Analysis
- max time kernel
123s - max time network
152s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system - submitted
24/07/2026, 12:19
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
indiaflagl_udq6zt6s.apk
Resource
android-x86-arm-20260325-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
indiaflagl_udq6zt6s.apk
Resource
android-x64-20260325-en
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
indiaflagl_udq6zt6s.apk
Resource
android-x64-arm64-20260325-en
7 signatures
150 seconds
General
- Target indiaflagl_udq6zt6s.apk
- Size 758KB
- Sample260724-pg9faazdkf
- SHA256 2c7270e898c5c0e61bf50d9335a547c1e2b408f6ed1c07bff9d669ed245841f6
- MD5 fbeb2af5614d01955a78d107c9c8b6f2
- SHA1 9f9400e41618d044eb41a7bc24b722dfbe357bd1
- SHA512 d68bf3bc9449bea61668a5984e4ac85c3f01f1423fc843d4038814f7dd58f90c79e83f31311b4cf0c6c07e8c10ccd4ee953ce3366a9fc2fb4b9fa9ea9b18601f
- SSDEEP 12288:KqSPjoNn/NKN5s2vCOjmp8T+qSnqSm1RDGFuqA9jsLZ4y4nNyh3R0V9ld0/x7i:K7P6nYg+07n7CDGAqRSy0aP/xu
- TLSH T13DF42304F7593857F13D5B74CEA157436A8D2432465AEA0B60F0D0592AEFBA6CF00FAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 8 IoCs
ioc Process /system/bin/su com.wickedfreeapps.indiaflagg /system/xbin/su com.wickedfreeapps.indiaflagg /data/local/xbin/su com.wickedfreeapps.indiaflagg /data/local/bin/su com.wickedfreeapps.indiaflagg /data/local/su com.wickedfreeapps.indiaflagg /sbin/su com.wickedfreeapps.indiaflagg /system/sd/xbin/su com.wickedfreeapps.indiaflagg /system/bin/failsafe/su com.wickedfreeapps.indiaflagg - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.wickedfreeapps.indiaflagg - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.wickedfreeapps.indiaflagg - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.wickedfreeapps.indiaflagg - Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.wickedfreeapps.indiaflagg - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.wickedfreeapps.indiaflagg - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.wickedfreeapps.indiaflagg
Processes
-
com.wickedfreeapps.indiaflagg1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4385
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.wickedfreeapps.indiaflagg/databases/tapcontext
- Size 28KB
- SHA256 cead145121adf043450199025d9c1abe5fd5a4199fc9c228ec7082d644609c4b
- MD5 c3db527cd1f616aa2994f315a11ed7d8
- SHA1 4b346b3ea6396301119e9441469feb1a8112323a
- SHA512 d703abf4bccc60dcd3063ffadbc7f8b606084b885b3f23769469e6c9921c5e4251226a4d6acfad7f1ca67ca6289ad9da51355c219d460bbf3cd1cac932b3d1cc
- SSDEEP 12:TGO89qWFNKQU99wzbhRJTSFbyjLH9wzbhRZfRmBEyPbGtOwGQ:TGOWqWFU5+JNR+Z0GSiGQ
- TLSH T150D2995FA7113212C08C12B76CE25293AEF4626EF74386D23AF11C28CD82654A832DB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wickedfreeapps.indiaflagg/databases/tapcontext
- Size 28KB
- SHA256 0cd261b114a61b31cae539845fce2ade91a30a6d8279007502a13d90f0a43833
- MD5 c7d8a78e2757fb2353f8535de6a159d7
- SHA1 ccae6ae8b898238a5278a45dde7a5167a3e7ae98
- SHA512 09d1a78db03cf549928cc4afe4b97fe13c62a4c38d3f541b7b57a8bc4cdab2c398d78ac44a006568026627f419986b33498248c7289cb62f147c1de5a223cb68
- SSDEEP 12:r3Dpj5/H/oRp5koJStYXjbpWE1AFU4FCEV9+qk/UhzvjkKWH9ToKA28haYX8IG:rHP/ohkoRbpW1F99YmfkKWH9k9aYX8IG
- TLSH T1EED2CE18DB4598FBF34C06FAB9CA8EC7E7EC12796002781B1497971421A919A357415B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wickedfreeapps.indiaflagg/databases/tapcontext-journal
- Size 512B
- SHA256 f7b327d8205c3cde1d68f4e6361216dfc7d36d6318f9bc7e3a863176a0377e3d
- MD5 cddf3c1e34d8381e1127b55a9ba6aa71
- SHA1 bdd76c5b61a1cb773a3fd2a97c646397184c1a6f
- SHA512 1736bae15475b359a662522a1d8f1e14fd7b19c57bd1ec38ca6f942adeaf0dcc3b7ccca334240965360aec4092a74d904e12090d9a8cc853f21cab786f0c32fc
- MD5 SHA1 SHA512
- Path /data/data/com.wickedfreeapps.indiaflagg/databases/tapcontext-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.wickedfreeapps.indiaflagg/databases/tapcontext-wal
- Size 40KB
- SHA256 3b15b9048e94335ef82e6122e01799459f4f45f460e184c6a11b5bfff2c54649
- MD5 73bc9c4a2bc1d78004c0abc8175b473a
- SHA1 c5db740d8271881c2245cc3a29c7ca3b162dd843
- SHA512 5b53e10c22398e2ede6b38e32a551f5fcbfcb80df10decacc247248cc95791c52ec6931f27f37e12f7565070c73deb3ce048ddaa33ac658561110a8ad5973882
- SSDEEP 24:KrzyGSP/8IE1L0jXGOWqWFU5+JNR+Z0GSP/LNX:azNSP/8IiAGOb5gzuSP/LN
- TLSH T18303AF9FA763320BC14912BF78E252436EB0925AFB538F8736A1182DDD416486472D6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wickedfreeapps.indiaflagg/databases/tapcontext-wal
- Size 12KB
- SHA256 9b87f6440bb8bd31079ff91909ffba98d278b575e5a171b76114bb5eb6ac431f
- MD5 95f6e0a8a73961b5b2fbca850ac26147
- SHA1 a3f51c52ca9b375083fe29b29075d6e62457d8fa
- SHA512 c5176f4eecd54b03b23c75f2d8416ba88baf7eea597279c39db0f08bb7573abbde1b164fa6d59c662b3100730145714af24addac675e6b7d2f96c289b6ef2fa5
- SSDEEP 24:KVHP/ohkoRbpW1F99YmfkKWH9k9aYXoSKG:+vskt9YmbWH9k9P1KG
- TLSH T12D422318DB04C8FBF34C06BA7EDA8EC7E7F822796011640B149B9604256819E317015B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wickedfreeapps.indiaflagg/files/eula.zip
- Size 14KB
- SHA256 73915b2f06df099d29b83dcf60d6e815235b2dc2704c5f9ff365325be341fa2e
- MD5 a96f59c1635e65e5378798a8ba2c0d73
- SHA1 26f8170a326f348593591864f9c3efce259981b8
- SHA512 eb0c2b7f4fa6d7af113b893c4115aae285e99a7a5cad2c66cc8f4a426888a1d6faae88177d3fa5755253c92e774f56e4c01e69003ee9381941634d4b6a6f6422
- SSDEEP 384:jCqQx5KalE4PJYaluigQ6KsYfMoSeCNOvGztoeP5heu/G2Csa/ou:jCVHC4x+d9YfzmOvDeP5kuQsagu
- TLSH T13B62D19431652BB7EE649C282E4714F4F843F7D21E0E289947F845BD278F2AF916026C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wickedfreeapps.indiaflagg/files/offline_startapp_eula_body.html
- Size 22KB
- SHA256 08bb708178046d352f85434f39421674603b6f3069d006487c2f0261fff04540
- MD5 28684f6069fb4ec76a3e54c8e2307ac7
- SHA1 6ecbd36ffe5cf6e77ed57ebf3579412f1581081d
- SHA512 3786c62f2892994e8ccaeca084f97b73bb3279fec62846d7bcbe176a18abc52e120b13aa2f34e7a6292b2ae7fd3ebe62e68a5054fbccd4e21d073237418e6876
- SSDEEP 384:SpJSAy4u/DgrhOIIpyq+eP3Zid5//Db1sE/D9yvtMJ45/TUiA:SpnMpyqpP3Zib1sayvhx1A
- TLSH T1BEA20A25E2463949B036C4F49522AA09FF38414FC7832ACDF96D7BEB6F725D0842B6D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wickedfreeapps.indiaflagg/files/offline_startapp_eula_footer.html
- Size 13KB
- SHA256 1f075332b57fdfbb9417718f3c0d9f27ffbb2c135b3291aca4b9f2911d7e9e3b
- MD5 9818dabc2eb86d5f4f071e9d67334570
- SHA1 117e7978c9293d86ea5492b90a4999cc24225dbb
- SHA512 79937390d4b02688abb0e24cef356024c3dbd3cd59d85ea3300556af59f0648293ed24fb5db740a4329fdddccf43af3b7679135555397a3adedd3eeccf5423a0
- SSDEEP 192:SIC1VPawVyCxZ7/YDLFn+D2yi0+DZQuDSeDOIDEFpS4V4GDjFu0QE69HqKS1cBIZ:SIiVxSAykfVBDjFaW18IZ
- TLSH T13F527564E2053856B137D1B4A726A508FF38404FC6832ACDF9ADBFE56F31594847BAE0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /storage/emulated/0/.bugsense
- Size 33B
- SHA256 e3671e395962f504997c7b196c171c51b8c67311452d86d0f1b4fc01ecb66910
- MD5 e9fbecef5486f275b2a0060623d00626
- SHA1 363e253d162058a9b6ffeb5a9754984042b9ff4b
- SHA512 2035e2716d63708ddedd2d31f391b71387a8900a2ac173e8684663d9c94b5212cde69bcd2d1cd2e11c686c7265912617cbc58d4da1fee8af8de0d5b29f37190e
- MD5 SHA1 SHA512
- Path /storage/emulated/0/.tapcontext
- Size 18B
- SHA256 8cdfa9505fbe0d9617f08d27d7d99d3f5dcbae701cfcccb9549b342cd16c253e
- MD5 7e6c787c297b755effc1faa040edce95
- SHA1 95fc631191a2034314028727ee13730dda7408da
- SHA512 b1d96c1e05f38c3993e7bbf48d6ae74c7d6ab73f2af3bdc8736d72efbeca05f67624a0850b170ff2b103db25b680840b564818204e1f8b05c61360228f369059
- MD5 SHA1 SHA512