8358fb631ae3012c4cd77d313db67ec29393bbcc3d9c37b536df31b9531a88cd

Analysis

max time kernel
4s
max time network
154s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
08/07/2026, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stalkie-1.2.5.apk
Size 21.6MB
Sample260708-b3eadag19w
SHA256 8358fb631ae3012c4cd77d313db67ec29393bbcc3d9c37b536df31b9531a88cd
MD5 34b30ad70e60201a94519456a22c885c
SHA1 f2ad852c98410eeefa05ca28b7f03ebf90944b4c
SHA512 72212b6d6f790c06b793aa8b1d78ec8487133fc0a473d5c244aa72beb12744808b6f88452e8551fb1dd151c57fd4b2ccee836c3e693223e2059f5a8d7e136f3e
SSDEEP 393216:Cs+mzXdWW7yoIi1MkoXSrZIEqQrVVq9s3Zqe:CpmzNWOygMkowuEnrnq9IZh
TLSH
T10F37E142B7935D73D2FDEB3856BA5704BF31728D774B63873048A2A89C931C46AC7688
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.gc.stalki
/system/xbin/su	com.gc.stalki

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.gc.stalki

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gc.stalki

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.gc.stalki

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.gc.stalki

com.gc.stalki
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:5058

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.gc.stalki/databases/com.google.android.datatransport.events
Size 88KB
SHA256 f53dd73fbe55a374075cc0d36fa3531f32e70e60ce2a7971af0e222d77830006
MD5 c1bb11e24a7c5ac1f50a8456e614c633
SHA1 ac1449094004b22a34686b5b02def02c7726248f
SHA512 efb6b8e96f2eca83556a58d683f6608b21ba17a1f0517b04ecbb38a9bccb356e56bca5d5a55c32e5f201747e7c1dc4195399d5002ab74f1580b9b37a2f7826f8
SSDEEP 192:a38C4MyGyQR4wY9Oj0vjbjpj+LoldWkoEDROLo9Qko7uY9coCCKLj1GDomkLoh5B:o3GkR2dWcVpwKLj1GDikXvXR
TLSH
T11093BC4B5F343C8BE16CDDBB61AB0A775AB705175A4E9A84E048D3291F6CCC132C72AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.gc.stalki/databases/com.google.android.datatransport.events-journal
Size 28KB
SHA256 b4091fd380bc59749587b292bfcfab60819b962876363e25bbb9ac6cd32584b2
MD5 5a38fe25da486417f50d409a659bb931
SHA1 b3549ae503b8270848803466f90170e2d437ef06
SHA512 b808213ac4bf02ccabe86fe0352e01577c62e7894267e8dcf91bab1400c9f088fc176042cfebb5e3ad22ef6c6815fb6baa0a91ea84b6e1e035520495973eee45
SSDEEP 48:7MQlqu59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSl:7FlVMEqzAiwIyNjal
TLSH
T1F9D2445E5A3C2211C57E283ED7E143535B3C93DF5723926139B88CEECDC246670255A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.gc.stalki/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 014187e3022907b8d38d59b6e8d120f5c166bf50cd1c535045b66f367af7972e
MD5 41f6b0c5ce4b4e23fc1cb0d29ee2a146
SHA1 d1d66354ba59df7e7edbafd33b4ae4887b876214
SHA512 afcecda6e53adf5748750b448dc7086066d50838393c2172fcf628499a93c5a217a2fa735b8ce284a442458e87c286e13c68ff93032ed64a7883a14f73c1296f
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.gc.stalki/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 42be93387d7e3d5071643e75ba29e16dbd3f9016393179fedc561ec819cb312d
MD5 f532aa65773e51d80bfe8e4f71c7e442
SHA1 e8e4b9ba5fdac8eea2a5901f7632637aff44bc1b
SHA512 3615a6f8cba89246c064bc13072783d3f15c957e0d7b2f920be6119500b92467960ab6ac50ef6a3d381b3546986021be7154e1b31a468d329c43d7b8b42cdb19
SSDEEP 6:7+/l9Kn1lg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKa:7+tIqLiuWdwRmBEyPb1
TLSH
T18902C0CEA3800923C81D16B7D0D893480D40F71AE271CB27166008D83C874CCF4B4F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.gc.stalki/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 501fbb43ecb88ceb6d18df89665d6f337c6ffd8f033cf19c8e462e4ef2428f67
MD5 ec21f62c3decd7bbf7e07df15707682f
SHA1 d97c25ebf7651a7c9692ca32a7a542a77e5510d7
SHA512 0708f3eb5fdc5aa2e114e7168632c15c0a977d998bc85cd19af3c1a117a346eb833ceb3788636e346fbf95381d6d50c393af79104d241c00c75456cc44ec2a56
SSDEEP 6:7+/l9dLPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKu//2:7+tbqLJdTRmBEyPb12
TLSH
T1F802128967411913C51957B790D9C3552E54BB158263CB57157408987C867CCB890D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.crashlytics.settings.json

Path /data/data/com.gc.stalki/files/.crashlytics.v3/com.gc.stalki/com.crashlytics.settings.json
Size 762B
SHA256 ddb4a3cfa1d4d5e68275696c1aa8cd4f4d881a75e7261bad08790cd8595ac900
MD5 d37d94d3ee6b45053206d14ff65849c7
SHA1 9ce69b810ec3fbc0116d59563a448ebd4b458c4c
SHA512 81666967bd32196571550eb4d72ef23fcc2198b52320e4f300689b4106023a20fbd9af20962a45669c2c993cc063be1cfa81aab183e9738ffd40580742bf895c
TLSH
T11901907DA48898F940EFF529C63577F2263848732715AC18F6BC431891E7AD4910B933
MD5 SHA1 SHA512 TLSH

Submit Download

event0000000000_

Path /data/data/com.gc.stalki/files/.crashlytics.v3/com.gc.stalki/open-sessions/6A4DAA8D024B000113C2B147D939297A/event0000000000_
Size 34KB
SHA256 5c7bef6faa2c8baaa7d441e57ca58433afa13c7fcf509e89c27eafb8631508e7
MD5 5b61fe05db6b747453e4b3df70a45b4e
SHA1 c5e03273687549f1fb752276b8570673c6432991
SHA512 10a4867b50da8a2aa2eda285929ff97981883b3424f88d4279e75f52600005bdddc0683c3a8f7dd1daeea5d37c1026d635bcc553403890002445956e49a7851e
SSDEEP 192:4RFY9Oj0vjbjpj+Lold1koEDfOLo9Qko4uY9comCKLj1GDo9kLoh5ujgXjTXjHNO:4R4d1czpjeLj1GsskXfXY
TLSH
T1D7F2784B5F353C8F216CDD8B21AB0A7B5AB709175A4E9A84E049D3291F6DCC132C77AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

internal-keys

Path /data/data/com.gc.stalki/files/.crashlytics.v3/com.gc.stalki/open-sessions/6A4DAA8D024B000113C2B147D939297A/internal-keys
Size 107B
SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
MD5 58c6ffd18aab0e3303cd49e1d2fdb9c5
SHA1 7dd517bc9278addca0e9c229dca834edbe030b44
SHA512 eba20532172d1bff0a750a5293024efd98c0c5822f3f15b469d1a54ce917ea78cc7f644c3e7d7a59dabac0226a942474c2a481f970ba8b519c24bf0765c799b3
TLSH
T1B9B0126061D5EA3738F6221DAD3244C1A5910D861452C38C6F14741EFE7006E69AF97C
MD5 SHA1 SHA512 TLSH

Submit Download

report

Path /data/data/com.gc.stalki/files/.crashlytics.v3/com.gc.stalki/open-sessions/6A4DAA8D024B000113C2B147D939297A/report
Size 821B
SHA256 5c8f841a06f6675c826277d209d5fa76a93202366867e1d9b9bb6a8201e1df9f
MD5 7576b0fcd7d6a854474beaa8e809556d
SHA1 0ecf7f5e43598738995387d285be764fb3db1e34
SHA512 1532fc454b7af222a949e997246ea2f2d68218e65bb3d652ecabddcd7c9d9db0a1ef61aef094e25cbcae88f28b2063b7ce0de95eca7f0846a2052c6501740a5b
TLSH
T1A2011279EBB02738220E67AD80C4EEF6F57903FC6621240C58CB401412CF89C6102436
MD5 SHA1 SHA512 TLSH

Submit Download

report

Path /data/data/com.gc.stalki/files/.crashlytics.v3/com.gc.stalki/open-sessions/6A4DAA8E0054000213C2B147D939297A/report
Size 821B
SHA256 078ca0d9f3a1c0d4bdaeb0430c2d792e587673185fd4a1a88d992b9edc80487a
MD5 56e65286da50ada8ead471eef06fcb91
SHA1 16cc00548a1f7bf24a33be3523edd72a592b1dfe
SHA512 0d0b7f982a103e4b10a8fe71b3225263f088a78be9ed3a19bfa4af39fb0b894b5ba095e2c38c2475cfcf1a41de2d1bf54f1415d1f6ecff5d2c076c1a774388f8
TLSH
T145011279EBB12778220D67AD80C49EF6F57903FD6621254C18CB401416CF49C6102036
MD5 SHA1 SHA512 TLSH

Submit Download

6A4DAA8D024B000113C2B147D939297A

Path /data/data/com.gc.stalki/files/.crashlytics.v3/com.gc.stalki/priority-reports/6A4DAA8D024B000113C2B147D939297A
Size 35KB
SHA256 27f9e779c83884a2c34174df50fb52f30b5c3e69ca1ab45819503cdcbb46f77a
MD5 1f0fa5755ece0db55f4b63d6c849725e
SHA1 c2e0ca3e5f36ccd4aebd76422a9c29abe167c6dc
SHA512 ee0a6cc7f5a25ba8e5fbab119cd4004529cad223075685b50a5d97dec3361e44fd55e67b2953f68427c6e77bfa942786ead50089ab42d1564f3b2b68313b9cd4
SSDEEP 192:tyGyQRFY9Oj0vjbjpj+Lold1koEDfOLo9Qko4uY9comCKLj1GDo9kLoh5ujgXjTX:4kR4d1czpjeLj1GsskXfXH
TLSH
T1D9F2894B5F353C8F216CDD8B21AB0A7B5AB709175A4E9A84E049D3291F6DCC132C77AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation4172343386240704101tmp

Path /data/data/com.gc.stalki/files/PersistedInstallation4172343386240704101tmp
Size 569B
SHA256 5f75249e25efe8d906c2fbc29a9d92b3a5144837484dd76257fec86ab7c6ecb1
MD5 413df08fad12171036eeafabf287defb
SHA1 10c5373ad44d93873dcf1477d3c49fcca83d75c4
SHA512 852fe9d6d40d9512dde99fda3eea98d2bf1292e0c1def0a7b2c3a3fcbbb80b1e675aaeba5739a66690d722bf288725e10c6cf81171ccce65a68defbc1987c873
TLSH
T1EBF0964652984B17F59D3487215F7E040CF1A9438B1E88E63EDB401051F8CE42207088
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation5202014299897363853tmp

Path /data/data/com.gc.stalki/files/PersistedInstallation5202014299897363853tmp
Size 90B
SHA256 c387defc5157dd946c85187e919c0056178876990b0f1263b5690e8e4832f6de
MD5 29ec8c1ad52875976cb473ba586037e0
SHA1 c9aee26bfffe94560e1f12d9aa0c7aed0a74eb2b
SHA512 66ee6bfd31a2d2166a4a378de781aca6853e8bb452fc9af5342bce757be9b9d50b6c0118a9440ab3c91f07a1ede95321ace92e44c1852ebb5061760099c58d92
TLSH
T16CB01244DB30435198BAB2031C8D92001D531442044E8E090E5CD48041D51D5E5439A4
MD5 SHA1 SHA512 TLSH

Submit Download