Resubmissions

03/07/2026, 07:31

260703-jcr3jsh16j10

02/07/2026, 23:28

260702-3f1nmsgv5v10

24/04/2026, 01:12

260424-bkq68abw9y10

Analysis

  • max time kernel
    125s
  • max time network
    154s
  • platform
    android-14_x64
  • resource
    android-34-x64-arm64-20260325.1-en
  • resource tags

    arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
  • submitted
    02/07/2026, 23:28

General

  • Target
    HANA_SMS.apk
  • Size 10.4MB
  • Sample260702-3f1nmsgv5v
  • SHA256 16f961b4f3f974109ae0de2546b092138bd29dcc1b8ec12efc487d34ddea2bd4
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.raidlayer.smsprovider
    1⤵
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4407

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        PersistedInstallation5100984582259093416tmp

        • Path /data/data/com.raidlayer.smsprovider/files/PersistedInstallation5100984582259093416tmp
        • Size 90B
        • SHA256 08212f6e60b579e1f4b1d1eeb7eb21456578fe37f4c40ad1dbac38b570ac9c64
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation7275546845071295114tmp

        • Path /data/data/com.raidlayer.smsprovider/files/PersistedInstallation7275546845071295114tmp
        • Size 569B
        • SHA256 2ce6ba60113d381415e9ce36ceffc801f86a97aa14f8949fddf4029ac913d47f
        • MD5 SHA1 SHA512 TLSH

        profileInstalled

        • Path /data/data/com.raidlayer.smsprovider/files/profileInstalled
        • Size 24B
        • SHA256 8e7e0786d2d29a354e772836905e19bb259fa4ce3bf3ef6aa7c11445be9a6383
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 f8046fb6523b685349e4ceaa5b63d5653f3d4d9bc0291dd9546056bfabd76205
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 f30fbc3fab44e410109dcdde6d06703f1959809d16561efee25b007611d0ece0
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 550688add70f53618d01c0cf04a33937ca1ee5bc6b079c789ee0e1cd114163d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
        • Size 390KB
        • SHA256 ef47da1ce8a0ca8942cfa9e262eb065da8b3d704b2595c63506947ad1932ab85
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 439b0e06bde051be556f29877e63c8f38a0aeb543fd76db05ad20aa5e01a4916
        • MD5 SHA1 SHA512 SSDEEP TLSH