Analysis

  • max time kernel
    125s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    29/07/2026, 04:33

General

  • Target
    86708ba639c7795a7c263ab11fa59ac24a2510cff1b03b648824c13d65994774.apk
  • Size 209.0MB
  • Sample260729-e6w65sthpb
  • SHA256 86708ba639c7795a7c263ab11fa59ac24a2510cff1b03b648824c13d65994774
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.pt.bark
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4735

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        environment.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/environment.json
        • Size 12B
        • SHA256 80be2eb0944c0453a6ad339a56e1c8f39f8cc57a4e627758246ccfd274176fd8
        • MD5 SHA1 SHA512

        release.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/release.json
        • Size 24B
        • SHA256 06baa5c76d16efce43352feb8fc3384036971802240b158a77988ea4535aca06
        • MD5 SHA1 SHA512

        sdk-version.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/sdk-version.json
        • Size 591B
        • SHA256 e115d8303649f07b36cf88a09bc3c87ef3d092c36448321f6b80eac809b9f511
        • MD5 SHA1 SHA512 TLSH

        tags.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/tags.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512

        breadcrumbs.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json
        • Size 4KB
        • SHA256 4c56ac06cd2f18f715261f775361e5c6b99a6c9f71c5e82c86f58e369b4a3468
        • MD5 SHA1 SHA512 TLSH

        breadcrumbs.json.tmp

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json.tmp
        • Size 12B
        • SHA256 ae1afdb53fc94d62b6862659f839a20634382b65a7354f32b5e81cd29fb4270d
        • MD5 SHA1 SHA512

        contexts.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/contexts.json
        • Size 63B
        • SHA256 dda403ea3f2dc79793e354552c63edfb2be6a7676df6d0ecdd02a12055fcdad8
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 182B
        • SHA256 e2115917c6984145b91ca50d477dd1658098a9b89ebc6023377e1b66faca2cb1
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 188B
        • SHA256 07fb721c475f516fe06655af16255037715d02213b7bfe4baa694979f11a6e96
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 82151889a08218147c851fb9664ab42a196f8d1793d2479bc3739f511a7d1317
        • MD5 SHA1 SHA512 TLSH

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 18B
        • SHA256 96f7a5db03a7c5ec7847b1ca053fa92d19552fe07cf22a21a004e4aabed4a95c
        • MD5 SHA1 SHA512

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 16B
        • SHA256 96c4b7db81f09c9990c9e856e2d350b49f8ca5e0657620be9a6632cc3d7aaf1c
        • MD5 SHA1 SHA512

        installation_id

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.sentry-native/installation_id
        • Size 70B
        • SHA256 0d9fc593d33b36bade4df5025fa426d806693d880b49e0079cb40730b6b45109
        • MD5 SHA1 SHA512 TLSH

        33c941d813ed44c08952a0162d79716c.envelope

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/33c941d813ed44c08952a0162d79716c.envelope
        • Size 886B
        • SHA256 e0af4053fbdf063c1eea01cbcedc3ed964c438ff0d163307bba3a7045070bb5a
        • MD5 SHA1 SHA512 TLSH

        874058e5146c4adfae5f6383cc836d5e.envelope

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/874058e5146c4adfae5f6383cc836d5e.envelope
        • Size 963B
        • SHA256 dc4c64998a5ee0715c9689114179709217c45496883823c10a34b1071aa604e7
        • MD5 SHA1 SHA512 TLSH

        session.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/session.json
        • Size 268B
        • SHA256 1bfd595fdcda6031d8be7ccf897f1e0d2d5f5b5c993b63c2f6d28cb2fcedf1d5
        • MD5 SHA1 SHA512 TLSH

        OneSignal.db

        • Path /data/data/com.pt.bark/databases/OneSignal.db
        • Size 52KB
        • SHA256 491c9687657ca71661a5cf42a763249f88fa222edaef20eaf552c4599458f99e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 5e29efd07dd2b0044a08620cc56033123aebaf5c1d8e5a157e2b2c377e2e9021
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 a39122b8c34550f130df7c6e46f54f436bdc08c296dd266ae89689a6ff006df9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 9646e43adb858a12b3383ea961a123950a5a5bfc63debe3e5882e3932d7775a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 4ca46032e5cc1c5b2a25793c615f4987b9d9ca8e10f2364bb657ec774ae46780
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 f9fff280d45db80ce31d0a1191373931a6848ae736ee6673013ac95b67ef8344
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 3b5ab969492fd43d09439b9e20386da87ac05b4ca1556afbea9749b6920663e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 2116c04c867c2a858cea5d925732442eacf8f8f9db5294f033f0086c9bf41ade
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INSTALLATION

        • Path /data/data/com.pt.bark/files/INSTALLATION
        • Size 32B
        • SHA256 e299629e58211a9103f9f87c0fd18da1a61f61bf246daefdb99d934ded4f2990
        • MD5 SHA1 SHA512

        PersistedInstallation2593246431619259126tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation2593246431619259126tmp
        • Size 90B
        • SHA256 f154af3bd68180e3556f03066d53b2825bfef7140abac67fc996c0a533013646
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation2629160517201523563tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation2629160517201523563tmp
        • Size 90B
        • SHA256 9aeeecab3e62f278f5605c2e8f083f1e76a1691249b375ffbfeb2777498c3c01
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation3263502922512617155tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation3263502922512617155tmp
        • Size 567B
        • SHA256 034193805f71b8ab5ff12ca0bffb8fb8a0536d2ed468c1061c2909fae63f8e71
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation6691303105753665395tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation6691303105753665395tmp
        • Size 567B
        • SHA256 5ce5bd0b60925aea2468a1e7b97b4eabb3fb67b88597010fac345cd1dfda587f
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.pt.bark/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 dbf26ab9003438024cde68b960afb16fc5895655cb217d6760dd8cafbe6cce56
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb
        • Size 100KB
        • SHA256 08e6722039ae0daf2db63d323c6b26b31331920cac58ec470612ec8efaa7b8c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 99aafdcb717947688dc3d84546f02f908840568179887757e9d248dfe68c1112
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 9e25d2238b3be6b109b6dbc75ebeb336178ef9b1a84bea994ec28bd9944a51e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 14f61b29cefbfe57a9e58819bab769b0253608b5e09d71a04ea5cdadc356e0a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 410KB
        • SHA256 6200224cc72325857448d2714a7f21f08b6226540cf2e016a1ba252990e96aad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 1KB
        • SHA256 2dfb52c687862dd9939a07fae37f61fff3e733b3c934cffeb7f286b2c38b16b7
        • MD5 SHA1 SHA512 TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 16KB
        • SHA256 8fa2440098c45670889b00563aeec8bda63aee02f67862c76d099dc96e5c36b8
        • MD5 SHA1 SHA512 SSDEEP TLSH