Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    03/08/2026, 04:49

General

  • Target
    6194aa250a7ec0c9e956c5a661ff9a3fe7db7135177a130fe97e0e3c8421115e.apk
  • Size 17.0MB
  • Sample260803-ffvq3assct
  • SHA256 6194aa250a7ec0c9e956c5a661ff9a3fe7db7135177a130fe97e0e3c8421115e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.alienmanfc6.wheresmyandroid
    1⤵
    • Acquires the wake lock
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4700

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 f5c8bea7c82a4b83cbc4a93597ede80069820bbb2a1cd4f9497b0be242c03316
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 9a826982f3ad436158101fb13ccec20f4a4910a33da5f69e624fe879fa12d599
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 0de18bdd0d2cfd66db78682b2d925212df2df52bcadd2902dfd44eec5b81dedf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 19cf79d03cf723631a150c890fe41421666c18ef965db3078679bcae56c8348b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db
        • Size 28KB
        • SHA256 ab7d034dd7cf7868bd1db2c337ae4a562fb2ebb58b947d40a2015d0a4d80005f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 512B
        • SHA256 e3e95bc620e984bb74d0a9245c7572bb0d0adc92d23f8650b2eadd7d1c997070
        • MD5 SHA1 SHA512

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 20b8c9c42017d5cae1c55d4506805a32a9642b15a21fd258f141f30c8f686d7a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 4KB
        • SHA256 1a7d5b0a8f7b2f648e5450fd339c495ac1d9bf21e3506f342ce08902c3b3c12a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 f1433f3782d78e5453d79270ecba3a5eae5808a574b16c2f79494ce992bbdca4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 b9190684d4c2359f8ad937f2fc81bd088f84606138bde7f7d9c3b84b892e846e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 12KB
        • SHA256 45573f39badd96855a2531f0b555358b21eae598e6dfc18a1fc3b78ecc019535
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 b6f361ac44fe6eb33a8d55c7a14bbabf53dc2ed2b7f349dea6e3d694fe738fe0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 96a696dd1f79191c64a89536ac3b6a505db3643ea4257206845273abe620b9a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 349b36ef12df34509a2ad4efc38873e03aa758aeedada55c53242e904ad1a96e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 1a66956309be47d969352d2ed8b98787cb320eca1650f2948f8033f07becfb87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 b0b63a87432b7a3e63f22203c036adb36c4801f6de19638226107cc4bc94c68d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 a0b4c70b434aa3f82a03bb8107ab89812feebd754ae52ddf4a6de79c6ba71b62
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 5f548b62d6d18eabfbf79f93e54bdce910e3e3cbbf2f6e0f01fc1d811e9ac198
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 c642f6af117b0a652eaabbf8437f8c00a50d7cfedc14624651c1f39c6da068fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 a49a8ad76dd1b86617e2093951eca9ac70948f11763d80331b67eea5883faf34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 2ca57ffac752bd2c033d4aa3e89724aeb017d6a9cc671b57812b48f1948fdfa9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 09e579a4d43c527e8765f6fcf10ce2d66130aaca685bbbf04156053b9d6b31fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wheres_my_droid

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid
        • Size 4KB
        • SHA256 b88f14bbaa4caf9641bb52b34eb8cb78c32c90a0e5d634dea1ea195237fd8f85
        • MD5 SHA1 SHA512 TLSH

        wheres_my_droid-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-journal
        • Size 512B
        • SHA256 a08b680a72723a3d394adc7e6f03b4b4fed7013dbb191845bd3a46ac9e5a30e6
        • MD5 SHA1 SHA512

        wheres_my_droid-shm

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        wheres_my_droid-wal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-wal
        • Size 321KB
        • SHA256 56df5a1c4eb0ad3af0aab71b1a565c7a6bb6b9ca786cbf83bd09f9d9166b9859
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation6798991684293886854tmp

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/PersistedInstallation6798991684293886854tmp
        • Size 562B
        • SHA256 c57884df5cffc3e4d338a6657356e96fc5ee75188c55985579ee2e9ac98cf143
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation9113100902587367979tmp

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/PersistedInstallation9113100902587367979tmp
        • Size 90B
        • SHA256 d604fe199893eb9ee338946dd4cc4a44171bc04bfb67d3b5c297c630fc79b720
        • MD5 SHA1 SHA512 TLSH

        coverage

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/coverage
        • Size 65B
        • SHA256 84ef73306361ab4bfc1e45ed7371f4704906e5ef6d226142abe97209ac490cbe
        • MD5 SHA1 SHA512 TLSH

        coverage

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/coverage
        • Size 54B
        • SHA256 b2c3de313ddbe97841fa2256287f0b03a7b86ceffe6056c4402eb6a114efe24b
        • MD5 SHA1 SHA512 TLSH

        gaClientId

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaClientId
        • Size 36B
        • SHA256 a41fb89150941783b2d1c89aa94073f00f7097bfe208ae9c98d5a710fc890987
        • MD5 SHA1 SHA512

        gaClientIdData

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaClientIdData
        • Size 32B
        • SHA256 c6ac4a16ab7fb0875550c705e674bb9af550e7a23b9ab266a0951f3e79682863
        • MD5 SHA1 SHA512

        gaid

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaid
        • Size 85B
        • SHA256 4da8790eae77fb6aa1060cb0f41e336cfeba3591eb33b6b261fc4b338119fc93
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 13e5eae682fd297cb8c5046f0a3f4ea8380599267da5d56152e6ebda9f506006
        • MD5 SHA1 SHA512

        regulation_consent

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/regulation_consent
        • Size 1KB
        • SHA256 51c08b027c0076345b844d7195128dc32f162f49595cd71b99dbbc116608a0ff
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 113B
        • SHA256 f91c4758326194d12adaa31e40111eed67827c442d7118e37aa5e6e828946c02
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 176B
        • SHA256 6d507386cefba47e11c85d05b2451c67109e592ce44e69e81361a89079ea19cf
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 161B
        • SHA256 54dc7360e4f3c0045ce8ab87e75120b1015dbc38611437bd0c11b4f3971bcc16
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 160B
        • SHA256 75285ea6e5a478c9f496911781f9b443a88c468ff26e75cea50fcf42f31c98e3
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 602B
        • SHA256 de1ef3bf255414323689a019375f9c4c04b8c1c523bbfec739630cb600d88f08
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 602B
        • SHA256 94dee8c991212dc903a43f1364af25a0d875e7c0c3df67bffab053870b57c00f
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 695B
        • SHA256 825e187959b2eab93835aa6b70cfb7024abbef6048f156601a0e8b5d68a02121
        • MD5 SHA1 SHA512 TLSH

        should_attach_if_allowed

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/should_attach_if_allowed
        • Size 31B
        • SHA256 53ade896a4b756ca5058942117acbe4b3d069c77c64b75662da74d2fcc558e3c
        • MD5 SHA1 SHA512

        primary.prof

        • Path /data/misc/profiles/cur/0/com.alienmanfc6.wheresmyandroid/primary.prof
        • Size 2KB
        • SHA256 4fdb914bbb522d296fcb021cb703ab975e3d3eb44a016b9c1a17696a9e1d563e
        • MD5 SHA1 SHA512 TLSH