pegasus | ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5

Resubmissions

23/07/2026, 08:47

260723-kp9zkagm9v10

23/07/2026, 07:54

260723-jrwpaaac8310

Analysis

max time kernel
101s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
23/07/2026, 07:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5.apk
Size 257KB
Sample260723-jrwpaaac83
SHA256 ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5
MD5 7c3ad8fec33465fed6563bbfabb5b13d
SHA1 e5920f3723e62e1850157f09baf556006bf80f74
SHA512 75da7c118879d9430fb13c5a51d76e1278f0c1474d5cc25c4b9684b7d8c0f93b2e44584eee0f8b0d12016bc1efad367b45ff9ca5609853ae345b6d802ff63d10
SSDEEP 6144:OiJF1SCwcTjQGPihLcfUmu9XuS0nbkDIyTkRJ0P1d41RiFV1iFuU:OqF1VHzqLcfIJ4bqIeP9d4jkKFuU
TLSH
T10C4423E5CA2E677BD102A3308F06F449960E2305C4A5B630FD96D57A1D528788BFBDCB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery pegasus persistence stealer trojan

Malware Config

Signatures

Family: Pegasus
Pegasus is a commercial Android spyware first seen in 2016.
stealer trojan pegasus

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.network.android

Reads the content of the browser bookmarks. 1 TTPs 1 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://browser/bookmarks	com.network.android

Reads the content of the call log. 1 TTPs 1 IoCs

collection

Call Log

T1636.002

description	ioc	Process
URI accessed for read	content://call_log/calls	com.network.android

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.network.android

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.network.android

com.network.android
1⤵
- Reads the contacts stored on the device.
- Reads the content of the browser bookmarks.
- Reads the content of the call log.
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5083
- sh /data/user/0/com.network.android/pex.dat /data/user/0/com.network.android/srcsu.dat /system/csk
  2⤵
  PID:5122

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Protected User Data

T1636

Call Log

T1636.002

Contact List

T1636.003

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NetworkManagerData.db

Path /data/data/com.network.android/databases/NetworkManagerData.db
Size 16KB
SHA256 97c1943ed1e984e7af5d8c490197075b8e43af11568663abee7c61f4e2caf0d8
MD5 2839279a9a853a40909c1dca03d2337f
SHA1 03baa059604d878e22917202fd90fb5f7de635ce
SHA512 bc63d7854eee474c97373a207031f7358bcb8330dcbab015cf2515e21728c0d0737fd3e452e3d4c4be2c52ff00a86a472592c540e374d3293141c425b276de56
SSDEEP 12:TLpEx5q4GUR4AQeX+g4JaLtJaRmBEyPbBvOw:TLcq4GUKI+g4sLtPGSN
TLSH
T1D37220D593402112C5494772D659E3602D70E51F41A2D7FB56501401AD4796DF4D3E8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkManagerData.db-journal

Path /data/data/com.network.android/databases/NetworkManagerData.db-journal
Size 8KB
SHA256 20ce71f01c1e22f76373838b361ed27b04c2a90bd3df6c084468f9c91933d0e4
MD5 8bcb6830721229b9f12ccdf4eaa4145b
SHA1 728b2e70f4f87ab19dbe5728ee9f5335f32f58ff
SHA512 02f67b8c3b09f9f207bf8d0edbbea22ed8021bd4e2c426e3fd667e80ffd25c17b6f2ac914851224cf6da8e7c2f4b623de26c8b762f2e4c668bfa7a018557bbb2
SSDEEP 6:7+/l9dQHn1IWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKyhn:7+tYNqLiuWdwRmBEyPbLn
TLSH
T1B402228967800923CB1D16B790D483681D00EB198171CB37176108983C034CCA4A0D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkManagerData.db-journal

Path /data/data/com.network.android/databases/NetworkManagerData.db-journal
Size 8KB
SHA256 ff5d9ea1bc77cf30aaf857517ea5578f5bab3474b35f655ed1be67565a51a563
MD5 af2578eabb793fd1d0a9fea9faf713f4
SHA1 b66afa6da9cb9e14c04c8a34a57d8bcb03a99bd7
SHA512 44f6ab4343f120f070b2a1e920d97ccd62f5b34581c973b9775dcd66c394ed3969dc90ca1b29fa6ad1aca0e5ec1d27b02b77b0e9b8eae11249f7c732126fa759
SSDEEP 6:7+/l9/gPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKZals//l:7+tJ4qLJdTRmBEyPbEalsl
TLSH
T1F602228963C00823C02957BBA0D883612E10E7149233CBC719600C983C026CDA890D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkManagerData.db-journal

Path /data/data/com.network.android/databases/NetworkManagerData.db-journal
Size 512B
SHA256 faed636e238f3484d914eed722964e2432f57f6edca3ef47a6dca85b866dd5ba
MD5 6c4e3e0d377aaa43d9e007cda673494d
SHA1 2bb41f0fd3d263202608e40a31be65742a8a3a9a
SHA512 639cf9c65736e64dedab07f3b5d5ac08648db768c1e53ce7b03c58067df3399994cbe7a8d7b4da34b3a0ddd7955c360aede3b9a470f20bb92fdb840a74426efb
MD5 SHA1 SHA512

Submit Download

0vlt.dat

Path /data/data/com.network.android/logs/0vlt.dat
Size 12B
SHA256 5d3190b8400788d7b542c5fd33afc35abbacb894e4e34b00f2f2db18e27cec13
MD5 54e6d58aeec56d30455fc004bcc7fae7
SHA1 c089eaa2540bd04d208523a866da8a1f6237fba8
SHA512 f180bbb622842d867f343338fd317b228f1db50da96b65a79f1eda04285978e824e5021cfa29772b92fdd3f09a60010aa74e175e479429b67eb8c6e95b36eb80
MD5 SHA1 SHA512

Submit Download

0vlt.dat

Path /data/data/com.network.android/logs/0vlt.dat
Size 12B
SHA256 838fb01aefc9de602d34081c2fa90e17111119539e1cc7a04086c65c842550a5
MD5 95555e2dd7c8247ee2e774303f73335a
SHA1 66d1528cb2a81de41cc9c9585c6aecf1ace9454e
SHA512 fb03da8f198ca962e49c73b5473fd652edb4cfcfdee372890230ccb17b159ccf7c150364334635ca61769044ef3666bc19b09e93815d4db45df8c42c92cebaf7
MD5 SHA1 SHA512

Submit Download

0vlt.dat

Path /data/data/com.network.android/logs/0vlt.dat
Size 12B
SHA256 3636b3af83c2c2f13004c6e9a8f8df8e9be92425749ec81c83a1a278ba851667
MD5 66fdc0c359708fac62fbe79562e6a8ff
SHA1 846c51c2d64660efbad71f34516813634dc9eebe
SHA512 21fef603a992632cbd06afd425a2065d19ff79ba30a901dc40f3503c843581e59ae30999f09d0f99d9f662e8712aa199d8d51ae90333f58e30a4497606b2e509
MD5 SHA1 SHA512

Submit Download

0vlt.dat

Path /data/data/com.network.android/logs/0vlt.dat
Size 12B
SHA256 24740572a2a6c50d848cd7fc58f46abebabaa210f3513b324d512b996a89ff41
MD5 c0168445cfcdc77f79ddcd81e12d5a6b
SHA1 790bbffc770b307ec8ab6f015eb00246b7394897
SHA512 18242f0172ad8de834f2beac009e5e754d339696531946f62bfc0d45da7e5e881f0a5d473a531e6d94cd227bdb470f472d61cc2e28b7c537bb4c6dfd008120c7
MD5 SHA1 SHA512

Submit Download

pex.dat

Path /data/data/com.network.android/pex.dat
Size 12KB
SHA256 0aa2c4123b0ccd2e11f3ea6bf425488da6b7db400745fb43e8563aa1d5f95731
MD5 138d764910cb46a05b83d5af830dcfd4
SHA1 583dafb10cbfa0941821d9fe721b4a28498ae656
SHA512 874b0c9745cb1446ae6e826e7888b08e1e7127b790bf3842093d16499175922a6305c7244c9b42a854cd7685bbe18d879cb057d59ed45bd30fd9dc11748e3584
SSDEEP 192:FuDgnnzy+vZ5LOtXm12l6cN9lXFx1w0Vw1yNAFtU7H:IDIz5vZe9l7VFCwNN
TLSH
T18D422857EA035D13C4D5C739EA8F8A5C37AED78CC69F6B1B95088320356B50C8BA2F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

srcsu.dat

Path /data/data/com.network.android/srcsu.dat
Size 8KB
SHA256 5f1c4d94b3c91704c3955b8954ce543eecb292da4a58b7c61e7592adcffa0f33
MD5 f091e95aa696a326b4b948869fd3df78
SHA1 3e2b4a81bac630973a990ed1e9e0a973158a818a
SHA512 0b5ed603ca79db5a98e2b4e24d98eecedc7bcdc660efb37241f9c3e40a68e9fab5caac53a1a4e3fb6cfd99ac40c0ab8acf63d4e5ff96c7ab03aebec4f87b35f0
SSDEEP 96:KmVOrGCiaVoJt7LQcVQCkcNjLN0+ocuNILPf3PmwEpDvQ8M+Kwwj9OpYvF5vWCkm:pLLztXQ9cl6e8kXFx84w0rvEh2h
TLSH
T1D5020859BF43DA25C4F01A7FFA9FCA9C3352979CCE8E221296088225354F4884F77B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads