188bbdb899be2da401ac0471ba4d10693612fa1067f2ea0987cc6e1afcfd4374

Analysis

user interaction
yes
max time kernel
302s
max time network
315s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
27/06/2026, 19:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kawendra-zpax.apk
Size 19.1MB
Sample260627-x8lsasc131
SHA256 188bbdb899be2da401ac0471ba4d10693612fa1067f2ea0987cc6e1afcfd4374
MD5 2725e9ae81839a4ae69f8f362fc4d7e1
SHA1 81833829fda154b743addf3572889d96f95fec22
SHA512 b0cb4de0115f9df055e03f78e18bb9c7e9e21e8006773caca342a086aa8a1d03a29620bd495d1dce1dc25ad847a061bc9b8cc3d3445937f25bc1491bf61df1df
SSDEEP 393216:nayGdcgSWrwYegLSs1TjD27YnM+kI5k5pY9mV+C+EiR8:nayGdSEwQn1P6YnN5kkmVWm
TLSH
T13717028BF32C942DD4B71572C855213266664E21DB06E79B281C3BECA8B3AF58F4C7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	cm.aptoide.pt
/system/xbin/su	cm.aptoide.pt

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cm.aptoide.pt

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	cm.aptoide.pt

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cm.aptoide.pt

Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cm.aptoide.pt

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cm.aptoide.pt

cm.aptoide.pt
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4255

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/cm.aptoide.pt/databases/com.google.android.datatransport.events
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/cm.aptoide.pt/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 b1b7b650cfa1f1b9cdc3d8a3fa78447e4ca03a85a61f4ceb27a2f4a560d23160
MD5 d705e82636360951c1a5837e144496bd
SHA1 b0cc6ede0a6720ff2eabea6d2e18dfb305aac2a7
SHA512 7c72e8089a2ac7c704d96c8dffb4b5be979b45d709f02629bfd817d5decde044a3a32137902a2eedbac9386dbfb30a495b1f541b4916b89e5f5a67965834e13e
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-shm

Path /data/data/cm.aptoide.pt/databases/com.google.android.datatransport.events-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-wal

Path /data/data/cm.aptoide.pt/databases/com.google.android.datatransport.events-wal
Size 68KB
SHA256 aad501a203ffa1f4060ccff53c63c7fdd1c5de31f968e6f71c725d91261cb75d
MD5 dfd34643607cca27ca65b8df12219df1
SHA1 736c74475e24a8297b221975b51a92c0c75a1b8e
SHA512 466c1a96ce64e50d5e19c5da43af11e551ec7a6ac9fe2749f6a3a1a0b64780cf78c577ba67c9b755fe28acf12e2e797ff85768d10a15eb5a2e9dec4d9873af42
SSDEEP 48:SBzNSP/0Ny31g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSP/I5Xet:SV0PrOMEX0wIyNjaPAU
TLSH
T1DE633E5D1E283A21C16DE43EC3E243635A7CA39F5313A2223A904CE98FC6028713195D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db
Size 16KB
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
SSDEEP 6:l9FCls1ulO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TgEu9zmzrfRmBEyPbBvOwk3
TLSH
T16772C2CE9F102647C6660377B4CAE3916DA4A12D872BEB472BA50464AE42609A861F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db
Size 16KB
SHA256 0ae42268585f14bdd2fe990e2d093312d38c7cb87d443a690a6d95b0c2bcf8a3
MD5 56717315c245d456fa42b2c9fe9fb3f1
SHA1 c01a1cfe5c7f12c1ec200d9ff6a5f52dce649458
SHA512 3114915bab9b4eb7eed86ab95a1d94ac31039fdb2f013d39acd7cc29d8f2e92a05a200c7ecd513d9c93986c5b3dea436d2c50e6b2af54b8fb6e1f2d79046f9a3
SSDEEP 3:qqb/NjghzY+/lzyliMlTXmJokzPQzMlklKllgIn:LCM+/lulvl6RPQQlrf
TLSH
T1D67292D23195C716E1278234928B87F21431A2903A0AC22A7901620C58912D01A1A616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db
Size 16KB
SHA256 bae126f17e6c03d7b845e709660041ffb8e226515a9c9b9645c0a6d213dd465c
MD5 0a70631451c6c470e20e087f36415cec
SHA1 336eb235da658b4379ba86d96c20ccbc6ee6a11f
SHA512 3f8be251af670c7cfa2dd80733956704f680e1e5c98fa79f86e61235f3cdc40f1db3a525e96c63fa57d9539eac8801527417240ef8ede5eae40b9d0eb69c6d64
SSDEEP 6:rLP/gEhV71m/9blDqlrElvlhVQlr2JhCM+/lulvl6RPQQlrf:rr/gW49blqYFlhuw/+/0Fl6tP7
TLSH
T1E972A7E23178C717F6378B3891CBD3D1303A72622B4BC2167D02BB0C18963D10A2A703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 f5c6f09ac3a38682d6c8a1942ba775b1ad9dc20d8feb0f3c043021bd36d89650
MD5 7cfc7c2ee88dc49e5fdb8e99f7850fc8
SHA1 df93f2f2213542db5a0109cb48f0fbfcb56f2fb5
SHA512 480be3e0a606fd2d3066137cfa847ada80dda961ed7951ea664c38269b0bbd2b688735a9ca26f1beb7f25d3c8c1752028aad4e28ae2cc0ce26f5abc4ac81dd66
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db-wal

Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db-wal
Size 36KB
SHA256 e89bf98918efc8257741f11a832a6f435f84b3cebc86b27da8497aeb57f493f5
MD5 f192833aef4187cbba6ec14c0765b407
SHA1 da38ace536218de0a82cc2bcb5691aabf1c2a3fc
SHA512 ad2dadb2a981aebff3a9061af96828972d31fcce36fbea40013e0e20a86bb70d2a3eccfe6347e198829efec109d0f60efd17b54a1a8e5d2d3ecd343553672119
SSDEEP 24:KoZKzyGSP/S1Q0REMzDGSP/1qpmzr0GSP/qR4Wk3:XKzNSP/S1QpMz6SP/1qArSP/v
TLSH
T119F22B99BB402953C1AD0376F0CAD3811D64A23F8367CF4717A14464BD8AE9CA4A1ECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-wal

Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db-wal
Size 4KB
SHA256 e8383d6a690aef3d9caff08b61640dffef586ca86a74eba0952cbb4234212851
MD5 00abd3409797445f540e8da18d4b8e39
SHA1 07f33353b8b46de3e34164cfb7b81798f5074c28
SHA512 18081c8e2991b9fdd3a517dd998db04895686d526f856d2333b4f6c2f6b97212ee8d9be5657a52c392781227841edd853cce71c3e025cd064e139ee5df7c57c6
SSDEEP 3:OlH/lUp+nip7Utl9+qttqb/NjghzY+/lzyliMlTXmJokzPQzMlklKllgIn:KGQip67tYCM+/lulvl6RPQQlrf
TLSH
T1AC8180913140C727D06752346147BBD1543472A03647C5173505A12E0C016B04925745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-wal

Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db-wal
Size 4KB
SHA256 74253bddf0b0872f7df3442dcc9f4660018ce61ec984df8e903e144c5301d478
MD5 84826ed63c315a0b57cf14530ffc4a23
SHA1 ccc1cef0aa6004b3cb474737a5c279a5baf6b2ea
SHA512 ae500e15ec9c3f8af064e5b6e5d00dc36e1abab0cd053739c9f7b6fa7c1e7f5662197b9f6838596de1aff908ceeec53904559dc39f9979e3db60aeb060bef2c0
SSDEEP 6:KoizdIP/gEhV71m/9blDqlrElvlhVQlr2JhCM+/lulvl6RPQQlrf:KoizI/gW49blqYFlhuw/+/0Fl6tP7
TLSH
T10881C2E13174CB26F2778A38919BD3C22039B2622B87C3193C027F0C58553E20A2A707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.crashlytics.settings.json

Path /data/data/cm.aptoide.pt/files/.com.google.firebase.crashlytics.files.v2:cm.aptoide.pt/com.crashlytics.settings.json
Size 762B
SHA256 9754f602d5f019874c593ae3c55c2801d9a2c061c5cc2a567c7ec2db02325caa
MD5 f52f1a50d27f0111c9616852d43a507e
SHA1 0e75bc8f4e27d965405e35a19dc04663142e0e0d
SHA512 b041703bd669d75666b313d7519fb35d697ddea8ebde6d2822bde1b242552e85a6dc7efa48185616f740fa2f7f58ea4ca3b926e7df16c3f78f93038d0dd7ac02
TLSH
T1F801906DE4C89CF540EBF519DB3477F21628483327595C68F5BC432851E79C09217963
MD5 SHA1 SHA512 TLSH

Submit Download

report

Path /data/data/cm.aptoide.pt/files/.com.google.firebase.crashlytics.files.v2:cm.aptoide.pt/open-sessions/6A4025A303BA0001109F5F74FFF868EB/report
Size 800B
SHA256 a9b374031ef1cd775b99db861f7f65dc980f0f7853e4979bbc6f0abc84a9ccf8
MD5 02e0581ff4f7ab570bc44e62da9b840f
SHA1 e4ffc184cb85832658be9fcba4e33a5dc8895553
SHA512 1763d3474430553d5186025cbb1d0d7537d87b07aa54d2ff242140ead2c604ce3a46a2b4d8866cd0a6e23b6db00be151e3cd1a0fbefb210a3957cbc170ffe689
TLSH
T17801FD598EB9267C034EE38AD281AEBBD3B807B8A706055C99C20025228FC5E93412BD
MD5 SHA1 SHA512 TLSH

Submit Download

userlog

Path /data/data/cm.aptoide.pt/files/.com.google.firebase.crashlytics.files.v2:cm.aptoide.pt/open-sessions/6A4025A303BA0001109F5F74FFF868EB/userlog
Size 88B
SHA256 08fc79a0217af7f89b82d4b4947793e21bd694aa50b1d5d9f5c26f939f1ff7cc
MD5 24b10d0ab645f4306d9e154d059d3ec8
SHA1 c60e3d7b7f0cd5c5d643745e38fc73d73c2acb25
SHA512 9653732a955f6bebfbd145f3c45c5b60202dc8d00c025749c9b22d27771f5429109854c5f9064d9a1f723a274a79c9bf1f0ab0accb67046d503fd62b53d69763
TLSH
T1D0B0244535404F30C004753004044F440145C0C135FCDD0745004C005F0741CFDFCD14
MD5 SHA1 SHA512 TLSH

Submit Download

userlog.tmp

Path /data/data/cm.aptoide.pt/files/.com.google.firebase.crashlytics.files.v2:cm.aptoide.pt/open-sessions/6A4025A303BA0001109F5F74FFF868EB/userlog.tmp
Size 16B
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
MD5 SHA1 SHA512

Submit Download

currentFile

Path /data/data/cm.aptoide.pt/files/.fstreaming/fInProgress/currentFile
Size 2KB
SHA256 529ed6323643f45f14dccad79e53fd3f46937df1d09453f48490ee0c065049f8
MD5 5703e39c3f568a1ec7384cd9f691b6e6
SHA1 68fe72ad78b522844f238312461f0f8d18282f0a
SHA512 f1e234698cac5f604120b286a37a6de62bff33949d1bd84a20ffb4f49b5856b2cec8a5f88306830170198d8c404f3ef657cd28dbbbd76a6401b976aafa23f322
TLSH
T11951BA2E7FA5CA77DA4C4B7A985459A3B77E8310B4485A4A63640BF173330EE301733A
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation819115924351183370tmp

Path /data/data/cm.aptoide.pt/files/PersistedInstallation819115924351183370tmp
Size 90B
SHA256 83ca6d2a1d8e8f117afb8f40c191b856bf6d9e5dfa9df361f8ffee182057c207
MD5 fea88385a9f75c30fc944fc4bd784ac4
SHA1 89f549403bef594ba0224d7eed67581c36562216
SHA512 966bb7ee96c39dae5b62fb1e17e247d4914b8a74a4439d1d73c6d5168d236fa81837aa998f260818a77ea3dc9a333b7091ed7889fcf3f76b85cb73466c403d24
TLSH
T1EAB0120457304361C689E3067D4CD1023D811881540B8F1A8A0CD080D0832D0F703AD8
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation9061929779097590061tmp

Path /data/data/cm.aptoide.pt/files/PersistedInstallation9061929779097590061tmp
Size 567B
SHA256 39eb49cd98f73e3cb1f75eef452a1c2e2d76f7b6067f2049b0374389fd2d72e4
MD5 bf039d27b95cf357b851d5cb0f2da0ba
SHA1 6918a23f6c71889f6ad2aef0aa2ba71a2e1818a1
SHA512 75ec4f18c150ae640bc88a8a571fe183d44837f0fe5e6a43911ed0e06e6c3079bd37e2d84660b06b2f1d5daf3f61ca4f066d67c6dfc43eb7b41718e8bf87bbe3
TLSH
T1B0F0E10E69114348D6ED3101155DEC00D9004979764784BDAE9A48FA7D95E16760F854
MD5 SHA1 SHA512 TLSH

Submit Download