Analysis

  • max time kernel
    126s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    02/07/2026, 05:17

General

  • Target
    2a1337efabe834e592303d1b6bad517ca0ec3620da10db063dc26d37a361c9a6.apk
  • Size 99.0MB
  • Sample260702-fytxgsbz21
  • SHA256 2a1337efabe834e592303d1b6bad517ca0ec3620da10db063dc26d37a361c9a6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.pt.bark
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4875

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        environment.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/environment.json
        • Size 12B
        • SHA256 80be2eb0944c0453a6ad339a56e1c8f39f8cc57a4e627758246ccfd274176fd8
        • MD5 SHA1 SHA512

        release.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/release.json
        • Size 24B
        • SHA256 dea433b2860aabdddddc48af4ba2304ee0d83f7f2f0d986b8f0ddd5b2e51e8ea
        • MD5 SHA1 SHA512

        sdk-version.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/sdk-version.json
        • Size 580B
        • SHA256 4e0324cedd3bec3b177d502119701bb304dc3e99d4a66e0a1dc1fe92126a3a67
        • MD5 SHA1 SHA512 TLSH

        tags.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/tags.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512

        breadcrumbs.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json
        • Size 4KB
        • SHA256 6db1ece9a484ee1fde8fea2e84ff35ca5072853acb96f40d644eeffb4fbad10f
        • MD5 SHA1 SHA512 TLSH

        breadcrumbs.json.tmp

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json.tmp
        • Size 12B
        • SHA256 ae1afdb53fc94d62b6862659f839a20634382b65a7354f32b5e81cd29fb4270d
        • MD5 SHA1 SHA512

        contexts.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/contexts.json
        • Size 62B
        • SHA256 01870d5d7b208dcf75df9c13c2f8c636dd5b711abfd33f4f424fd3808d753cc1
        • MD5 SHA1 SHA512 TLSH

        contexts.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/contexts.json
        • Size 63B
        • SHA256 dda403ea3f2dc79793e354552c63edfb2be6a7676df6d0ecdd02a12055fcdad8
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 d46bd5def6d03f4f443ef7c827bde616585dc4b7828a284b1596a28274a568d6
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 188B
        • SHA256 08532aba7a381e390c8b0107ceda356b075203534a01711d6f22a937c80b152a
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 947fd092a4d84b7eae8c23f31ec0195f1ffd58ca7c9bcffecef58b1baf328635
        • MD5 SHA1 SHA512 TLSH

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 18B
        • SHA256 96f7a5db03a7c5ec7847b1ca053fa92d19552fe07cf22a21a004e4aabed4a95c
        • MD5 SHA1 SHA512

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 16B
        • SHA256 96c4b7db81f09c9990c9e856e2d350b49f8ca5e0657620be9a6632cc3d7aaf1c
        • MD5 SHA1 SHA512

        1dcfa72c34e64e6197d3007a35bd7043.envelope

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/1dcfa72c34e64e6197d3007a35bd7043.envelope
        • Size 935B
        • SHA256 d64a14707f66000ab8aa81f6d69012f6d0094a9a0cb4813fff0ebbc381b207b2
        • MD5 SHA1 SHA512 TLSH

        session.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/session.json
        • Size 268B
        • SHA256 fadd2d9bbea8363f71473a9fa46338a86e6bb65e9de6e6b7d5da86279bf372be
        • MD5 SHA1 SHA512 TLSH

        OneSignal.db

        • Path /data/data/com.pt.bark/databases/OneSignal.db
        • Size 52KB
        • SHA256 491c9687657ca71661a5cf42a763249f88fa222edaef20eaf552c4599458f99e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 7ee74145d0da0139dcf48ca2912b041ad73198d23fe72ef5440495d642f9cce1
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 0f1f853a4cc306217b1835404946adbbe1e885512467eb61bb74dac4aa4ec919
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 a61e3fd3061d58836397cb67f257fe59915516ce3cf9ef40ad141efb30dc2dc1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 f6ea1c070bfe64e29934c5ca44e4f6688900cd2998f52ef2886158f5d6294015
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 e58698eaf436304f285ba31719fcbf2292758706a3fff5ad25ae044d4432f8e1
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 13087fe4eb355d43fdb718a5d283d0e46bce1892fce66956645119c46442f696
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 f2b4e7f841d9d39f2acd642815bd5ec30c0ee2b1b055de710100560e7e5275e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INSTALLATION

        • Path /data/data/com.pt.bark/files/INSTALLATION
        • Size 32B
        • SHA256 50825f78cfc9185f3c0c2b57a46b7ac8e44806308c547b06d3cd8ec198db7d0d
        • MD5 SHA1 SHA512

        PersistedInstallation1416438633246300304tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation1416438633246300304tmp
        • Size 569B
        • SHA256 64dd49953e0d401b399838eed9e92d6a981edae1aba2ea064b929c30bf9bbc05
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation1904534777060954759tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation1904534777060954759tmp
        • Size 570B
        • SHA256 e9ed699fb3430f4dbf7dd36b03ed8bddd1ef451b362e65a48a67f629a064b878
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation4378192206450424766tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation4378192206450424766tmp
        • Size 90B
        • SHA256 424e581497d2210c130b37c424a6954eef3e43b07c34cd03e4db43b4e4cbe0b2
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation7466674995246557316tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation7466674995246557316tmp
        • Size 90B
        • SHA256 5d80dadaa82423b77168ce0157e9f88070ce300d36753973da40f74900b632ee
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.pt.bark/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 f11b5beea6020bbcce744ab6cf1888045a75513615a863bbe99098d88cc97463
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb
        • Size 100KB
        • SHA256 aeabbfa85607d59c01475c7562e7bacb94fd052da584848beaa314f2a636b1cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 f262853e482b4012001a3443056e363baf278169f8e83af9c73fbcbd61c056d6
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 f9b8b484409596e52d371f8b03683dabac4f6e9f57a159a51ade1ecbedec62ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 861af0ddf653cb8dfdb4066dcf83c52d8ce7ea329e687451618b73f4bf83dd31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 410KB
        • SHA256 5b6e7d92594dfd1a4be86b3e60bb7b64dc44301be53aacf93386ec4c34925f1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 1KB
        • SHA256 64d059a4c278990a08396cbacddbc0beb3889cdfa7b150be614ddb0d2f83b83c
        • MD5 SHA1 SHA512 TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 15KB
        • SHA256 47c0770089dcc5a250d8874af66b8482d64f3564e509b71452f3e64c5ed2b98f
        • MD5 SHA1 SHA512 SSDEEP TLSH