26934ab7fde5df4be5281ced5b424308e17a0a1740963bbb464207730bf083dd

Analysis

max time kernel
7s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
28/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sara-user.apk
Size 3.8MB
Sample260728-pg3bzaha65
SHA256 26934ab7fde5df4be5281ced5b424308e17a0a1740963bbb464207730bf083dd
MD5 7210c77148fb21cef29c0e99031e1d46
SHA1 654518c88219c56f0d16f8080255560a5674a404
SHA512 797dcc94239024d782eafd8cba357aae15cced8d53fc25b53ac7558bb166046ca93adff1a398f53476b4dbc0477e6cf0e6cc71f218b9d02e0c99c00acd3f4b59
SSDEEP 98304:TcfHEUJJb41X7aEodcLfGR3QaZ72rCKQ2E9HBQmQtFRrYVHD:ThCJU1X+1cTe3l72rCfrIYD
TLSH
T1EC06E14EF35DB92FC47F503249AAD33622564D168E82A7076858376CE877AD80F4DBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.saraduser.app

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.saraduser.app

com.saraduser.app
1⤵
- Acquires the wake lock
- Queries information about active data network
PID:4812

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation3574658106966895619tmp

Path /data/data/com.saraduser.app/files/PersistedInstallation3574658106966895619tmp
Size 90B
SHA256 79485daed4ae704523beba26310302ec81ddf98fc1f31167ec01e981166e33b8
MD5 5b408eff9fee8ec7548e1c2197f9be5a
SHA1 d37e370e668ea0d042cab055118204b485564dfa
SHA512 cb074e56acc49dadd7b2dae4bce1dd73009c144a89390d2b702a4d24092b4f575d80be8772f4f7bc49ffc2bd50405d9a12a2566a5f6074c0a20f8fac4fca371e
TLSH
T11AB012008A754142CDD9B6021D8FA1006D5015810409CF940B0DA48000823D49243DA4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation8785786020128137674tmp

Path /data/data/com.saraduser.app/files/PersistedInstallation8785786020128137674tmp
Size 566B
SHA256 97a419e842bb74c36f40441237fcd48afc565be7f0da6ae827f050dfcd7ec40e
MD5 3c3df649f062f62ca6b8123ca22bb165
SHA1 b1a7f9085295102a9da85b9caa7a6e4cf999d81d
SHA512 0ff479b304a14586e807a2dda62911fb8e8ad259de689c746ac129b8031ebba15163ebe3cafb0978e6f8dcaeb58821686db43faf1638e7a246a8d726900b7a34
TLSH
T1E2F0E1AE3560CB0ACAE95082686DBE051E3849F601010AD7FA8D4CADC7ABF58E35A448
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.saraduser.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 22b62f2e6adcbbf69c4811f4212c19089685d085a9d14a4e8608556eb2e6d6d4
MD5 31635b5416de33821eb57f98c757a391
SHA1 db4b22f976718a5cd4c92e27dd642eeae3ef3b75
SHA512 bf39d83f5b123acf69f9f30ef6e1cafa65ea1f89eb05bb5ef63e3fc10d8eacde398b168c9489304dff06607de516d2d2e01086f855deea1d3f258ca37ee394cd
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.saraduser.app/primary.prof
Size 1KB
SHA256 9a6ef99d82cb11a5235614353c99d1c5d5fefdae5ed2ada2dcdb81308f157d75
MD5 7601703e0b9a62d6b3e19c57eb5164e5
SHA1 e2c92578c4281a617c04cbce26607f42be23b85c
SHA512 35ee79fae53a95c25e0182a2429af3387bf1cc98966b81855ddeb2b073e38b8f676cb0790b9726cc0ab5ace1f6977a0ba14f7b1062496bcc267e0f7f77a821a5
TLSH
T1EC410C09C6948792895BA872C0477FF67FDBE945F9F15D8B583AF58831C10C5403B884
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads