16f961b4f3f974109ae0de2546b092138bd29dcc1b8ec12efc487d34ddea2bd4

Resubmissions

03/07/2026, 07:31

260703-jcr3jsh16j10

02/07/2026, 23:28

260702-3f1nmsgv5v10

24/04/2026, 01:12

260424-bkq68abw9y10

Analysis

max time kernel
9s
max time network
33s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
02/07/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HANA_SMS.apk
Size 10.4MB
Sample260702-3f1nmsgv5v
SHA256 16f961b4f3f974109ae0de2546b092138bd29dcc1b8ec12efc487d34ddea2bd4
MD5 d6716468752179059d2194f0a73ddc33
SHA1 6444c6479f11358ba9c6a828867683be6eb0840d
SHA512 44c98d1376664646baf8714fa09c405850de645e726f8311e65278578dae4e58da12795f83d11b225b9e740cfb02f34461ffc0a4cea1d8073709da976ed18578
SSDEEP 196608:F6hcWU9EKJAQHdgdIPJKCAHL+PE1HUgb9qPzXHEqq6IMRIQYr/oq3nO6Lf4Jt:IhGDJAkd+SFAr+PI0gb9yzXHE+IxQ2gz
TLSH
T13CB612C6F7D8A92FD83750B2CDB952B2114A4C068743DF576919730C69BB6E80F4ABC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.raidlayer.smsprovider

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.raidlayer.smsprovider

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.raidlayer.smsprovider

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.raidlayer.smsprovider

com.raidlayer.smsprovider
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:5088

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation1194512540030896328tmp

Path /data/data/com.raidlayer.smsprovider/files/PersistedInstallation1194512540030896328tmp
Size 90B
SHA256 ae179cb3d413aa928d9c905294a0984a6b4b1c891c30f581f909f6c8cd034162
MD5 6c8a22eb4b3ea7aa2e98022e140320db
SHA1 d7b87e94fe11454a5fb890d5768ec9cbbeb491f8
SHA512 05017440f55f59b3df88f29d87e9ac411d46278b38ab714554e2645f8887c4857e497c293fb5e8091e0908f3ca0eeff28ed0363a3d2003d866e2a1d7940639ef
TLSH
T1B0B012825A3043418B89F3021D4DA1342ED01540484D8B0C4B09E09052922D0C303AB8
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation7536317953595097016tmp

Path /data/data/com.raidlayer.smsprovider/files/PersistedInstallation7536317953595097016tmp
Size 568B
SHA256 e53c4104edbae9738f603dce9ab34118398b9e13f38e364044f80d0a06bf1551
MD5 9604ac8fa092b045cb2ee065d50749f2
SHA1 baede3a772e2260c9f85da20bb8c03f5aaf2c0e3
SHA512 12fbf24bdaad5040b302c0ee09351cb583970c063ccbfe0838324a4e9ef10fbc0aa4143c7b2feff75d1e77bba4f725c8e9cd230c732129e15ab67a7943099925
TLSH
T17BF0964534000638E49373010F04EC285A288FA4799F22CCBFDDD443B2417705187480
MD5 SHA1 SHA512 TLSH

Submit Download

profileInstalled

Path /data/data/com.raidlayer.smsprovider/files/profileInstalled
Size 24B
SHA256 19202d15482c54421969f68e3e02536cd7a6807bb3b1abffdfa926e9ab8608b2
MD5 f45dea24d4345286abc06914fe6f65ad
SHA1 078af03655916a2d329e07913a34ff1e85ac767d
SHA512 7ad3b5afb9ef8e6f69b1eb191751148a9729cab628f11e636f7d2c9158d46124adbe9a5f29ba9498f35308182cb68b5f6431b008ee0d3ecaf6b57f52ab6ad20d
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 a1ff710107b6c5abd8c0be2c203b51e9c09012b13b0cc120673ec149c44fc04d
MD5 4b849e3f99e0a615ed7809f3cb8b6c3c
SHA1 f7815c1f00f89e87922bc568d4f74307d47eaf30
SHA512 ed2976b482f8445719e357404c8b2271ce7d066e206e721abddff6a1d2e1294d5708cd90189737ca8a4263bc0f48ee1e6bff3a1525a4c28a6b60e3fda06eaf60
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 9b4899c50dc8cb5fc7fccae55a88c5416b2353e434b45b6fe7efd6eccb1e4b4f
MD5 6b32407f725c0bfa02211aef0099ded5
SHA1 57c2f7fbfb65a7e1d3359911e9e33c90d07584fd
SHA512 061c37026f80fa10c9fc9237a03a5b28e591b91e95f00144013e331ea9c3e8c58d3d1040459ea28c74ea951e58cb0f33d16cfda109b873b25b285d228ca44b90
SSDEEP 96:WeZuSUQ76+etidjnZRWzzb8/KeKcK+zSxddKz+ZD86u0ExV:/uSVgtidjnfWzzb83zSxde+ZD86u0ED
TLSH
T1B1C3309E1F193640C0AD54F0D8D10BA1793F811EA793E3D235A011B6AED7C61DE2ACFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
Size 374KB
SHA256 b6463f605f86098457e05d76adde8ac5a4b3520aeb78d93d4b226aab1cb09df7
MD5 8bc0a8fe2a73ebb90a0dcf8423998b3d
SHA1 b432c91d3343b3a754863b8ca8ee4b2a7b456ea6
SHA512 2f6960386f38f6cf28f409a1e328eef10e7bf01bc488501f3cdfd94092c1eeaa245b3f5259fa03368cae6fadf75198c6f7950a1cd030b465d2b19a8ea0ecea63
SSDEEP 6144:dUC0VoKgojRoIR8Kz8Fz8qzZqzLng2AG1kG1O:L
TLSH
T1298415D2F721E345E7251BFC68E347F929628DB41F255889309B3B3623BB44792E25C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 22c9a8a24441e447e67459755c4ce738a9844ff9a3c4faec344abe5c497c4fdb
MD5 15bfccb94e559d3486c087aa2bda5fe1
SHA1 ddf5983e90cf589eb1d9de0801773104fbaa397a
SHA512 7e0fb4696b1efaf8756f07c0274ae4df559c59d5bee9b5a87abd5a30efff5d5d0b97765eb01593ba9928a2092502eb72deb82b1aa3aa5b2eb26013fe44f8468e
SSDEEP 6:KiTSXw0icyg9FZdrlOERX4PBX4ogLugMBX4suuK+/GkyblyvIJE8YkTOw2:KP9yqzdTRmBEyPbP/GgRATOw2
TLSH
T195728671A3417692C11C43B25496C3411D51D619A292CB4739A12956AE47ECCD5A1E06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads