Resubmissions
03/07/2026, 07:31
260703-jcr3jsh16j1002/07/2026, 23:28
260702-3f1nmsgv5v1024/04/2026, 01:12
260424-bkq68abw9y10Analysis
- max time kernel
125s - max time network
154s - platform
android-14_x64 - resource
android-34-x64-arm64-20260325.1-en - resource tags
arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system - submitted
02/07/2026, 23:28
Behavioral task
behavioral1
Sample
HANA_SMS.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral2
Sample
HANA_SMS.apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral3
Sample
HANA_SMS.apk
Resource
android-33-x64-arm64-20260325-en
Behavioral task
behavioral4
Sample
HANA_SMS.apk
Resource
android-34-x64-arm64-20260325.1-en
Behavioral task
behavioral5
Sample
HANA_SMS.apk
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral6
Sample
HANA_SMS.apk
Resource
android-x86-arm-20260325-en
General
- Target HANA_SMS.apk
- Size 10.4MB
- Sample260702-3f1nmsgv5v
- SHA256 16f961b4f3f974109ae0de2546b092138bd29dcc1b8ec12efc487d34ddea2bd4
- MD5 d6716468752179059d2194f0a73ddc33
- SHA1 6444c6479f11358ba9c6a828867683be6eb0840d
- SHA512 44c98d1376664646baf8714fa09c405850de645e726f8311e65278578dae4e58da12795f83d11b225b9e740cfb02f34461ffc0a4cea1d8073709da976ed18578
- SSDEEP 196608:F6hcWU9EKJAQHdgdIPJKCAHL+PE1HUgb9qPzXHEqq6IMRIQYr/oq3nO6Lf4Jt:IhGDJAkd+SFAr+PI0gb9yzXHE+IxQ2gz
- TLSH T13CB612C6F7D8A92FD83750B2CDB952B2114A4C068743DF576919730C69BB6E80F4ABC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.raidlayer.smsprovider - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.raidlayer.smsprovider - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.raidlayer.smsprovider
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.raidlayer.smsprovider/files/PersistedInstallation5100984582259093416tmp
- Size 90B
- SHA256 08212f6e60b579e1f4b1d1eeb7eb21456578fe37f4c40ad1dbac38b570ac9c64
- MD5 08e9afc04edb5f8922ef4fb921d8b7ff
- SHA1 d03d79ed3b7878bc1b391ea56f4e4b78a814a52a
- SHA512 6993dd02696039b629a71895bc99a73ed80805ff431a5e58cb1187c5e77a40baec27f7d36393468fabad02efc6300130ec1a67fafb517967775f8b6d18fc2bfb
- TLSH T132B012455732438285D9F23B2C4E92409F901851484ACA844A08915000811FC8343EA4
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.raidlayer.smsprovider/files/PersistedInstallation7275546845071295114tmp
- Size 569B
- SHA256 2ce6ba60113d381415e9ce36ceffc801f86a97aa14f8949fddf4029ac913d47f
- MD5 730bf38080095afae4a445171d8cc871
- SHA1 0334c33a210f3de6da547b0a02b769ceee1c187d
- SHA512 df7809451a8da7c6d3a669f5ec94596104e394d8b35367700af6d565a2d8d89ab240b1402302952b8155241ece8316d53e208781722c9976f42c4df7055cb839
- TLSH T147F0E10A2D25865D88AAAFB368CDFE815D2C83D68E5A12E56D9E485664D48A90113384
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.raidlayer.smsprovider/files/profileInstalled
- Size 24B
- SHA256 8e7e0786d2d29a354e772836905e19bb259fa4ce3bf3ef6aa7c11445be9a6383
- MD5 4497b4f2a45b9e244d8820320dd804d0
- SHA1 fdb16fa2cc4f597cc39185112a19ffaeba3389d0
- SHA512 1a46ef94ef6660a1403ea09b860d2efff8402e74ed90952dffe61eb6964ffcd947cdce5f26be412f763fd4843b8726598677d0aa4a89bded75a32eedf262cdfe
- MD5 SHA1 SHA512
- Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 f8046fb6523b685349e4ceaa5b63d5653f3d4d9bc0291dd9546056bfabd76205
- MD5 19e5c2bf2a99d61bc5ae4cc8952d1bb0
- SHA1 34d540bf135454e98068819b42b84411fdd62dbf
- SHA512 454bce38a46107d5a4c64d8757475da9ff6ee0025fa1a8212e613d787927cb209217c655ae4ec7adf884c723e5683f473e21df0a606cd40ada4245f8daf9c3ce
- TLSH T10C810454D34000F1D0D407F354D1130D0F07D1D4D5510F0315070041CC415470C74FC5
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 f30fbc3fab44e410109dcdde6d06703f1959809d16561efee25b007611d0ece0
- MD5 e3deebcf4bcaafb89795d931ee60348c
- SHA1 2a03533659a1d4c9ff6a4ec5993f25f9132ad0ba
- SHA512 0d1e0e4b2adfdf6f8e82024d49d6d70a90a2da7e0a8bfb93a3c7312996701ea97c2f7dd5425f26fdea198114f30fa7fa2d19d59424a3107d8bff0ee8308498ac
- MD5 SHA1 SHA512
- Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
- Size 116KB
- SHA256 550688add70f53618d01c0cf04a33937ca1ee5bc6b079c789ee0e1cd114163d0
- MD5 5a4f073cfea9acba19ec967e7e6fad47
- SHA1 ed863e75ba5faf97dd3cebe6b33cfc0a9b9fab3f
- SHA512 7e441d831bb50384fbfb1c8d7ac6a8a89ae348f7e0e729183a8c87f49dc0d08519a0fb1ce3b3338c4fe787ef481fb100af7152896b5e1df7a9286542139d91d7
- SSDEEP 96:DjSr6+etidjnZRWzzb8/KeKcK+zSzddKz+ZD86u0ExV:KQtidjnfWzzb83zSzde+ZD86u0ED
- TLSH T1F6C31F9D0F997640C09964B0D5900BA1B93E412FD793F3F1A9A11075BDD2931AD29CF6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
- Size 390KB
- SHA256 ef47da1ce8a0ca8942cfa9e262eb065da8b3d704b2595c63506947ad1932ab85
- MD5 621cf63b6cc66894a1b69b59b299686c
- SHA1 f66b07436fbe09cb2bb987dd1ea9a28527967b22
- SHA512 b6cab2fc1bf6ab73eb78932be1035c1bedd7d3be1b6b6bd57430a7c157605dee5d55a665b24129e9c9541dc13b4ea1bf7ff344cfa7ab072b327ac436ea0f9f44
- SSDEEP 6144:eKvLhvN+vS5vW57xn7cn77nCgnIxs10G4DG4c:D
- TLSH T12284C1E5E340C705D71C6BF8A9E5D6B0A4768DB24B2298B57036B7383BF203775992C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 439b0e06bde051be556f29877e63c8f38a0aeb543fd76db05ad20aa5e01a4916
- MD5 709d8264806b9e6bb52613f301886c96
- SHA1 06df827fd948d7cac13242c46ecc253f76444fcf
- SHA512 a4f33914562baffe0a867048ba2db3fcc0784caedf106e1839d0b030524bb84f04b0ddf56d5c98d1c1c6bef7cad7952b9930d9f98336417b0ea9f97c38606a3d
- SSDEEP 12:KuFKcBCTzdIRmBEyPbP/QFpXYFnOQFSATOw2:Ks0Tz9GSP/Qv7y72
- TLSH T13972C2B593C0F582C849637A94D9C3449E60561AC362EB3B99202C10BC423ADB8A0D89
- MD5 SHA1 SHA512 SSDEEP TLSH