656783cc2778da407992a8baf37c24b007de1677d4bd20764b9b7ebc1e68b65b

Analysis

max time kernel
1s
max time network
153s
platform
android-13_x64
resource
android-33-x64-arm64-20260708-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
submitted
20/07/2026, 06:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gamamatka.apk
Size 43.8MB
Sample260720-gzzd2abt21
SHA256 656783cc2778da407992a8baf37c24b007de1677d4bd20764b9b7ebc1e68b65b
MD5 afb1e8917aef8eafb3f6d1cd50683013
SHA1 ca780106dc240747f8520b046c8cb474f3640451
SHA512 d5b697d2926dff536c30b81ce2970df0039db39f4d07e1fbc1f1e7889e5f917f13ed4ccb5ba141960fba6eb7a05f512b6e03ad752d970f828a0b069351da6368
SSDEEP 393216:wMmYDcl1ceGM3nPeAlFv+ClykQtAwog8wf50W6VMrkLmW1KjtHN7MzoiCV3w:wMRwVXPeCv+ClykQtAwogF0UhRtioNFw
TLSH
T112A7AE19B78DA82BDDC6B0FC8C4B06927539BC505A11D09B3923B209EDB37E54B797E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.extensions.jar	4102	com.gama567
/system_ext/framework/androidx.window.extensions.jar	4102	com.gama567
/system_ext/framework/androidx.window.sidecar.jar	4102	com.gama567
/system_ext/framework/androidx.window.sidecar.jar	4102	com.gama567

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gama567

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gama567

com.gama567
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
PID:4102

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CFPGCore

Path /data/data/com.gama567/databases/CFPGCore
Size 28KB
SHA256 177300d34c6b8d99e4e7240e485d68fb4cda430747fef3565ede3b8c7c00e0a4
MD5 7a759d99c6763208fd0360ed1b1fe24b
SHA1 d185d2697f34c72267a87f9a8c9e1783f9153d61
SHA512 f2fbc6fc42360c33c2fbafbefdb0fdfab1f5d0d6a4c97a381db5f524033e6a2c506a5e8fab4bea4eb67cef8939ae76444f1e38c76dfeb5725315d8409f423b0b
SSDEEP 24:TLlS+sig0EZFib3FTilviiMN8gZ6GSiIQ:TBSjGTsqlS
TLSH
T1D9D2E0DE8F103752D1E61070D8A023E31E3CAF2D9B4DA7DB479444F7B8812766621938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.gama567/databases/CFPGCore-journal
Size 8KB
SHA256 7bda71bb32aa204209b1108767c49c072ddf77c9bb5484c3db99e7c0f232eab0
MD5 8f3da1063ab4ad278e8176996795f36c
SHA1 27d002f236637932be47d6da7e96323181c7165f
SHA512 93350503d499a02de880e29ebec93546271c0458e548cb8b14b599af00296dce7fc080b892daa50893ea2c429aea97816a9026fe105a2ea3ea7da2940efca6df
SSDEEP 6:7+/l9Q/mHPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuK8mM/K:7+tbqLJdKBRmBEyPblK
TLSH
T172022288A3400803C01D977790E883801E10A7148323CF2B159008543CC2ACCBC90F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.gama567/databases/CFPGCore-journal
Size 12KB
SHA256 64838b9498e634877bf24b07f3fe76c38eb590ce32c4035cdd5d524f3133b260
MD5 191f634339d1c733a140ba61c5699c05
SHA1 44fc6816f5cc4e5453386eab124f47e3525a29e7
SHA512 1db92fc0e68fb194a4f01f72b1b8326c478c6b4d9fe16db1797ed73aadb4a9a4b1b41e777569f68352ec34293dc9b44bfcb208e17f7549d030ce3d00b81a6f22
SSDEEP 24:7+t7FeqLI+sig0EZFib3FTilviiMN8gZ6GSI:7M7FeqkjGTsqlSI
TLSH
T13D4206DE8F213B52D1E66070D8A012D35E3C6F1DD74D77DA079485F7F8822766261934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.gama567/databases/CFPGCore-journal
Size 8KB
SHA256 e279e59b198b26f687c527274d29ef1a3b3514d1afd8ed35e623960ea8e2a573
MD5 102b6a7069f735c9b6245064b7468db7
SHA1 90a484295f57482c014f0c5abfeaa6f148dd5a3d
SHA512 6b37605096e6cdf292472a38fe08d084b7906a64a0a690cc4b4e5d1c2396e192758dc5090202c642b8536be1c3dfdb6e6c3c38fe1b81b77f7f26b9df354b2b25
SSDEEP 24:7+tjnkWqLEb+sig0EZFib3FTilviiMN8gZ6GSM:7MDqobjGTsqlSM
TLSH
T1D70202DE8F113752E1E61070D8A422D31E3C6F1D9B4D67DA079445F7F9812766212938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.gama567/databases/CFPGCore-journal
Size 8KB
SHA256 bda7fdf7dea00a3b3cca382979a3abcb023a1c5551b01cdec61dfe04af7e8494
MD5 56f99f1e3070fbbe4eeb99b60aee75f7
SHA1 3c1acd3c2628169b2daf7ff420f9c7a695872b3f
SHA512 eeafb99050f8509c907472846f2d2564c0e1e0413b46de0e77ca0c86ca7d7237d4d18869f895f531b966326487909ac2a397a2ea599ce4fa74220f49a2b06e8b
SSDEEP 12:KqLWuS10qn99G95GE9Q+O6MZFipHxHAwFOB+Ot/mOjRE4xFCni6j/vHX66OnRZGm:KqLlS+sig0EZFib3FTilviiMN8gZ6GSV
TLSH
T1080202DE8F113752E1E61071D8A022D31E3C7F2D9B4DA7DA07A444F7F8812766212938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.gama567/databases/CFPGCore-journal
Size 512B
SHA256 97d7a383651be8fcaac03962074d72b4feffd365813648dfd91209eac85aff76
MD5 6d6ebeb6b316a6d17e397fd295c5a320
SHA1 a368002849d62100a572e07e7647139b2a303e08
SHA512 066fe5d62057f66c8ac16ac96d615da59c89130b2cd5ac712aecda86d389af170b7f5b71c98e77832c9434697a5ae3703f3fc37ae456dcaf17f211710f04a247
MD5 SHA1 SHA512

Submit Download

CFPGCore-journal

Path /data/data/com.gama567/databases/CFPGCore-journal
Size 8KB
SHA256 882b245b7320ea9bdb2651d3e4b7a97e397f8f4aaf6f665769339039966916d6
MD5 87653356c88a8e19b64e124431a03d7f
SHA1 e9be831e4b24e51e737026a47788026c73b166ac
SHA512 91ffebc56cb9d7ca5d4c0d1c809dd2169b7e6e57dce3b51dd92f1ec1165b933f6f47b39d67d40bfa2a6c1c9a813e228157bf406b6fc5295acd475f9a6bf0813e
SSDEEP 6:7+/l9d6n1bg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuK8H:7+tEqLiuWd7RmBEyPbbH
TLSH
T1FA0222D867900812C81996B790F883401E00E7188272CB070AA008942C034CCF8A0E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation5612173551580735854tmp

Path /data/data/com.gama567/files/PersistedInstallation5612173551580735854tmp
Size 90B
SHA256 9975860072e822e9d6c62705b88534e1e6504bfdb172188a6a07e8784860b7e2
MD5 590abe1bcdde183e583df26670a7050e
SHA1 67e9b68c277cf9cc54a49d950b9733cb317f89b6
SHA512 a78e094f9435b741b9d20d250c76c1c919d8bc386865fb6b7d70a960140b663ccd465ea8cb1e70be8dbcf3fc463e1fd35ca35519aa856a7f8fd13851a0267fbf
TLSH
T16AB01248E7718182C485F21B1C8C91005DD024401C098B06CB0CE18040C11E2D103EA9
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo5ODI2MzIxNTU1OTY6YW5kcm9pZDo0NTc3ZmJmYWI2ZWRkOTAyN2NiNTY5.preferences_pb.tmp

Path /data/data/com.gama567/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo5ODI2MzIxNTU1OTY6YW5kcm9pZDo0NTc3ZmJmYWI2ZWRkOTAyN2NiNTY5.preferences_pb.tmp
Size 372B
SHA256 64cbc835e6a244b5bbfe2bb6bdfeab706dfb597145723d2792fb05f346ee3b66
MD5 0915c26874b465938816191c08970b15
SHA1 7f785129990671cd45b77658830be9a6ebefdc6a
SHA512 37308f6ff5e0b585f942f28d2006bfa59a6185c013cdc07c9fcea5165f001308c6a30d3d1efab5a9b4b9a49c31c9af1f8bcea7c10f0bae002870d81269c057c8
TLSH
T1F3E06800E7E19DE01D3F128D7BA4011D4F6FF39460F5009A24E401C4F61AA86E1C2E2B
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.gama567/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
TLSH
T183810250534000E1D05446B354E113080F06D19496428B03550100428C415440C60E88
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.gama567/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 be278d9d1ddf090265502949a52915e00065c931c6abdce3fb4c19f378996b30
MD5 a021281e124d928a9a3651ae72a3a472
SHA1 47a4211377e65df1492a62817241a480f047662e
SHA512 d2192258f04cb3b78fb5c5fd611745039420cdf9971dc0c4fe22c492f5a0e075cb565383043a1acf3d1406da8a65723756c2e2bf2512127f91331f8f5a1943c1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-wal

Path /data/data/com.gama567/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 ecc14fe102dd90eef2717358b03fb48f45d80cec23916dfcdebf9200642130b5
MD5 c7a3d743580062e4c594017ac08af9fb
SHA1 289788cbbf372bcf653ce6d8e93155cba1dce33d
SHA512 7f8e8e8fb6535c0be7123b3e1d97b2a2b8e384f730d5c7342e0c12fa258d1371b958c08adbbfaf2155cf6396841cdc171b870e2fd14ce023acdfe2cdc7be3fa5
SSDEEP 6:KO4rZoMMpv9FZdKEAlOERX4PBX4ogLugMBX4suuK+/XwCwo1FbvpTOw2:K5rZoMMXzdKBRmBEyPbP/XwCldTOw2
TLSH
T165722B985B802D02C546B33F49E8C3040EB096495723CB5B164118553C0B7CCE0D9E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.extensions.jar

Path /system_ext/framework/androidx.window.extensions.jar
Size 123KB
SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
MD5 3056e1bdb7d4e19789d0319eff484bd0
SHA1 6791ae47aa9466fe0bca27ad6643f846853bbee4
SHA512 c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658
SSDEEP 3072:8Pmsa8v0v8FYNMhpjLXZ/pziNQdysk4p26PQ:Qmsa8vXhRLXXOQGJ
TLSH
T19DC31951FA4159A1DEAE933B959B1301AB30A648AB2383137654D0BCFCD73C39F87AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 25KB
SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
MD5 29469324e59dfcc052f24b5af4e7b2c4
SHA1 10c1e17ac6f598037bb51baa07945663645de4eb
SHA512 5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2
SSDEEP 768:bjydnTmp8WNAupUuvkg5NrtsESOMXIpc3dRwQA0:bjydCpF0uhtsxOQIqdSj0
TLSH
T1A5C2F716E7400C63E9FF9A3B6A5B13009F35E3A4AA43471B640585A4BDC63D3D9EE7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads