65c0eb8ca9f7af56e6
SHA1 c7065b63e03319186597ec8f5acbd2fa91e16905
SHA512 fe219b39d414713834d820100e9fb7c452bd9d36a7273f552d2f67ec3f5a80a08a04bd25e22f8793cf2785f301ef5a835872e4447f43f24191ea029a5f8d0dea
TLSH
T13911C251772494B66D2EC7768272EE011B785D3250843088F9EEC21E6FEFC593055D43
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/it.eldavo.pib/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 3d68e663cbadba4088eff89a2d38c3cdea00360726d0fe227f0820fbec8c2d9e
MD5 ab70b453458d9f7e65e7a8708b434598
SHA1 40eb256ecf588d9ad8d388f48006d3c67bf62168
SHA512 263f0624dc7abc88efba92e2290ee1aac9c0cb633ee1aa13cc3d4599c57f6b995910b2205cb260a6c0c136ce5576c3084c7c8d84b510e2d7d07bbbfabda50cd1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/it.eldavo.pib/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/it.eldavo.pib/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 73ae79c60776691820b06183bdb192a785376df4daaac321f483663d2faea6b5
MD5 5bd2c80b459ead7ea9db194a6f8a7844
SHA1 7973017a9fdad812f597dbafba9d63af33359c70
SHA512 be0e364f039b7d2d0118fcdf63f8d9c730d86c30849271b70a7db620c70d3990aa9c2af3624dd13305937809e4049579ff860c853820001113a1ffb80d6e0b2e
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/it.eldavo.pib/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/it.eldavo.pib/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 f311f5830a5d8f3decb4d3ca5a94d05bfbf946c6fa166e5d63788dcfb6e8b4a9
MD5 66ce7dc285928f1a9c47cd59337f77c4
SHA1 87af3bdd9469f5c56aadaa476b5a8b0c68ce73ec
SHA512 f66d906e33bc3a8c9c66167c95825d828f30417f926de68920badf276a3cfa03851cc13bb7889ed95825ae19cf544ea0a99017d1d9c5563e9a98eeb074073432
SSDEEP 96:O8PlpoWFtpvv6+OtidjnZRWzzb8/KeKcK+zSvKz+XD86u0ExV:hxFtpvktidjnfWzzb83zSU+XD86u0ED
TLSH
T197C3229D0F682601C09954B3D9F10BA1793E812F9393E3DB769100F6ADC3921DA29CF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/it.eldavo.pib/primary.prof
Size 2KB
SHA256 dda3225afa17989fd38c05eaeb4043ec614335a2e9d7a86338bd862d6c737432
MD5 5db8bfd2ebb294e10b74fe1b8119cec4
SHA1 3de898b36b6e124a861b4b1a4abb0933fa1981ec
SHA512 52c6d6211ac1797e696ae60fbdad36fd0ae6f15b31733018ba597689bb04998e88fcad201f85c7ccde09bbe7040a9bcb1be042e9f935c6db5b5ed16982a6bd6f
TLSH
T1994119FCE160DD4DB2173BE69DD2BAA126920010598029399A348F7879329B1E00FA4F
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/it.eldavo.pib/primary.prof
Size 5KB
SHA256 c5083e00d02b1bdd9af9374018ccf00ee27f18ddd006243cb7886c5f593ac2cb
MD5 750215bccd4b1ee84e81ffbbaecdf50a
SHA1 f60d6b2e1fe574ac18cf7cb06981456708b2b587
SHA512 5eefa9bbd0d16a7c6a0f56ec8b3e1e06c259a8af26ed62a5cba0ecc489e57e0719a69d83fb6d30e0a91c2a6c95b283cf6b222e90d665c9e6515b37e97512eb21
SSDEEP 96:pcrs/SvDafpMPZ9qQtgv4immwJyVAV2ryjjerynC5u0:pcY/xpWu8VxV2ryf66C5u0
TLSH
T117B1AE0822199D0A407A33FBF4F34E61D4DE5002AB7126673A5E1536AA779AB14F8E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads