Analysis
- max time kernel
147s - max time network
151s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
26/07/2026, 11:43
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
app.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
app.apk
Resource
android-x64-20260325-en
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
app.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target app.apk
- Size 255KB
- Sample260726-nvvzdaeb28
- SHA256 a15e50a753028ff9db51885705d6348113dac5b653cd2bd00dcfd8b97da7566a
- MD5 a816acd165af4d2fab9f7456a89d5cd8
- SHA1 e52d09385ed4289d5219e16a4d7edb03413a3072
- SHA512 71d7b564a0fb7925cfd3bd038a9012117bd0b57aec404fd167715d46148baf00b9c0298dafbb8ce19da2ebac92f842a00f131eccf63d0053c49c500078431b36
- SSDEEP 3072:ycvY6Hy8bGPSsBf0gUC4NPee6amkXA8phswr6naSu+8X4tslDS0RqY3z+xBCNut+:OMySGreee6aPdhvrz+2zVqEz+rCNuZlk
- TLSH T1D74412B1EB358908E99B1D731ABF6330822426208469D14F4D09F3F1673235DA782F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.android.s4protect - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.android.s4protect - Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.android.s4protect -
resource yara_rule behavioral3/files/fstream-1.dat upx
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.android.s4protect/files/libandroid_runtime.so
- Size 182KB
- SHA256 e4cc4c89b6f5448a1e554a381970319365532f05cfc312927b4e18350e128776
- MD5 a3c66b7e8bba317705955c5e6ce63351
- SHA1 a2fb9b5c0d94790f501452679e36fc9c7025c1d2
- SHA512 be3f3553a884307c8f224a1902343798fe0088512a3b52dd17c857a91193f692c48062b935c9e08f11a8c80de65117b1fe974d9e8822724108ac923b479998a4
- SSDEEP 3072:1IUyp2HVTSC4Nbes6amkXA8pfswr69aSu+OX4bslDSoRqY3z+xBCNut+1nF:6U9HVnQes6aPdfv/z+YX7qEz+rCNuyF
- TLSH T12C0412F08EF2C209F7256CE233A686ADA54131108E9C955DBD3D8EF94635DA13B16F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.android.s4protect/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 8a31bc5a83146d6308ae2e284df183e18903cf3f62c2f1c0c38ec65294870693
- MD5 c03eb3dc4b2cdbafa19664467e24c90c
- SHA1 9e2eed1d1e451bde8f715a59325bf0612938e72f
- SHA512 854e1de5c5141bce9816805a87738fd93a575636a4bcc4fcec266338bcc3480238c77e9e2efc869487704f41fd5cb69eb0374762784db81f47587fdec40a4d69
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.android.s4protect/primary.prof
- Size 71B
- SHA256 900d6aa8fa1ea7b46d62b15551b31056c42a83a478966ea7f354feb59aa51377
- MD5 b6d4735c1e36c1bbd4cf15566d129fdb
- SHA1 6d3ae8db0fe8c78303b89ad4197272c2f014fdff
- SHA512 24ba555805da92da3e0a03213dcf743616b0906cb60937343965f21b5a5ebb8d38f3ad978e8cbaaaeddd3a06594cd9aaa0c7ece8440e3dd489eeae8bf0e381f2
- TLSH T163A002BDAF3187C8E7260055404FCB4F2AC3D411A4CF0E16A55C57D665624F25526116
- MD5 SHA1 SHA512 TLSH