Analysis

  • max time kernel
    822s
  • max time network
    770s
  • platform
    android-10_x64
  • resource
    android-x64-20260325-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
  • submitted
    02/08/2026, 17:07

General

  • Target
    IPVanish-Mod-v4.0.0.8.139194-MOD-gamekillerapp.com.apk
  • Size 30.6MB
  • Sample260802-vm651atta1
  • SHA256 9c1dc4093e0e4a050cb7dcfb692f440d3973ff7812a8f61d74b3360eb012c762
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10

Malware Config

Signatures

Processes

  • com.ixolit.ipvanish
    1⤵
    • Checks if the Android device is rooted.
    • Checks memory information
    PID:5179

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        journal.tmp

        • Path /data/data/com.ixolit.ipvanish/cache/zendesk/zendesk_media_cache/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512

        journal.tmp

        • Path /data/data/com.ixolit.ipvanish/cache/zendesk/zendesk_response_cache/journal.tmp
        • Size 36B
        • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events

        • Path /data/data/com.ixolit.ipvanish/databases/com.google.android.datatransport.events
        • Size 40KB
        • SHA256 e802fdc1ccd833b91d80bb1d8f54cab2b585393e6a07622c4d9feaab07633370
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.ixolit.ipvanish/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 82212745594442c5c2c2a754025dcc468eba60d1fef5697cab342cc56795cfdd
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.ixolit.ipvanish/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 31e8b5e9b1d0eebb50a0f25f58b012048c032f31ab1fab7c628335be43881706
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.ixolit.ipvanish/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 ae60a09b320afbd3d3d21accb53ec530e836cf10a93c704ceb182b68078b27e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.ixolit.ipvanish/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.ixolit.ipvanish/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2484983a969aa15ff90fd74de6c14329a9d28a5025bfd94d285fd58a20b41d72
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.ixolit.ipvanish/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 fac2e2a6dddc91846b48832dc5a25ebbf1c6670102173dac9c1576d10cd31846
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.ixolit.ipvanish/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 afa6a152ec571edb56abe49d83f5f5e12d933d58b6dced0265e811e1338ff822
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.ixolit.ipvanish/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 709c30a1976296641717be72987125d80f13dcc0f1af5c1f02e96ad8446bf32f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.ixolit.ipvanish/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 baf77183a8c62195b8cc26c477de1f5643dd21108604aab08e269952b5c382d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.ixolit.ipvanish/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 ad3440588a8721d122140d42642f311858c9bd996c5254efaf661326d6d53288
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.ixolit.ipvanish/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 b5b3413f658b2c71c5ab5246a00697c706028a5001e19605678bae27d31e7367
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.ixolit.ipvanish/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 5512e243bac34574f21c15567c60131378718b5b92cada62c6cd20f1e8edc815
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.ixolit.ipvanish/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 46cec2882550bd99bd8f324ee3b8e4a627d2d7258a677f9f6c270862ba50b30c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.ixolit.ipvanish/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 00cf7d89221caef7dadff11aa6d89b255c77e75b214f7cf93fa33b9863a635ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.ixolit.ipvanish/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 11518ccd66358ec2f98030b645fff8be734dac8535d3ad4e57446df75ab54b75
        • MD5 SHA1 SHA512 SSDEEP TLSH

        6A7333D3004D-0001-143B-408C80B67E29BeginSession.cls_temp

        • Path /data/data/com.ixolit.ipvanish/files/.com.google.firebase.crashlytics/6A7333D3004D-0001-143B-408C80B67E29BeginSession.cls_temp
        • Size 75B
        • SHA256 e003d98dcffed5ce9c471b6119b89ea6c558de19dd4bc2c9991e0f02538b7f86
        • MD5 SHA1 SHA512 TLSH

        6A7333D3004D-0001-143B-408C80B67E29SessionApp.cls_temp

        • Path /data/data/com.ixolit.ipvanish/files/.com.google.firebase.crashlytics/6A7333D3004D-0001-143B-408C80B67E29SessionApp.cls_temp
        • Size 83B
        • SHA256 7883dd02a0c6f9b96134c416c12b5557147c2690402a72818e93f1b971f92988
        • MD5 SHA1 SHA512 TLSH

        6A7333D3004D-0001-143B-408C80B67E29SessionDevice.cls_temp

        • Path /data/data/com.ixolit.ipvanish/files/.com.google.firebase.crashlytics/6A7333D3004D-0001-143B-408C80B67E29SessionDevice.cls_temp
        • Size 49B
        • SHA256 8103c28e4cddc0f3581e6189c4fc01bdce57c4c4ed292222989d5d1f765fb20b
        • MD5 SHA1 SHA512

        6A7333D3004D-0001-143B-408C80B67E29SessionOS.cls_temp

        • Path /data/data/com.ixolit.ipvanish/files/.com.google.firebase.crashlytics/6A7333D3004D-0001-143B-408C80B67E29SessionOS.cls_temp
        • Size 15B
        • SHA256 e78068dac7c1adce8676a309d60abb8be4d31ab3dd5c6bdce85284b7ca8e8761
        • MD5 SHA1 SHA512

        com.crashlytics.settings.json

        • Path /data/data/com.ixolit.ipvanish/files/.com.google.firebase.crashlytics/com.crashlytics.settings.json
        • Size 768B
        • SHA256 bbd1f95a60ccc88ad905db92f1c11e5bcd655dd54d2b4e02271c67fa49994cb4
        • MD5 SHA1 SHA512 TLSH

        crashlytics-userlog-6A7333D3004D-0001-143B-408C80B67E29.temp

        • Path /data/data/com.ixolit.ipvanish/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-6A7333D3004D-0001-143B-408C80B67E29.temp
        • Size 352B
        • SHA256 a81d6393dc80f505c8b64cb8ac481bf0acec01a6075d92beeadac4a1257d360e
        • MD5 SHA1 SHA512 TLSH

        crashlytics-userlog-6A7333D3004D-0001-143B-408C80B67E29.temp.tmp

        • Path /data/data/com.ixolit.ipvanish/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-6A7333D3004D-0001-143B-408C80B67E29.temp.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        report

        • Path /data/data/com.ixolit.ipvanish/files/.com.google.firebase.crashlytics/report-persistence/sessions/6A7333D3004D0001143B408C80B67E29/report
        • Size 765B
        • SHA256 441d2a2369a558657d6fe2feb2ec669df1dcd39b30b3d50159bb7061e2a4ae54
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation2169671281718226740tmp

        • Path /data/data/com.ixolit.ipvanish/files/PersistedInstallation2169671281718226740tmp
        • Size 562B
        • SHA256 b746dba32028265193b9904fa267fe36858e850a3c4b7e82149fe07bf45a32fa
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8877460965613145163tmp

        • Path /data/data/com.ixolit.ipvanish/files/PersistedInstallation8877460965613145163tmp
        • Size 90B
        • SHA256 39995836304a459052c3bc25e5f21509a6dcbd8c4842834c7453b1bd9e5ed232
        • MD5 SHA1 SHA512 TLSH

        dso_deps

        • Path /data/data/com.ixolit.ipvanish/lib-main/dso_deps
        • Size 296B
        • SHA256 d9fa6485d946e703736b0d0905b67791ecc40aea0e7153e8b5e26b45718b6e1c
        • MD5 SHA1 SHA512 TLSH

        dso_manifest

        • Path /data/data/com.ixolit.ipvanish/lib-main/dso_manifest
        • Size 5B
        • SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
        • MD5 SHA1 SHA512

        dso_state

        • Path /data/data/com.ixolit.ipvanish/lib-main/dso_state
        • Size 1B
        • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
        • MD5 SHA1 SHA512

        dso_state

        • Path /data/data/com.ixolit.ipvanish/lib-main/dso_state
        • Size 1B
        • SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.ixolit.ipvanish/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.ixolit.ipvanish/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 60777e38c7dc7d22b8f53e08942edaa555bf92b2126ced05606974df499334ba
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.ixolit.ipvanish/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.ixolit.ipvanish/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 913eba107b2d16a9f73c9cea409c64a2eed2dc3e16bdb693282f6a4d8c94c00a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.ixolit.ipvanish/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 af1ba85a0781555bca610c15f21a9c065bd4108fbeff3e8906ee65753a21279e
        • MD5 SHA1 SHA512 SSDEEP TLSH