16f961b4f3f974109ae0de2546b092138bd29dcc1b8ec12efc487d34ddea2bd4

Resubmissions

03/07/2026, 07:31

260703-jcr3jsh16j10

02/07/2026, 23:28

260702-3f1nmsgv5v10

24/04/2026, 01:12

260424-bkq68abw9y10

Analysis

max time kernel
124s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
02/07/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HANA_SMS.apk
Size 10.4MB
Sample260702-3f1nmsgv5v
SHA256 16f961b4f3f974109ae0de2546b092138bd29dcc1b8ec12efc487d34ddea2bd4
MD5 d6716468752179059d2194f0a73ddc33
SHA1 6444c6479f11358ba9c6a828867683be6eb0840d
SHA512 44c98d1376664646baf8714fa09c405850de645e726f8311e65278578dae4e58da12795f83d11b225b9e740cfb02f34461ffc0a4cea1d8073709da976ed18578
SSDEEP 196608:F6hcWU9EKJAQHdgdIPJKCAHL+PE1HUgb9qPzXHEqq6IMRIQYr/oq3nO6Lf4Jt:IhGDJAkd+SFAr+PI0gb9yzXHE+IxQ2gz
TLSH
T13CB612C6F7D8A92FD83750B2CDB952B2114A4C068743DF576919730C69BB6E80F4ABC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.raidlayer.smsprovider

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.raidlayer.smsprovider

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.raidlayer.smsprovider

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.raidlayer.smsprovider

com.raidlayer.smsprovider
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4683

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation4740743086403130847tmp

Path /data/data/com.raidlayer.smsprovider/files/PersistedInstallation4740743086403130847tmp
Size 90B
SHA256 3b7de1f5bca49caad6c49452e0f0a4766fa291cda70bfce51b461f40feab5db6
MD5 50a4581204cd679c10bb65d648e65f81
SHA1 fce6023cd66fea6af996b0a2372d65ba9e100a85
SHA512 6297f7b41b77fc7cfc71e82e13fe5d9a6ad36421ff898b19df8f5dafce6a06503ca704c81e09aad2f66b99e1ac1cb27c1bf2b7438c528d71cb6da23ee2d485c3
TLSH
T1DBB012004671C25588EDA3032C4DE3411D811480148E8E140A19B04000C11F082139A4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation8000902553027198547tmp

Path /data/data/com.raidlayer.smsprovider/files/PersistedInstallation8000902553027198547tmp
Size 569B
SHA256 576e5c987d9bdcfce8c46cc99bb3cb737a3342d20bb6f7a8d01619a60ee1f269
MD5 14915871746dd96ae52839b3d92e51b4
SHA1 e9386eb0bd98d19bd431cdb7a5e1dccd6083113f
SHA512 5f1d41a186da94cb50795e3481a3f95b6ad56a4e1d3d1904cb0bbe57afdcd747f39241d092195adee44c0cc3839f3aca541bca9a81197affd3e5b95a5ec80bb6
TLSH
T128F07C5536918E1F8CE6575A1D5C7C045D44D15A1FFE04D57D1CD86171955BFC1035C0
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 59d717b9b107d550db2ca72eadb90473a816002cdb1ea2c05ac08bf53a0b4555
MD5 a6b372a237abc2d1a9cfaf9a422d21e8
SHA1 97d7ac562be6109e6ac7fe1930c4cd816d85bd36
SHA512 319337602fce127b0ac7adf930dc1ebacda122736c6b31da02be47c47ea1edb987a412a644726c0c4af89f7d697f11cae90d94359aa69f388023aecdc95071c8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 4fa91cc7c569f030cb08f5843f3288b493304de9d9c183b99f61c0e72bacbf36
MD5 d9942a731293cefc48a9afbf5f1c48fe
SHA1 ba68cd90371bdfdc2e31db1b9e4c791ddc55e7e5
SHA512 7fc0ce290dd017ad06f4141df4128301889239229d994d6eee5d0a53725962fc2cb3ca1c6c7f13118aeac952a681737ba9183b4d6022dd7c69c3903be1c56fed
SSDEEP 96:RsGeQ66+etidjnZRWzzb8/KeKcK+zSnddKz+ZD86u0ExV:RLPtidjnfWzzb83zSnde+ZD86u0ED
TLSH
T11BC3049E0F192A10C0A954B0D7D00FF1797F811E9B97E3E1659101B5ADD2A21DF2DCFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
Size 374KB
SHA256 dcfb22073cbeb40561c4284e9ea31baa45b84da1e25193cfcfd99f1413a1ecb7
MD5 cb31ff6830d5a1b09d9e1ec349239a5b
SHA1 1135340ca05236fdde7f6a89c06209c00e620799
SHA512 152cbec2aae912bc5b92698a5493114d9930ca571486daca7df229dc5be558264571cffb955732ca94a5aff05f70f1266dc7b843f329aff610b83ceb8b9563f5
SSDEEP 6144:qNZyVB69jBhqBZIq1lU1CU1kUyUUaPzRjB51B5dx:Q
TLSH
T1048432F3F300C505F7185BB86EF787A0A5A64DB04E2114D9916F2339A3A344FE6CA5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 a4970247065da150209339fa97efce1ed32cc19932d08f42cf3c68887dff3b5b
MD5 a016e60781a0b182736178e8e029ad9e
SHA1 0e5e4a0b6d645d33f0bbeb3cda17a29f289f6095
SHA512 ecb6bb42e727699bbcd03e9a75167dacc590a051b39357ea5a61d306bc0829f2fe4f802ab788d010ce3db417db34ce722045f681f86c93fce9e403af5e17bcfd
SSDEEP 6:KmZV9ACZH4Ug9FZde/kPlOERX4PBX4ogLugMBX4suuK+/8ZmLktu3sowoY4tiOw2:Kmyu4UqzdeWRmBEyPbP/8Xt4sNOw2
TLSH
T19A72C2A2A3800932C50D133A57D6D3000EF2161D5F52C71B97A215603D417CC66A4D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads