16f961b4f3f974109ae0de2546b092138bd29dcc1b8ec12efc487d34ddea2bd4

Resubmissions

03/07/2026, 07:31

260703-jcr3jsh16j10

02/07/2026, 23:28

260702-3f1nmsgv5v10

24/04/2026, 01:12

260424-bkq68abw9y10

Analysis

max time kernel
65s
max time network
68s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
02/07/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HANA_SMS.apk
Size 10.4MB
Sample260702-3f1nmsgv5v
SHA256 16f961b4f3f974109ae0de2546b092138bd29dcc1b8ec12efc487d34ddea2bd4
MD5 d6716468752179059d2194f0a73ddc33
SHA1 6444c6479f11358ba9c6a828867683be6eb0840d
SHA512 44c98d1376664646baf8714fa09c405850de645e726f8311e65278578dae4e58da12795f83d11b225b9e740cfb02f34461ffc0a4cea1d8073709da976ed18578
SSDEEP 196608:F6hcWU9EKJAQHdgdIPJKCAHL+PE1HUgb9qPzXHEqq6IMRIQYr/oq3nO6Lf4Jt:IhGDJAkd+SFAr+PI0gb9yzXHE+IxQ2gz
TLSH
T13CB612C6F7D8A92FD83750B2CDB952B2114A4C068743DF576919730C69BB6E80F4ABC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.raidlayer.smsprovider

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.raidlayer.smsprovider

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.raidlayer.smsprovider

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.raidlayer.smsprovider

com.raidlayer.smsprovider
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4282

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation520299095565995959tmp

Path /data/data/com.raidlayer.smsprovider/files/PersistedInstallation520299095565995959tmp
Size 90B
SHA256 0908ef04890ca94ea11c05b2a89cdf124422cfc65b3ca71a90951dddb9fe8320
MD5 6acaa9e0cfabab0c0e8e2124481e049c
SHA1 566fe2adf02f592699c9d432b194f1bede6ee721
SHA512 53be22d7829a450343a62ce820f11366725dd2a4912067a3d5a0cf753451da2d6bca6dec9cdd24746377621fe0d134fe3fd348d965276cda3eb4e4a59ee54b0d
TLSH
T134B012005671435184CEB3031C4DD1001D531C80140B8B144E1CB0B000B12D0C2039F8
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation7698595601970540287tmp

Path /data/data/com.raidlayer.smsprovider/files/PersistedInstallation7698595601970540287tmp
Size 569B
SHA256 3ee0f62cd89172d610f2d6450fea3a157568647cf7d9cbceff81c12dc4d0e823
MD5 e735aaa13f1a486bd02609301e368987
SHA1 1cc5b6b91312fb5f8f0c86e5146b8be8d9eeb0bc
SHA512 5d005cb04689edc663bd73257dffdda2c847ac4aee394f59d79a8c539b50bbbb5e54d353eb896a08860355f6140df517d33d225f61d3746bf0f551cc756f30b4
TLSH
T188F0268A39704F2ED8DF531739097D04A86D5C943F4A14B45FFC5CB168E567641131E4
MD5 SHA1 SHA512 TLSH

Submit Download

profileInstalled

Path /data/data/com.raidlayer.smsprovider/files/profileInstalled
Size 24B
SHA256 b86751a189cd688f11572b16ff8914ad41c01216f909641cd637b6b0d81132dc
MD5 8192c875dacf4185a0608a948f92da23
SHA1 45ac29f058a6ca0a4ab49bd3aa35a4de8b60119d
SHA512 dc8dd0982088961b5e1ba3e2b905887b4847018a50ba77c79c627a9e52721e16ef689030cf2dd47708405c051339dfb8906421f9376930f34c2b075e24068ece
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 97981bc0e1d1797b5417f8030ecf1fa1a980ad598d514b9e9c77ac69ecac075c
MD5 f8c16a905919fb00e186174ae64c811e
SHA1 d132d8641050870d7e52570bd4b31a714f37691d
SHA512 90f374f1a43e84dfade2e568e472c38ef86bdf25930af11cbb41a77f9d544cb574227f9a4d9ec49a546057f84f436ba581bd805a3d582b4f0f129f03cabc918c
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 e5f66a5d6f4e1e4101b3ccb9ac18fab707c8272650d7c682cb3e4476caebefd4
MD5 89b6dddfca613b7b03e89b47371a4e37
SHA1 722aede45e628de764785ad84ba3b2f519809b86
SHA512 b8e0413c8d3c802015aef1e29686bbed974e5b078ed892b5633f60e25d3fa717a44f329f4fed14e9f00c22b842e45bc24629a2091f196f389ff83a81baaa80d2
SSDEEP 96:DN9bmOMK66+etidjnZRWzzb8/KeKcK+zSeddKz+ZD86u0ExV:p9bEotidjnfWzzb83zSede+ZD86u0ED
TLSH
T1D8C3FFCD1F192700C49954B0E6E00FB1793E412FD793F3E165D101BAAEE2921DA2ADFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
Size 382KB
SHA256 d4fc0876075a98fde8053c5035d3dd505fe706d75ce5c058cfb5e7f895cf66ad
MD5 ee0c8724c4e64cd1cc8fb24a857758da
SHA1 adffaec6869cff6b32d645a973ff2374d956a035
SHA512 464a5305259af960d9ba1d0d18797e7d18d91544144e43f587825b32e1a98237c6503db8f24529853103add7c82d1bfa8b559d57532bc5bde69648f35026d4ba
SSDEEP 6144:g0jfSIBYIokI1kUfaUSaULaJhaXlRZuzVozVN:X
TLSH
T1EC841DD2F211C218F6265FB86CF296B26A52CDB64F3054C820B67F39A77705BB3952C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.raidlayer.smsprovider/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 fa340eff5e3ec5aee39871e34ab9f89c80bcf0944efce7f5f37be8fe66485bcb
MD5 b303aa0a7980cf4f0df1c18f92225b17
SHA1 1d75e2fa894325f5b34abf35903640d5cb638017
SHA512 4cb3777b14be1ae0191fa386ed256ae5231c043e95390aebf3fe51e3d1bb8b783cdf25d3d45be3c847834cc062e8b38810235ef6145c986a3a851c14cac0905d
SSDEEP 6:KMkk0mkBuZy9FZdrlOERX4PBX4ogLugMBX4suuK+/ZkeM/O98G9DH4Ow2:KMl0bMyzdTRmBEyPbP/qeM/jOw2
TLSH
T14C72CDD473819B56C4094332A1D4C3242DD1551AD312D7AB16900EEB7E567C89552F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads