Overview

overview

8

Static

static

6

Captions f...ed.apk

android-13-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
  • submitted
    26/06/2026, 23:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Captions for Videos - SUBCAP v3.7.2 b241 arm64 9 _ed by youarefinished.apk
  • Size 77.4MB
  • Sample260626-3fefeaft4v
  • SHA256 02c079bfe59c0cd44af5c5c97aad6ff6e7c00480f7fd56323c7742b3abbb9e1c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
    defense_evasion
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Acquires the wake lock 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Checks the presence of a debugger
    defense_evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.ratel.subcap
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4265

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        identity.properties
        • Path /data/data/com.ratel.subcap/app_amplitude/com.ratel.subcap/$default_instance/analytics/identity.properties
        • Size 77B
        • SHA256 d69b3fe6b367b69935e6996bac024636e54a7d0ebd3b5c765bc7334a0d5f02d2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        identity.properties
        • Path /data/data/com.ratel.subcap/app_amplitude/com.ratel.subcap/$default_instance/analytics/identity.properties
        • Size 125B
        • SHA256 78cc959d4db827a000ff71f5df3744af73845e9fe911b385f2ed97502464b0b0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        019d25b2-93c0-7bd5-bb7a-9c6c9c871171.event
        • Path /data/data/com.ratel.subcap/cache/posthog-disk-queue/phc_L8gqEHMlbGO0CHSpvviSSAgqaDSr99oAxDMQAoh7PIV/019d25b2-93c0-7bd5-bb7a-9c6c9c871171.event
        • Size 944B
        • SHA256 3ef901736a7083871f7c22b22488aff429a35903c19220b59b92290731c079e6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        019d25b2-93ca-7ace-83d9-d44907a42aa5.event
        • Path /data/data/com.ratel.subcap/cache/posthog-disk-queue/phc_L8gqEHMlbGO0CHSpvviSSAgqaDSr99oAxDMQAoh7PIV/019d25b2-93ca-7ace-83d9-d44907a42aa5.event
        • Size 965B
        • SHA256 c5c378316fd3843b8f4000517b306b7c4f55fbfb1041898878ff4c5e8a207199
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        OneSignal.db
        • Path /data/data/com.ratel.subcap/databases/OneSignal.db
        • Size 52KB
        • SHA256 7f7082bb8f6b5a480de49608f5f702d01b31404a9a1aa5140011e97ea6180054
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OneSignal.db-journal
        • Path /data/data/com.ratel.subcap/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 147c35a4e9d2962c2f15d2775c0d289727acbbf2e89ba9fcdd9fd9b17309689a
        • MD5 SHA1 SHA512
        Submit Download

        OneSignal.db-journal
        • Path /data/data/com.ratel.subcap/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 6104d23d927310b5ace85951def1ea7bb3dff2da669e2b779dab68d11bf94bf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OneSignal.db-journal
        • Path /data/data/com.ratel.subcap/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 aa06a582c0021fa64e82efa885658a8628d5079ca29d40e45fa446db9337d1a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events
        • Path /data/data/com.ratel.subcap/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 9ac13cf3c55a41028325b37393c1e894b656603b0d9be522d86a0688504abee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.ratel.subcap/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 357de3cc236c87d054f184d177f75242be7e33abae73e281ea28ceb519ca451f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.ratel.subcap/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 c101f5eb2e4e9376f1f768c3a9b728a407d2260a245076a705b0c695d9b52bbc
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.ratel.subcap/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 43bbeeda81a7a52a62e8309a1658e9da94a1c28ac9a79909a7431a1fbd7b2e07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.ratel.subcap/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 ecf1f655348f5fa4b1f219097fd6b365225865921db68f537e65ece199615b53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.ratel.subcap/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2a340388f145288c8867ecda5c58991d8dd97363ac730d5a0251136491461a20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.ratel.subcap/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 eea84ba208b5116624ac32526db2696dc1fb7dd9369f1a05158a3613ba12ce69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.ratel.subcap/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 40737b57b30d30a2ea35be71e33205d58326203ef284eae4b55a1da44f1faba5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.ratel.subcap/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 7ca7a620f866a1c65f45830928c64ea11f7b6fd3594621d4263e93a809dd79d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.ratel.subcap/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 89220b9a3236a8317cf7e04624a8d30b9e1da0f8e98ff6007f2e3325a2e584fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.ratel.subcap/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 3be1e043c028cd237615f0a5c11c7ee55f6d4c5c9285120c3a94a4d3612af7a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.ratel.subcap/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 d05819090535bcea2de45d48c16c95ed440ccf9b017d886b92bb2e5ee17310b7
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.ratel.subcap/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 f754d770decaba90b2255a72ebf2be71c340bf50c8938e47c5ff833806b71665
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.ratel.subcap/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 2f0e92ad4cadc8070c4cf2ba112c6d493ad05c7f3b6c587583867aa4fc9b74cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.ratel.subcap/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 a9ff4dad1fe831ed70378ad2dafd4ce2bbc41639dfaac08ae4c30e1a2baa3a9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.ratel.subcap/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 f46786c9c995884f63e9674794334ce45ddcda3407f308b790ae498a919f0216
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.ratel.subcap/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 18815bccee386948d735f740a3edeb551d32a4dc980e14d9e9b20946a9c8a10d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.crashlytics.settings.json
        • Path /data/data/com.ratel.subcap/files/.crashlytics.v3/com.ratel.subcap/com.crashlytics.settings.json
        • Size 765B
        • SHA256 57fbe36b623b6d8e52c6b3e49f1fadcc05a81535fc39c81953be56e1f68e772d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        internal-keys
        • Path /data/data/com.ratel.subcap/files/.crashlytics.v3/com.ratel.subcap/open-sessions/6A3F0AE80100000110A9FD76E1B4B90E/internal-keys
        • Size 107B
        • SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        report
        • Path /data/data/com.ratel.subcap/files/.crashlytics.v3/com.ratel.subcap/open-sessions/6A3F0AE80100000110A9FD76E1B4B90E/report
        • Size 826B
        • SHA256 3ee319bb908291c5bb00a3b99c26096af399fae496e5044dabbb90490e420e40
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        userlog
        • Path /data/data/com.ratel.subcap/files/.crashlytics.v3/com.ratel.subcap/open-sessions/6A3F0AE80100000110A9FD76E1B4B90E/userlog
        • Size 88B
        • SHA256 63bd1b01078484e91cb6571a41a9cf52723de19fc90839ce02ad4d0980ad2b16
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        userlog.tmp
        • Path /data/data/com.ratel.subcap/files/.crashlytics.v3/com.ratel.subcap/open-sessions/6A3F0AE80100000110A9FD76E1B4B90E/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512
        Submit Download

        PersistedInstallation3760953183629840463tmp
        • Path /data/data/com.ratel.subcap/files/PersistedInstallation3760953183629840463tmp
        • Size 90B
        • SHA256 7ba6d959f94dc2a44f1dba39570f71db91b532c6e094a8c6fea2de90763c45b5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation6139646499761515134tmp
        • Path /data/data/com.ratel.subcap/files/PersistedInstallation6139646499761515134tmp
        • Size 568B
        • SHA256 5afd72bddb91229011a6c8ac740de77ca937f266a656381e5d8f71df8ecee762
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation6907981442005398141tmp
        • Path /data/data/com.ratel.subcap/files/PersistedInstallation6907981442005398141tmp
        • Size 90B
        • SHA256 8f9c89c87e0b8d68621ccf28bcdd4c323df42eafbff49237cc4683d5a538308e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation717467661216744594tmp
        • Path /data/data/com.ratel.subcap/files/PersistedInstallation717467661216744594tmp
        • Size 569B
        • SHA256 76ccb156a2e9f537c17e77c2f63e7faa36ac9f505b53ed78460d87644d4ab592
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FirebaseHeartBeatT05FU0lHTkFMX1NES19GQ01fQVBQX05BTUU+MTo3NTQ3OTU2MTQwNDI6YW5kcm9pZDpjNjgyYjgxNDRhOGRkNTJiYzFhZDYz.preferences_pb.tmp
        • Path /data/data/com.ratel.subcap/files/datastore/FirebaseHeartBeatT05FU0lHTkFMX1NES19GQ01fQVBQX05BTUU+MTo3NTQ3OTU2MTQwNDI6YW5kcm9pZDpjNjgyYjgxNDRhOGRkNTJiYzFhZDYz.preferences_pb.tmp
        • Size 658B
        • SHA256 f90e0950e6e4b141d6142a27160e78a0d505d58105de3d2bd7058a57ceb6676a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FirebaseHeartBeatT05FU0lHTkFMX1NES19GQ01fQVBQX05BTUU+MTo3NTQ3OTU2MTQwNDI6YW5kcm9pZDpjNjgyYjgxNDRhOGRkNTJiYzFhZDYz.preferences_pb.tmp
        • Path /data/data/com.ratel.subcap/files/datastore/FirebaseHeartBeatT05FU0lHTkFMX1NES19GQ01fQVBQX05BTUU+MTo3NTQ3OTU2MTQwNDI6YW5kcm9pZDpjNjgyYjgxNDRhOGRkNTJiYzFhZDYz.preferences_pb.tmp
        • Size 682B
        • SHA256 9709f7c484870c9c8204eef41f6740c9af53f072493b2f20392748b538b61f93
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FirebaseHeartBeatW0RFRkFVTFRd+MToyNDEzNzQ3MTM2OTE6YW5kcm9pZDoxY2Y2MDdmNjI3OGQxZDQ3NDk2Yzdl.preferences_pb.tmp
        • Path /data/data/com.ratel.subcap/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToyNDEzNzQ3MTM2OTE6YW5kcm9pZDoxY2Y2MDdmNjI3OGQxZDQ3NDk2Yzdl.preferences_pb.tmp
        • Size 658B
        • SHA256 cf76c1290717ed988d030475bdc9b668ccd1e18a510d11aa203f744f6d7124d9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FirebaseHeartBeatW0RFRkFVTFRd+MToyNDEzNzQ3MTM2OTE6YW5kcm9pZDoxY2Y2MDdmNjI3OGQxZDQ3NDk2Yzdl.preferences_pb.tmp
        • Path /data/data/com.ratel.subcap/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToyNDEzNzQ3MTM2OTE6YW5kcm9pZDoxY2Y2MDdmNjI3OGQxZDQ3NDk2Yzdl.preferences_pb.tmp
        • Size 682B
        • SHA256 54c4f3fc2b1890c417f7db934c6bf4b62c294ac7ccc15dec5e985975120e970a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sessionConfigsDataStore.data.tmp
        • Path /data/data/com.ratel.subcap/files/datastore/firebaseSessions/sessionConfigsDataStore.data.tmp
        • Size 145B
        • SHA256 944a465d3f56593df499a55c4e89ab3a798acf33949131022b36013648642fa7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sessionDataStore.data.tmp
        • Path /data/data/com.ratel.subcap/files/datastore/firebaseSessions/sessionDataStore.data.tmp
        • Size 276B
        • SHA256 080f6fd574fe98571c016b07ad66806e2d3b9c2cf55cce8f5e5e9ef4fe3e1589
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        frc_1:241374713691:android:1cf607f6278d1d47496c7e_firebase_defaults.json
        • Path /data/data/com.ratel.subcap/files/frc_1:241374713691:android:1cf607f6278d1d47496c7e_firebase_defaults.json
        • Size 154B
        • SHA256 afb4396e7436b889fb5f31e54de06a2cdb8c7f2d7fd1b01960a44c0878945fe7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        frc_1:241374713691:android:1cf607f6278d1d47496c7e_firebase_fetch.json
        • Path /data/data/com.ratel.subcap/files/frc_1:241374713691:android:1cf607f6278d1d47496c7e_firebase_fetch.json
        • Size 316B
        • SHA256 64987091839bca0c6355b1a5b78de79035d106dd5f189c8adda32726d655117c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb
        • Path /data/data/com.ratel.subcap/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/com.ratel.subcap/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 32e5ae123438ade1e9081b9fbec7449df1e3ee3747ae3624b9c158c32f23707a
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/com.ratel.subcap/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.ratel.subcap/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 e926cfeb40afc4546d79d4a48e3ad4bfc69ca43086ad2e3a1688bc0edbc87df6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.ratel.subcap/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 63b9db2a18990da92273aafdeed9b03f888ab91b5bb9f7f4c346fa8e0836ff5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.ratel.subcap/no_backup/androidx.work.workdb-wal
        • Size 193KB
        • SHA256 0d29c4afdbbac5dab6145784efc9026f4ef42bd26b293e12688c7812a2f7eb99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.window.extensions.jar
        • Path /system_ext/framework/androidx.window.extensions.jar
        • Size 123KB
        • SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        androidx.window.sidecar.jar
        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 25KB
        • SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download