8fa05663ec12772bade5fc295889b916edb3452fe4a925fc526877139c90e4f4 | Triage™

Analysis

max time kernel
2s
max time network
151s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
03/08/2026, 18:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vamyar.apk
Size 9.1MB
Sample260803-wxswsshk7z
SHA256 8fa05663ec12772bade5fc295889b916edb3452fe4a925fc526877139c90e4f4
MD5 9996b5debf059ff65aa2deb5aae27680
SHA1 e4fdf761afdb5006b7947559e11c64a749be119d
SHA512 df60a2a0af225febca05e603d65bab7789486da84a5f090e2a6e7db7ac9202ea8ce2ff194c76debd205c8f4bc70d7d59c9b04920adaae5bb087b215076ad4b42
SSDEEP 196608:FaZRp40joHPR6aeY6apVYwroPcOU90bPxa8Tcpbqb1YkdYqfj:FaZ/oHPR6aqajY3kNd8AqBY6Lj
TLSH
T134A63306FA935D9AD8FAC331506A5B35603B0D69D34BA70B2760B3B56CFBBD847420D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.elgfus.app

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.elgfus.app

Queries information about active data network 1 TTPs 1 IoCs

System Network Connections Discovery

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.elgfus.app

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Broadcast Receivers

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.elgfus.app

com.elgfus.app
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5094

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Credential Access

Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db
Size 16KB
SHA256 dcb62f640e9e49332dd015933185324472f3186b446ab1a3335c0a7fdc4b6544
MD5 6223048d031cf007b731c90404cb7dcb
SHA1 b653b3f09378a9b8b6e4b1c18ad8d33d996a4595
SHA512 264d80bb082d35c15598e3d83834643b36a412296fb24832dbeffdf2efb784576019f589af02d5a951370103dbfc38dd67ab03b588052dd88f30608a74a7dc6b
SSDEEP 6:l9bNFlqls1IP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOw:TLwEI7LzmzsRmBEyPbBvOw
TLSH
T1767220CD8F106217C157037B7486D3951F68951E43779647277404706E53158B051F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db-journal
Size 4KB
SHA256 c45ce73e8b7ae23be2c66e1f5281d68161564c170274d7c0c4db410913b78c09
MD5 463d8bbc045eef19fc9a53ea5967be01
SHA1 1e5b4e27b098953386020ec58419c7029a1fef2d
SHA512 ff068ab1a59af19b53505ee56525fb44b4202780f828661221c88c2df16212173bdabaee87ceb796c56a0bf61dc96da03d4bb6e912f9622ad55d87c0e8e3ad00
SSDEEP 6:7+/lUg9bNFluls1EhlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK6:7+tUqL8EEh9zmzrfRmBEyPb5
TLSH
T1E7912B8D9F112603C2770B77B4CF93506E6CA219C3779E572BB80474BD4354A9051FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db-journal
Size 4KB
SHA256 8d906c8c2cda62c7a290f1a98f813242eb6577fdfb9e6dd6a82a886bddfa037a
MD5 80fc0c4c37a8df0a6c2e0e0e8663f6c5
SHA1 58a5654ef8c15d247bb43c38d69775e59cfea594
SHA512 4baee534b318b05fd0163199bc404dc1fccb1afef14caadda95af2031eee15db8af00084f88a3b9e2f9b5ad026915ee01bffb7777ae4ef735e90d835ed75a42b
SSDEEP 6:7+/l9g9bNFl4/Tls1OJEpFyAgLusi2JLnGLNcERX4PBX4ogLugMBX4suuK9+:7+t9qLWBEOWzmzmRmBEyPbM+
TLSH
T1F5917DCDCF106612C1270677B4C653801D14521E8377CE0767A804A4AE43498A081F64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 5010de51afebdbfe6b5d09e5e16cb8c3186bbc967d1cd57055c3715fefa21cdc
MD5 0112e290b422d8597e1f8dc77684ebd8
SHA1 d9f5be0a8b38583d7da59ccc61914934dc1f665b
SHA512 ac2504e1c63d44e2565208ee2346d81a5c33567fab17a689527f710c9c6085551631ce883354022c7b177f1d8090bcbc7e675a7e0228316d6fc45e76a1023d7f
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 02962ef0f9ffc56e6aba69263e7c1f3f4bc6e05196f9a0d83f04769963596881
MD5 a6f385454f67a0a22e2a41f4744e17c2
SHA1 859ec0a9ce781ac2e259767a1d3cd31b203c9e3c
SHA512 27e2515d1ad58a54da1e8b466c4dc9c29f1c160f046cd3adf23328cb684acf0fae898f89d3df61377f697f984403603f25acbb57291bb7038306ba8116871414
SSDEEP 6:7+/l9qcn18g9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK5:7+tsVqLiuWdwRmBEyPbe
TLSH
T1DB022289A3800A22C81D1AB790D883400D50E71985A1CB07296008987C036CCE4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db-journal
Size 4KB
SHA256 ea02a89737b72d88afe5ce9f6e04569767683f093e8bbdcc5ea9c8b52649e329
MD5 c3ed768221e1e2868b45c2b7b7655e6d
SHA1 80cd428d63bb04d6f6797e051cf719e6cc7fe46a
SHA512 b8358a9386ac5b3aca33903928324ebc79e3e482b41d452a29677ad32bc82c2044b422544eb18ec057cfd950d49074cd039978afddb87b43200a63ef366667ce
SSDEEP 6:7+/lqGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKe:7+tFqLJdTRmBEyPbl
TLSH
T1EB9180C967410913C5595BF794D683752D54A715C373CB5719A00C9C7C476CCE4F4D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 e1c2e2d83bfac422bf6580c1431623be6fbe6ac5f69b5c2ef4a940558a5e7deb
MD5 df7d9c6ac5b4964248177ac9f29f3975
SHA1 c4b3b6e57873ad5db1265cee4ee05f14fad53564
SHA512 5a38fe9175946cdb32fc2c566823292cd70453f9034dfcb08fe1a445528eb668acf40af428c1fe79620c2dfd213fd3b4d92f8c7c094ccc449120474a71e08ce6
SSDEEP 6:7+/l9qPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKff//Cq:7+tYqLmqCRmBEyPbUj
TLSH
T1A202128A67810D23C51A56B794D983582E11E715D1A1CF9715B419A87C469CCAC90D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation6696021927021410738tmp

Path /data/data/com.elgfus.app/files/PersistedInstallation6696021927021410738tmp
Size 90B
SHA256 2a605aff68f4eb052ab7dc98dad0da8a2c149c8567ec7e5f9e749812f8ce05f7
MD5 dca85d4b1755cb0ac0a7d6165790beff
SHA1 0614ae3d302a050cc17c6b6410566d8f7bb561fa
SHA512 1f97108cf2b01490f0c0f5e502e3e6790b5d6dcbf448fb56943178e687a43abe17e5c60d4abcd2ab281d2d0f4c61e56e35f282916c7db6a6bc7c7faba6b1a5d1
TLSH
T14EB01201D6314181C499F2071C4D9140AE601441540B8FA40B0DA4D041D12E0C113DB8
MD5 SHA1 SHA512 TLSH

Submit Download

offline_key.txt

Path /data/data/com.elgfus.app/files/offline_key.txt
Size 8B
SHA256 614e41932f954872b4be97594c99ea42e65f56957482541360b7e4d378dd72d1
MD5 5e450aebdceb2a55f7b20ca6dcee4bf9
SHA1 075b1013defce84a3818889eaf915e76e0245049
SHA512 68b59fec79cf2bf261688fac2399afa6899384cac29e561c3e05d67935a9ecee3ffd1c6d0c6ef4dba953249f484047f2a7f7986eafab71ec654a9bd5448ecd7b
MD5 SHA1 SHA512

Submit Download