Analysis

  • max time kernel
    14s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260325-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
  • submitted
    23/07/2026, 00:15

General

  • Target
    EasyRetailPOS-Pabili.apk
  • Size 8.8MB
  • Sample260723-ajvycaeb65
  • SHA256 6e0d135b0d5dbad06d2ed4c96ae6ee665c77d39828bd3c3db090e3a6a1bd920f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs

Processes

  • com.posbase.frontend
    1⤵
    • Acquires the wake lock
    • Queries information about active data network
    PID:4261

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        journal.tmp

        • Path /data/data/com.posbase.frontend/cache/image_cache/journal.tmp
        • Size 31B
        • SHA256 8f22a32cd8de58916041d1097976f2b9c80f7e9a18593d5a6b058bcaed17e22a
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events

        • Path /data/data/com.posbase.frontend/databases/com.google.android.datatransport.events
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.posbase.frontend/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 cb217efddca2f5807f6ddada72574785f476332ffdaa5b556a32a84b2d206687
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-shm

        • Path /data/data/com.posbase.frontend/databases/com.google.android.datatransport.events-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        com.google.android.datatransport.events-wal

        • Path /data/data/com.posbase.frontend/databases/com.google.android.datatransport.events-wal
        • Size 68KB
        • SHA256 20829a413616b3ce16af37e007feb9b3c4d5ac59d24cd17900c6931ac57b2915
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.posbase.frontend/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.posbase.frontend/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 7d716d32ab358b853c19315f8e6614460c2c910253215a7cde43d8a05c4bd4bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.posbase.frontend/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 eb9a00267fe4759fc44ca592076098291fad62a226d41990a8d5f5a47916f16b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.posbase.frontend/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 6ffef8d0483419468939d32736f88cfe1fe0f1f58b566a51824c169946efac4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.posbase.frontend/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 f640b29aba14639de19cb8243af540fa0da3ef90c383b92ece19cfcdefd7eea5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.posbase.frontend/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 8fe0ac9db76d4a2dcd3b3d54c0efedcd223e25aabf716506493d50e243a7a2d4
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db-journal

        • Path /data/data/com.posbase.frontend/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 ad17859ca1d0b66f4d5dde3fd0967b9c9bb24c1e5091d91d62fa04c36196f0b9
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-wal

        • Path /data/data/com.posbase.frontend/databases/google_app_measurement_local.db-wal
        • Size 36KB
        • SHA256 2fedb3b9dfa883a86715d59be8c503f956aa6c757a4fcf8cc4b05ebab03ef55f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-wal

        • Path /data/data/com.posbase.frontend/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 8deb222202e0f0e89e5b1534f268539716c14162ead29b464fb0c59085626eba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-wal

        • Path /data/data/com.posbase.frontend/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 fee3268a3b036bedc5ce4a167875a8150673aa3a400037a82475160ce9aaafc6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-wal

        • Path /data/data/com.posbase.frontend/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 6a465f5b9a00cdeaa80308d12c7e0a959a199acf49effcf23857ecf26ba994e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-wal

        • Path /data/data/com.posbase.frontend/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 d0c7fe539e9a2f0b4249914fcfd0d2d564bf4268d277ac2535c5539b258ebcc9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-wal

        • Path /data/data/com.posbase.frontend/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 5b1bd82da0e491421641cd7b540140a8e5922d5f46fe3929df38cdee08fb3a58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        793b0680-509c-4280-b25c-bf12810f7eac

        • Path /data/data/com.posbase.frontend/files/793b0680-509c-4280-b25c-bf12810f7eac
        • Size 2B
        • SHA256 8f434346648f6b96df89dda901c5176b10a6d83961dd3c1ac88b59b2dc327aa4
        • MD5 SHA1 SHA512

        PersistedInstallation1162784814183637492tmp

        • Path /data/data/com.posbase.frontend/files/PersistedInstallation1162784814183637492tmp
        • Size 90B
        • SHA256 12e157195935d12631bffcc9055dae4d6099c3162a2dce50dcdce8aa67a84628
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation4883495374418334450tmp

        • Path /data/data/com.posbase.frontend/files/PersistedInstallation4883495374418334450tmp
        • Size 570B
        • SHA256 6153429b10a35c49bb2308ce5d66b1a8380a0036f293292a538cc070e027b555
        • MD5 SHA1 SHA512 TLSH

        profileInstalled

        • Path /data/data/com.posbase.frontend/files/profileInstalled
        • Size 24B
        • SHA256 d500887a7aa9e2ba5ff0e0cd8ec02dcb705b2d33ea0e799c6e78c02267325761
        • MD5 SHA1 SHA512

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.posbase.frontend/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 d1eb32f2f36e0cf6a88e4a05dacb9a41f7868dfdf98205bce3879ee2ed594a46
        • MD5 SHA1 SHA512

        primary.prof

        • Path /data/misc/profiles/cur/0/com.posbase.frontend/primary.prof
        • Size 5KB
        • SHA256 6cfac36d0ab519a2476e00f259ed960d29be8c21be51aa98146cbb09f6c8172f
        • MD5 SHA1 SHA512 SSDEEP TLSH