f7014450c24c67649310edb8648a8ebce3270c6d1e391f828c1aaba890c4c238

Analysis

max time kernel
97s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
02/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
the-doctor-online.apk
Size 23.8MB
Sample260802-wt38csdh63
SHA256 f7014450c24c67649310edb8648a8ebce3270c6d1e391f828c1aaba890c4c238
MD5 4296d88d6d956f369e013d8cabb12b82
SHA1 297507153b43af53a0f64f9bb9e58230ad715213
SHA512 16b163189c0905de3651e5bae881802a1adbe299c59f11b612990259abdb4da0e4b9e1c0d22b1c38234b4198c94f16d63a4c9263805d165410bc1369607a8527
SSDEEP 393216:8bN0lF7Q/5chPm7YAmOjj8ZsX0dqIcKXk9f8PVJ1v94o1sP4xgLXNY6vmyTybYYI:CN0f7S5UPm3mOj+pdqSIcz9OoeP/9vuW
TLSH
T1A7473306F7A89D5EC973C1738C4A6536521EDE66C243D397CA38378978AFDE40E842E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4831	com.thedoctoronline
/system_ext/framework/androidx.window.sidecar.jar	4831	com.thedoctoronline

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.thedoctoronline

com.thedoctoronline
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4831

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

firestore.%5BDEFAULT%5D.doctor-online-app-2026.%28default%29

Path /data/data/com.thedoctoronline/databases/firestore.%5BDEFAULT%5D.doctor-online-app-2026.%28default%29
Size 156KB
SHA256 ccdad38f9bf74bb8c9ce243add8ff416bdea7f9af5877255a1864e769a3a723a
MD5 aaf80e1f93b0042279dc17346c9c1a43
SHA1 4a25ca8735f7f65fc1e387740cd42e8db4c6b09f
SHA512 bbed81ee58a2912e89bfed06f6d0f3b22e55305ec430dd5530120ad60d8fc34c6bd96798dfc7f1d60ce84ca1a8639707391a3fbdf9d6a4ad3bb8ec8ce13509d9
SSDEEP 96:WSgIgArgIGZDDEIG3QIzZ6iW/UzfdXRtDA2cpBm5Ts3v/AdNp8uV:vgwgIWDDEIyt62A2cpBQHNGG
TLSH
T150F343E26F14D170CC87013AB1B28B736BF6DF1FA42372126DACA1118CD6B40661E5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firestore.%5BDEFAULT%5D.doctor-online-app-2026.%28default%29-journal

Path /data/data/com.thedoctoronline/databases/firestore.%5BDEFAULT%5D.doctor-online-app-2026.%28default%29-journal
Size 512B
SHA256 90fa34c88f90adcf11632e7f9b4f45209cae21e6b5d602c44c4904ef56b4e8e6
MD5 c0e0232ff68040969b0f554044522874
SHA1 a937dd78a6f4ae89f7b3ce140578a4890a267c77
SHA512 3d02ff584a9bf67cfdc68683ba052d1cf40886f015d3f269752b9b1271f3836b006e0d3c65f3f8b343e61142332749b4588a6d44a0a8b67f9a5d7a6c1210ce4e
MD5 SHA1 SHA512

Submit Download

firestore.%5BDEFAULT%5D.doctor-online-app-2026.%28default%29-journal

Path /data/data/com.thedoctoronline/databases/firestore.%5BDEFAULT%5D.doctor-online-app-2026.%28default%29-journal
Size 8KB
SHA256 c23965b888fae2ab2bef011777ee39e9f826e2c9966e2d9ac3f68e20ebb736ba
MD5 82cc4df5c079534bd9c99551a0e4d1c4
SHA1 12d59e4c1f85e77c92c38f0442f3eb47fb298cac
SHA512 9864bfde17268c732531f8ccbd66ce7c084afbe218afb6e67dd5c5f0f6b30c7abfe703acc952e447c98ca87ab05266b80731be2996d602fa47599d8ac7cfa20f
SSDEEP 6:7+/l94gn1g//vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKW/w:7+t2xnqLiuWdYRmBEyPb1w
TLSH
T1C1022298A3820C13CA295A77B4E893400D00EF289171CB27179018952CCB4CCA8A3D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firestore.%5BDEFAULT%5D.doctor-online-app-2026.%28default%29-journal

Path /data/data/com.thedoctoronline/databases/firestore.%5BDEFAULT%5D.doctor-online-app-2026.%28default%29-journal
Size 12KB
SHA256 5b27fee289e2a1ac83981341b9222f153619ad903fb0f82c52ae896ed2b8cac3
MD5 f4b5966d450d48be195a865b85f9f99f
SHA1 f0c5ea076aaf0d2e0987bc51e093a8fae9fe5703
SHA512 ef404f17932ea0245ce3dfab86f114b9d3c39f45ba20ede4a704b86830a030d99579fb323cd5c733caf0f8209fc50f1fdc8b7b6f90160ae4d4f564183f762e80
SSDEEP 48:7MdOroTkWZMBSNOM3EXWBOMrWukOd4ZBE6:7mAxxSgIg
TLSH
T13C4208E5FE61C1F0DE47457EB291A891B5E2EC3F5859F8325628FD608083B8A23152D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads