859485ce377767cf55903a1fb3f18e740bacdf18a792629a8ff15a5b5382e5b5

Analysis

max time kernel
122s
max time network
150s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
20/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
instapesa.apk
Size 4.5MB
Sample260720-pgs4ashy2p
SHA256 859485ce377767cf55903a1fb3f18e740bacdf18a792629a8ff15a5b5382e5b5
MD5 89646422002de7930a7b0fa6b1dc679f
SHA1 a623a68ab681be1a6d9dd4c7cd7c78e0d81083c8
SHA512 b763c7a252b56a23e4ca33d3014d115ea01e85c16d1b251d64a1c4f06581a3cdc9b98a380c843a86ee983c56c02358d49b0fb00a02e1c21d69f1d2eb24eb1610
SSDEEP 98304:wsj4INrvU7DWK9mjWgcwwBqNi5XsoOv+U0gLCrzmdvL3R:+Iib97q8XsDVdvF
TLSH
T1BC26F19AFB68D92FC4775132596A5235565B4D028E839B4739443F2C38BB2D80F8EBCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.insta.pesa.loan.tz
/system/xbin/su	com.insta.pesa.loan.tz

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.insta.pesa.loan.tz

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.insta.pesa.loan.tz

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.insta.pesa.loan.tz

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.insta.pesa.loan.tz

Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.insta.pesa.loan.tz

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.insta.pesa.loan.tz

com.insta.pesa.loan.tz
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5057

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.insta.pesa.loan.tz/databases/com.google.android.datatransport.events
Size 56KB
SHA256 b3e1bf9bbb8f420ce3e68610c8059202dd728606f8e84bd59406c56791135d08
MD5 7e5367b29d94a21c2e88020606d19d4f
SHA1 0d2f741765290f17524be7754b805feae36a561d
SHA512 4adfc0911073081c442371a38a9a77798a9a35b338c9118f6782befb82b5336be003336fa967d816406de912c6d1482ba6cdbdf55bbb6c30944f90f8b1a26837
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPS6r:8MEX0wIyNja6r
TLSH
T14A43639D1E2C2221C57E283ED3E143635B7C93DF5723927239A08CFA8DC206974358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.insta.pesa.loan.tz/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 a0e1b0aaede8e2ba6da377ac38711b4f7e697361e5855318832b1af1149206ec
MD5 c9c8eb39e0c902603948884bb3bb4c8d
SHA1 0eb63cb7fa7f09b0343996e73cf728915772a320
SHA512 fb04370810c5e2707d5f2ecaba7225ffdf9106dd7b87a83d2315f23a1d962dec99139a94e51f2ffd9af8f955bfb49c4d62e0d9fc15cee63d7e484ba34febfd1f
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.insta.pesa.loan.tz/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 5932931fdd59b0108e426d5226a3db9dedd129f90bf2022b1dd16ced8dd33e5a
MD5 9b87bd449922f8b9e786e8ae22d9e44b
SHA1 101bd6c83abe5ddec1f12d07fbf9c8886fab600b
SHA512 1fe033d847de101d9e41d98ed4923bdfa9eefafaf59f7e2a42521c2dad94285fc3816cde6bb710d6c41bdb37f8e312bdb27f3260a94c05e3c19cc7d0f65541b4
SSDEEP 6:7+/l9feCGn1HlJvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK8L:7+t9effqLiuWdwRmBEyPbfL
TLSH
T10902228BA3800A32CA1DB6B7A8D683902E00E7298161CB07196018983D035DCE4B0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.insta.pesa.loan.tz/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 cac6e02c9bdf5ec2c94df7e405bb22871b04927bb94cddf8512ddd940231b686
MD5 bc7123e69d6bebc16ac5b17a6daf04aa
SHA1 f88a10cb7723b71122e8717cf7aed3979f454ac2
SHA512 f31e8f054ff05014c01c623427b1aa912d704d12dac59f39acabc2fcb17a686792ce3bdd291b3fa3d18d37e949afa8d9d8bb2bffa856602eaf4a2109e2be0cf0
SSDEEP 6:7+/l9B25sFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKSt/Yp:7+tisBqLJdTRmBEyPbRYp
TLSH
T1AA02C08973802813C11E17FB90C883616E10E714C333CB07156028D97C036CCE8D0F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.insta.pesa.loan.tz/databases/google_app_measurement_local.db
Size 16KB
SHA256 3f983098433b5c5201836b9c6d8d5f79ffbe25ca3566accf2114674b3e1fa3d5
MD5 f824c96f51653577664e65b0d2f2df8b
SHA1 43c3c84847563a3aff72a31e8aebabc43bd35e63
SHA512 bcf37a1c5e4884b485ea393eefe8a539bc4a2034246f4d29b99f13120e42423595de8a4d49dc0db625547c994ac9916bc8b5b1eac2c35332d865e28dea25310a
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqNsv2sss3:TLWuEOe9zmzrfRmBEyPbB9V3
TLSH
T13072C2CFDF102603C1760677F8CA93A56E14E22D8337AA476BA50464AD42449A8A1F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.insta.pesa.loan.tz/databases/google_app_measurement_local.db
Size 16KB
SHA256 8a9807981fafd77be9b2005350937ed3e260cc995d4f8ecf73ac999dd2b4011d
MD5 8d7fe7b88f79f1580861e1203f1906f8
SHA1 5f1d886a211d8ab76f7aab32add59a73aa3e5ef5
SHA512 7d7a6de8c7de320792395ba5585f679da53061a74d89660c0d25b85b3b44be57d36dbeaedeebf44e47bfcb7d336a075d4433d2aff5838d3bc4b23f2a789f2de3
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6kAM:TLiEy9zmzrfRmBEyPbP/P+/0Fl6kZ7
TLSH
T15A726FCDBA106703D27347B6B0CBA3E22C34B2188723DA0B7B980468AC42289A082F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.insta.pesa.loan.tz/databases/google_app_measurement_local.db
Size 16KB
SHA256 a2b1d8310e06d06c751cc2e42c85ed6ac914313d048a0acffa829053a1c75efd
MD5 c162d3373142a3022bfca512455f7761
SHA1 98db8370421d4fe57de03a4b53fe869a3b8ecadf
SHA512 ed27807f47b7d5807e78389e09af329a0fc7e6eae28e61aa069b50bd60b70e06ef3abf44512d8fe772ad29993bfbab4da62031aaad37a2a38bc5d6cefcf56efd
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFlwF+/0Fl6kZ7:TLQpmzr0GSP/h1499FalFjZ
TLSH
T15B7259C97A109703E2330B75B0CBE3D12C38B2155B63D50779091A2C6D423865012F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.insta.pesa.loan.tz/databases/google_app_measurement_local.db
Size 16KB
SHA256 34142d616af50f0a5154692bb63fa8370cf67c3c6271e52dc948d069fe2263cc
MD5 79e8630570cf7a24fa3f188f0ee9ed91
SHA1 ceb003517b4d041232b477a19b402cd67b909e84
SHA512 8d564535cc13c53fa2e69ba2612e49f798a20109cff5e80d562541ad4af4309d3434ff17cff6e8d7cefd107ee387cec5e103e2e401e2c19967df7c602a1385b1
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/JOLabCAUx7jWlGov49blqYFlwF+/0Fl6kZ7:TLEvpmzr0GSP/JKabCH2d499FalFjZ
TLSH
T15E724EC97965D613F2774B3961CBE7D2383871665B67D6137D0A2B1C6D423858121F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.insta.pesa.loan.tz/databases/google_app_measurement_local.db
Size 16KB
SHA256 99f04650a23ee117ddd123da5ec1be60b9c80ea95dd6ad887f3aa54949aa45c8
MD5 04af9de84f6e4744dc43290c60ca1517
SHA1 ab5353f0dff5ecc9d1f850c0d81a0e2961a72ff8
SHA512 750aa6af94e896e02eeafdae9854d914fbbddb977f9ae3cc0975782ccb05980493fc66c4741b279dd2a13f48b181f47af5f3e6da2c8816b35ef4eded0e6e6a5f
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/uOLabCAUx7jWlGov49blqYFlwF+/0Fl6kZv:TL6Xpmzr0GSP/uKabCH2d499FalFjR
TLSH
T173724EC9BA65D613F2734B39A1C7E7D2383971664B67DA137D0A2F1C6D423858031F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.insta.pesa.loan.tz/databases/google_app_measurement_local.db
Size 16KB
SHA256 458aa953a9e0adbf5b8765ebcf6b51bc5b5a48b7664e85d25c7a8ce9781a2d5c
MD5 2f1eeee3602c828b8e9f81f6fbd20d41
SHA1 d240b568bb6929702815b9a5edd05ad635671caa
SHA512 a8642cc12cb9af0cd9d3fdc4bb1fe3b246d02af6b36714d80cdd2809def699b0b93eb585187c17f0a8e19801879e2e9edef7963ee416ae9e8cc35fd9cede2859
SSDEEP 6:l9bNFlgls1qlvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WK:TLuEev9zmzrfRmBEyPbP/WK
TLSH
T1A8722BCD9F102603C5730777B4CEA3916E14A21D83379E472BA90574AE834499061F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download