3e37908ab180f4b6199973ee088d1eca58c4de2914f00149fbcf2d66d2a75271

Analysis

max time kernel
149s
max time network
155s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
28/06/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FireRing.apk
Size 20.2MB
Sample260628-pc33psg15q
SHA256 3e37908ab180f4b6199973ee088d1eca58c4de2914f00149fbcf2d66d2a75271
MD5 4f6574def98206ee507001e7f3bcb1a9
SHA1 b12f078427f466caedec46f7b53cfb29bfdb36f9
SHA512 e458aeddceb1c3301ee8c77c84692d9f62d5df1de464fc129a59b7edaeca71a0a3b270a420e4afe37dd2eb84856eb19de6857315416c5abc81eca19690215f0c
SSDEEP 393216:/ceZhH5T2cMVbJ+CQgws+vdra1ueCAFgWBoYsVaA2C73Oh4RSqNvN6y/BPGXWM:U6H56lxyjrez3BoYsgA2bh4RSqNvN6yw
TLSH
T17C2722C7F7289E2ED8B315724C5E53366A2A4D11C743A3476A44372D3877AE80F897E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/bin/failsafe/su	com.app.firering
/data/local/bin/su	com.app.firering
/data/local/su	com.app.firering
/sbin/su	com.app.firering
/system/bin/su	com.app.firering
/system/xbin/su	com.app.firering
/data/local/xbin/su	com.app.firering
/system/sd/xbin/su	com.app.firering

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.app.firering

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.app.firering

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.app.firering

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.app.firering

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.app.firering

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.app.firering

com.app.firering
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5062

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

CFPGCore

Path /data/data/com.app.firering/databases/CFPGCore
Size 28KB
SHA256 a4feccd5666316055adf7c7612df476c210b78e0f65225a87edc5dbeb04aa673
MD5 ef9650627a35f169c276082cd6c9ae61
SHA1 c8a9cec5ae5e3b2a0026d225bb1cfa63dfe5820b
SHA512 1edcbfba742311ddff823b98be6eb263d68da584038875aa3fde86224f1af2b84cbe08d4f0dad3f8552a541743a2ff1b8ef1ecf8d87a3eba53a9a7802ebc0248
SSDEEP 24:TLP+sig0EZFib3FTilviiMN8gZ6GSiIQ:TzjGTsqlS
TLSH
T1EED2E0DE8F103752D1E61070D89023E31E3CAF2D9B4D67DB479444F7B8812766621938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.app.firering/databases/CFPGCore-journal
Size 8KB
SHA256 518d542153d58caf936984b94171e8c5ff14a2ef10bd0e69686df4abb675475c
MD5 7b05dc5e7b9c7b6069b9b6151bc27b3d
SHA1 d7b5fc1ccd2011c41ab74769f85dd3c0f9281e74
SHA512 1df1438b7d2ea48995e5f4a834b0787f7075b6ec7a1bd456dab51dc2f8e50befd22a500795595b7677197664b1d8aec47891c209e7ac63d221917918f3d941e4
SSDEEP 6:7+/l9uClGn1lg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKut:7+t0C4qLiuWdwRmBEyPbft
TLSH
T19402C08E63800C23C81D36B7D0D483400D08E719C273CF17256008D83C438CCE4E0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.app.firering/databases/CFPGCore-journal
Size 8KB
SHA256 e919f7938507ec9b7dda31eb4309303f17028460da005ef128b3672968d9135d
MD5 6ac7d9d446bf6fe67b76b79898a0de6a
SHA1 cb809ecba35a0b7298f1bb7a69cb6ff78ebe6e8f
SHA512 7eefd54d4567bfd79f7c5c9e8ece837cc06e9f57bd3830497cd82bb86cd427ac9fad5b7b3ba2b7beaee3687914ce1b85cf37046fae94fb19885c0e01921ae302
SSDEEP 6:7+/l9dWPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKwU/Fn:7+tyqLJdTRmBEyPbyFn
TLSH
T19702228963420813C01917B790C8C3802E20B714D2A3CB47156008987C037CCA891D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.app.firering/databases/CFPGCore-journal
Size 12KB
SHA256 4c481e5f89ad1fb2e5e6654054d9933f588e43c955a156837e9423991b4542d0
MD5 8672faed09fc7c8dbaa588203e3a99e0
SHA1 aa943e6bfa7eecb9b4a372fd4d3d9f9fd629454e
SHA512 de46aa7c20de889c6d4f7344e8181444f0c426c84bd9bad1b188840c156e8d4a79194322e97c3ff3c0c84452181e3970c944d5c8d9cfa52a08a63e87d0bcf0c5
SSDEEP 24:7+tfSlnqLf+sig0EZFib3FTilviiMN8gZ6GSD:7MfSlnqDjGTsqlSD
TLSH
T1534202DE8F113B52D2E61070D8A022D31E3C6F2D975E67DA07A445F7F8822B66252934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.app.firering/databases/CFPGCore-journal
Size 8KB
SHA256 0b04d9b04c567c5e861d5311192798c12c9b411c321fcf65ed58eaba57b70477
MD5 bf8f7c36e7738cca46f8183b83b63320
SHA1 f37d06be6f4397c4b7107a1e5cfb370072de6d0f
SHA512 f939d9cf889f1b415b6de3cebdaafa05c435309391df4f94b8361cf1dfb2510ccad48ffb07bcdba321d317b769658f636e9310bdc701cc2591fa73e65a4dde8c
SSDEEP 24:7+tDqLEaX+sig0EZFib3FTilviiMN8gZ6GSb4:7MDqoaXjGTsqlSs
TLSH
T1840202DE8F113752D1E61070D89022D31E3C7F1DAB4D67DA4BA444F7F8813766212938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.app.firering/databases/CFPGCore-journal
Size 8KB
SHA256 408313581ad25f1be3504bc5ba4bd57073469aa06305a37c1ebbc7bda2cd5d50
MD5 8fef03a9d21378f9dc9a956d439866fc
SHA1 291fc72de134059c4574b898bf61b3d0c95af129
SHA512 b32fa0ec4a326e153b448d2ffff103cdd0d0d30ca62dfbf777cb977b3210f4cdd7dafbb1b10596069f30014a464c78f5cf060eda5ebaf6f8519c5af52430ffbf
SSDEEP 24:7+toqLCY+sig0EZFib3FTilviiMN8gZ6GSw:7MoqjjGTsqlSw
TLSH
T18F02E0DE8F113752D1F62070D8A022D31E3CAF1D9B4967EA47A484F7F8812766212938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.app.firering/databases/CFPGCore-journal
Size 512B
SHA256 3ff528a51b41d85cf4fbf25cb26f158f766e72ceb0de1acd6e159da01cf3181f
MD5 ba86c2e6b6f4d44c101007ac7be5f7a0
SHA1 83f6d1da916bfdc91ea6c33f3c4103d41a7a4e8f
SHA512 3e53497543be7e62cebaed5244084258e4c23e7de6db46cfe0b6fb292c5cc4f8c6b878bf6b1babf3b2578c3fad06cbee507561069098de1a81f949ab20e8cc29
MD5 SHA1 SHA512

Submit Download

OneSignal.db

Path /data/data/com.app.firering/databases/OneSignal.db
Size 52KB
SHA256 ab03de5564295f5ec34e2fccba9811cff818911b07798e9e456a58309deeb3a7
MD5 e1941e84ac2269c7b1b8bb7041b14001
SHA1 aed569ddb068a94e893702c297683c233d841f6f
SHA512 99124fc5347f6a7e19e0e30330c4e2f0f2d9074a0fc6a0ab7be25c5bd90d8dfdc66e8abeb1852be871dadb7a5945d7046d2e72ffb4f179c385ed7ffded33c2b7
SSDEEP 24:TLLSRZBUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvJqrEqjUix5+xGTrOPjwV+x:TeAcrA0oJxqrKcrObMoOS
TLSH
T11E338BCF4A862191EFC765B3155252E44E3B610E889317A63BF760245E83B16D72387C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.app.firering/databases/OneSignal.db-journal
Size 512B
SHA256 6eaac769844be195990467057ac9a54b5eb5959daeec2e9632eaa041a69339f4
MD5 6ab42f9b2c25a565818c82cdf6ed64dc
SHA1 4415bae29f18d2c942a1151c6086f8a1974dc370
SHA512 1dd258c16bff16763bb85f2a25663bee7e6e9059c8b1d9895f31e4aca2e8d1c73b9917897ee873a4633919eb45a80caba5145f9b2a084f6dc36a18a9d8efffeb
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.app.firering/databases/OneSignal.db-journal
Size 8KB
SHA256 6c294c80f41aa21d15bfcc6fedfb37742feeac45e21f567997f0f6dd474f1e55
MD5 5326a762f4976195a90eec80e7cebf95
SHA1 8a51373330001a07beb793a830b9648977f6be8e
SHA512 9924ceed3da10ccc6229e94599318294cb23e4b544374789c0c66e55eae0dda40101095f2846285c90596992e8adb4290535a8bf3e8a0a26532b3e36b2790200
SSDEEP 6:7+/l90UHn18W2vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKkw:7+t5WqLiuWdwRmBEyPbxw
TLSH
T17202228963801822C81D2AB798D483400F40EB6981F1CF0F156008983C434CCE4A4E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.app.firering/databases/OneSignal.db-journal
Size 8KB
SHA256 64c35571747b40dc2b818a9df1caba0aa38f38816e1d7a43b2de079eca17f2a8
MD5 076b591a7d69af1d456ee2cd05bba642
SHA1 ffabc42fe945cd788819a3cf06315f2dc3d32750
SHA512 f50143441ea93e5bacfc23a3c29769fb5e9b5c51eeb85ae0b989122ca0f7ebb1f452a1689ede842c4939570548f28cb2f7fe0de9ef1d201c5ffcc40d0db10d0a
SSDEEP 6:7+/l93qFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKwpOt/qU:7+tABqLJdTRmBEyPbdgF
TLSH
T14F02228D63421C13C41D17B790C883402E10B7258227CB27256118983C036ECA890F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation2364237664595244792tmp

Path /data/data/com.app.firering/files/PersistedInstallation2364237664595244792tmp
Size 570B
SHA256 f0ac8e19294eddcb6271f66046773bbb84b1c60b0ad2570deb858a2d83b3d65c
MD5 e2d424ff32b94c10419a4f1a804138d0
SHA1 39f095e138c6dbfcea78ff76281382030765b752
SHA512 21fcd1460b599a34155b603bd7b1f4a2071bc3629087c4c177a0ed89db3f159518de248fc55f7a36e7f827f3bd842bc83e8b157b54a622b26b3c7f996d238f0f
TLSH
T1D7F0960AAF70881CC8DFB34CB1CA6CC09D0809612A4A81F7FDEE8C6448E425B6107C80
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation4148996178010335239tmp

Path /data/data/com.app.firering/files/PersistedInstallation4148996178010335239tmp
Size 569B
SHA256 efb831d1bce5d6b3920e2f17020d34df6a4d0e27987154a9c960f34ca8049386
MD5 51ff95f4003a63ac78f446dd91b79477
SHA1 fcea8418b67828b3da6922c6e06d9fe55415b414
SHA512 85479ac9c362a02387eee88e4a1e06d6a559997464b6473b984f2bd9be9a0519d7507c85da178428f3b77c05ecbc417fea19a172257c385163950db0536c41a4
TLSH
T117F0E18B23308214C5A4A7021998FC58FD1C1DE6262701E6AD8BC85079919BBA34B555
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation5319038748790863882tmp

Path /data/data/com.app.firering/files/PersistedInstallation5319038748790863882tmp
Size 90B
SHA256 51abeffd8c2d2caeafa913f6380c5ac464691b6fc11d35d0064b65ea83d427d0
MD5 e99da707fdc221d7077a12e0f2650a4a
SHA1 9baf5ec861dac23eb600f7806c114c86cdc09f39
SHA512 b2833d8db853b0c908bf73d0f17798ddb10db8902beb669ca67d1b28e09d090f9caea08eb1f0830e442f1da684daddfe903ab7bb032dea4705889985070fee6f
TLSH
T126B012444730424186C5B2021D9CF2056D9024C1540ACA070A09F04000815E1D213AF4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation777065660022309217tmp

Path /data/data/com.app.firering/files/PersistedInstallation777065660022309217tmp
Size 90B
SHA256 ec48767157dbc7e655de3f16cc4741470ee63c570ba0f4921561a7700222f380
MD5 9378dba789dcd219ee4d1003e17dd65e
SHA1 db653b09b35d2100b055dc6baf56c69272841beb
SHA512 121830a517af8457cd353ae0774fda656a5a020643014894499820327f9ca7539c5293119b2296479cc900d1b7672ac61eaa12cc6887b8a4b39e721228d8f1b5
TLSH
T1DFB0124857348341888FB6062FCCD6101D80148108099BC50A09A4D004D22D08203998
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.app.firering/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.app.firering/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 fadc8d64275ef86773dc52871e1ae880adb01e3ceb9df6e0680b0afc2cf6c6c8
MD5 c91b6748ba6bf1568c803fb61be2d568
SHA1 f61f95c3aca86677d038f39230b706bb0d8a9565
SHA512 93015149191ead09a56ff308a55e9bb97f147b5912ef4a117594ac65dc27bd1bef7b048bb5255ca35fc952bdcd72d8de65a3b6d01fb8ce650c15ab7ef34ecccc
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.app.firering/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.app.firering/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 70c342e184c46ea67a1c923125bc450aeda01496a65314a48136c76a56696437
MD5 58f422dc223b9d7b626ef09764da4a2c
SHA1 1a01fa3a1cda16086f8a9e79fd2a968a52fc5437
SHA512 7ead3f80cadd73564fe467c58216d78674cc92f888a14dd52af1e685ba5ae2598f7d409b7841150f9a3c7248cb4be8333fc62363e197ddfce721e0e93092718f
SSDEEP 12:K4M3EuMIM3mqzdTRmBEyPbP/2M3t+ojmwGB+TOw2:KBRIWqzyGSP/rIoCtBC2
TLSH
T1EE72C2F493A03AA6C114037AC884C3702E596E1F4232CF0B96521A26ECC238DE860D18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.app.firering/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 a2e8c23e4b22f15e4cf341c31ec180a65dff1e7e2fed4e52abbedd748a1fd51a
MD5 1565a2f60532067f19d1695ed457b5aa
SHA1 a50a27dd5a6e0599c31b9325e3b4ee49ebe515c5
SHA512 68ecb72c2317ae34a13d38be779111d71729b0e9485f2325f348e1580dbcf032f375a4d23999f5bf60937bba176a4445af4b4f52c42cf1a0075114e46de17d20
SSDEEP 96:sNkHiMSWVDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:sNTEndjnHt9S/f8JzSV+6D86T0ED
TLSH
T1A2B3435E0F193540C0A964F0E9D00FB1793E592FC7A3E7D1A4910175EDD2A22EE29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.app.firering/no_backup/androidx.work.workdb-wal
Size 193KB
SHA256 187c849333c21645ef009f01471c8058345637c062ec19c43a4d90581873c1b2
MD5 ad4f976a425afb245f0bf75500eff724
SHA1 620633f0c9ee4d2e6742b2b5291c325baeee10a6
SHA512 5ddcaaf4ab974c6759e71105db0f952ee875a7a5da9613d9e24727b839a17c1f5725a4ee694b4d39315886f260206adc6284df1ebbd94380d838c37d09f71f08
SSDEEP 96:7rE21DtYajUEMEeiUukuLE21DtY+anE21DtYPSaE21DtYY:7j1DtYi1r1DtY+av1DtYj1DtYY
TLSH
T1F0148CEB7B5E98A0FF0B03FFD91259F60C7B5DEA4F925D80A93A5360D4C2209875B502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads