16f961b4f3f974109ae0de2546b092138bd29dcc1b8ec12efc487d34ddea2bd4

Resubmissions

03/07/2026, 07:31

260703-jcr3jsh16j10

02/07/2026, 23:28

260702-3f1nmsgv5v10

24/04/2026, 01:12

260424-bkq68abw9y10

Analysis

max time kernel
124s
max time network
154s
platform
android-13_x64
resource
android-33-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
submitted
02/07/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HANA_SMS.apk
Size 10.4MB
Sample260702-3f1nmsgv5v
SHA256 16f961b4f3f974109ae0de2546b092138bd29dcc1b8ec12efc487d34ddea2bd4
MD5 d6716468752179059d2194f0a73ddc33
SHA1 6444c6479f11358ba9c6a828867683be6eb0840d
SHA512 44c98d1376664646baf8714fa09c405850de645e726f8311e65278578dae4e58da12795f83d11b225b9e740cfb02f34461ffc0a4cea1d8073709da976ed18578
SSDEEP 196608:F6hcWU9EKJAQHdgdIPJKCAHL+PE1HUgb9qPzXHEqq6IMRIQYr/oq3nO6Lf4Jt:IhGDJAkd+SFAr+PI0gb9yzXHE+IxQ2gz
TLSH
T13CB612C6F7D8A92FD83750B2CDB952B2114A4C068743DF576919730C69BB6E80F4ABC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.raidlayer.smsprovider

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.raidlayer.smsprovider

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.raidlayer.smsprovider

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.raidlayer.smsprovider

com.raidlayer.smsprovider
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4167

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation3077394585512773961tmp

Path /data/data/com.raidlayer.smsprovider/files/PersistedInstallation3077394585512773961tmp
Size 569B
SHA256 bfe84cd83769cd9006691af255dc11ecb9c9a6c04d9bf3d930af4161953d99db
MD5 9ee6921b190334b5599f887defe1f9e5
SHA1 aacfb4627980bb4e5f21c4381beb231dc367256e
SHA512 7722cebde38e1d2533e71f3be5a8af6751c0bf1993901b5cf9aa938270afb9b49a15830d9472b7e5afc3bf0003b25f4ae16a11c709a652ecd510f9f8d7440713
TLSH
T1CDF0E12723B14A9DDC9BEA026A88BA04AD29C8ED971B51B5AF940C945A450A481134C8
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation4874594287084087363tmp

Path /data/data/com.raidlayer.smsprovider/files/PersistedInstallation4874594287084087363tmp
Size 90B
SHA256 cd833cb67685247be451b6f9ec6c7126ac427175056ad51dad10f8280f5e46bd
MD5 e0603cde9b9327c125e589189c812140
SHA1 767ffa769782ae696bf2705872f5e0d0fab2f9b5
SHA512 f0fe4e7b975287685c53b2be7846d6118ca7f892a48aedfaee2864f1c64f02e64dd13c3ca70d59a4f90450a6b1a31def2ac2e9fe7fbb4374fdae29b1c808a50c
TLSH
T1ABB012054A3142528ECDBB0B1D4CA3402ED024C2141FCE480B0CD49044953E0C203998
MD5 SHA1 SHA512 TLSH

Submit Download

profileInstalled

Path /data/data/com.raidlayer.smsprovider/files/profileInstalled
Size 24B
SHA256 3c3b37d0ba4b3588dc7fb59ff44c531ac209f216aa1d56b4e67b89ceea9f1de6
MD5 f820f50963d4f1c44b007b7a92067a67
SHA1 3f3d41d9d5dcf5fd09c1e76df8d0ae8f5c4996ad
SHA512 1d0e52456f69620c2d5384d3f170e1980c735d2badb0528da37536c529cb23612d1f6ebd1b38fb391dbeeff8c1ac4d0ce55a4ea7efa7341028462f445e4d22de
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
TLSH
T183810250534000E1D05446B354E113080F06D19496428B03550100428C415440C60E88
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 95903c4b4fcb928619dc93f03168a024054069226293279f8efcce8304a5ea7e
MD5 3ec06efe7b2907020fe94b0e16705906
SHA1 ea49694b9ce7b5d075b1347a78e58cd8cceef400
SHA512 b1081846194a5512b0094e23024152f86fa6a098c6b7369e8690d585d232b4bf09f5d676a074568af314f507ef0a9a7bb53d53c1cd95031ba29aa8b9f14e6fc4
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 767fe99c8e4d0310b067d55a6201e38d402e5e138b8df747a122bb2d91e72150
MD5 99487aedd4b40684f15e9dcd2f3ee70e
SHA1 9f1a6294e179f9e2ee4f4c0233e3a09fd6e5ab72
SHA512 d9a11960b6e46cd5da8e0879b2ba8be02ed40ef4bc0c39d7605c4d0850f2cf7e4d46272f4676dbb7c5e8ae4cea2ddd4aef8c5a138c16ea67123ff81b5110c20e
SSDEEP 192:g5hMlbltidjnfWzzb83zS+de+ZD86u0ED:DrtidjnfWzzb83zS+dhZD86u0ED
TLSH
T123C3119D0F592600C49E95B1D5D00BE17D3F412EABA3F3D225A100B6BDD2D62DE29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
Size 398KB
SHA256 8c540bfb865b376888a3c057184259ace76f67d38e09282e9757d265315cd07f
MD5 89cb857449cef5051ed637ff8da74f2c
SHA1 1459f0a620982b4dae6eb74a2e42d1f08e537adc
SHA512 be66a5796a92ada690bd196e0d2078f357ab6440fa65fff6f07a249a1886a6cd046a16428139ea1615043bbd70323be6d2bfcf3be8dc0acc66dd1f276e24715e
SSDEEP 6144:D7/5lCaqCdrClr2wB2VB2WBJhBNzSq1E7jE7:
TLSH
T1EA84F2E6E310C104EA1DABB8ADB642746E7B4C711E3165D460AE337E37F358B92871D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 fdf1129b326e3d10c312cc942b4c2ca94f4e67e4530578d0eff785db18f12524
MD5 d37199965ebbbf5b42b6f9ae43040c71
SHA1 f576488e07726333960d6102693bec17df753cab
SHA512 85d1ea08be567d0e1ee4a405164a166bf2207bcc1b950c661783ce922e0f3384908e3de66bfffe6178503a6df09e87694fea01747a3174c644f80d551d1dd7e8
SSDEEP 6:KM+1fILsJ1J5/v9FZdKEAlOERX4PBX4ogLugMBX4suuK+/H1AtGl/lmPCqlmPCH+:KM+e6BtzdKBRmBEyPbP/HxqldoXWOw2
TLSH
T1FF72C27893808A93C10EC33A50D8D3800D629A296F73D78B625004A37C03FCDE350D2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads