d5cb8dc8d892a9b6284fca1f117c85929d42d1390656afbcecab242869d24635

Analysis

max time kernel
16s
max time network
134s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
04/08/2026, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d5cb8dc8d892a9b6284fca1f117c85929d42d1390656afbcecab242869d24635.apk
Size 278.7MB
Sample260804-dxttzsvtct
SHA256 d5cb8dc8d892a9b6284fca1f117c85929d42d1390656afbcecab242869d24635
MD5 4634de8173d061ca62f405d03f812c5a
SHA1 cabfc2d737753c84c9d700560e170de01e309b50
SHA512 64d0873be04d1d67cd2ab0516dd9130598881317e69d739548b3d05f446e187bec1c914723cb71ea1066e210d42493b4c9a4aa46419cd9701dd03f659e123b2e
SSDEEP 3145728:V7IDtTdro+WW7CwfwxWuHvugMbnQf/pOwL44RSTZvdzTyQtqP:VIDtT5oM7CwGWZUfBlL4f+Qti
TLSH
T173D8F146F35944BDF9BBD8B8B54E6133DB243C168362839B6F45A7007F331A09F69682
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 4 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.hydradragon.antivirus
/system/xbin/su	com.hydradragon.antivirus
/sbin/su	com.hydradragon.antivirus
/system/app/Superuser.apk	com.hydradragon.antivirus

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4785	com.hydradragon.antivirus
/system_ext/framework/androidx.window.sidecar.jar	4785	com.hydradragon.antivirus

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.hydradragon.antivirus

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.hydradragon.antivirus

Enumerates files in the device's shared storage. 1 TTPs 1 IoCs

Queries the system media store to list files across shared storage, letting the app discover what documents and media are present without opening them.

discovery

File and Directory Discovery

T1420

description	ioc	Process
URI accessed for read	content://media/external/file	com.hydradragon.antivirus

com.hydradragon.antivirus
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Makes use of the framework's foreground persistence service
- Enumerates files in the device's shared storage.
PID:4785

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Credential Access

Discovery

File and Directory Discovery

T1420

Process Discovery

T1424

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.hydradragon.antivirus/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 4efba6835770dfd4dc2b8d815c89581d1934dcd87d8b1d69ee87a1bd9c351bd7
MD5 e8c39f57624e4c6edf7182f047eb90ef
SHA1 37f60d3a022a5010ff8b3cc197c9b496f4778a61
SHA512 b4760329366e4441107f8de4b32ddb882064219c40db060b3c1f25124ceca67ba1107cbab3c5e6f3e250fc3bb14a203d99b88daa25dfd9003cf6b412f5d082a6
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.hydradragon.antivirus/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.hydradragon.antivirus/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 ab71be57e6f09746c82919276c997b46cddba2410da30ddfe71fa846cfe73e73
MD5 c5777bca580c2bf55142943256cfb7c1
SHA1 d0090963f8f121c20142bfd0c01ed3a22e08942a
SHA512 334d182008a20707cd64ea1673b21df603d2f7cf0a5a9e43cd0d97223c65c134ebd92c8fe54f1cfec1b4e70b38b0f4c974be9ff2afc215f7aad55e4e27d93424
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.hydradragon.antivirus/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.hydradragon.antivirus/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 8e93bd1d0535b957c519200386d1eeeea9f6eff78c8362dde81704a5e4a7ec50
MD5 9667bf687a5286ce54cd7e2433934b95
SHA1 a813fcb311cd962ae88eb91541b783828cc5af08
SHA512 db29ac5e9992cc1e0fb08529927bb846e77352837e63ccb42f31aa6cc0fbf2b6936dd873c175f683f809bacd5dc5afe35ab65443ced5454441e277847bc411fc
SSDEEP 96:h68PteD0kYq6+OtidjnZRWzzb8/KeKcK+zSeKz+XD86u0ExV:hdtegkY/tidjnfWzzb83zS5+XD86u0ED
TLSH
T1EAC321CD0F586600C4ED64B0F4D11BE1793E412E9B93E3DA659100B9ADD29A0DB3ACF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scan_cache.db

Path /data/data/com.hydradragon.antivirus/no_backup/scan_cache.db
Size 28KB
SHA256 86861336231a588f7cab6045c9698874fa4c21fcfb497325961897f345c04ee6
MD5 c374e7f9cfd19ea3b552c8c0585f26ba
SHA1 71806aae9aed89cbd9a2a11eef44bc349107d63d
SHA512 272c715d195ae0156f285a03c9f68094319f45d8fb2f279aed1fdcd2ede89dcb0f920d9fb63148c285d691d68fb6274b78aa520dec51183be7cf7f53313eb126
SSDEEP 12:TLEy3lnSebFCrTKn919347BHBFfnqRmBEyPbGtOwI:TLEklzFOG9fkBHnvJGSiI
TLSH
T1E9D27D9DAF10B217C27911755C8423903D789B2F57F187C26DE011A26D824CBEA65D5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scan_cache.db-journal

Path /data/data/com.hydradragon.antivirus/no_backup/scan_cache.db-journal
Size 8KB
SHA256 92d2489e378ad7a21a6254fa33661399ee56874c5a82b66798c45fea6a1a1c25
MD5 6e993ac0f44d342055c42ab45f2161b5
SHA1 bc63e364f271a50a2fa11a7f8ec8923763646fb3
SHA512 adabad53fcf5d0064fe73c5f38a7b4eedbc3ac2c2b8b8dffda745591b37132f88f6c65c5e88290f3df743d46051b5e884b2481aeefea17256f722e70aecd01d8
SSDEEP 12:7+tCinqLZVAT19347BHBFfnqRmBEyPbSDS8:7+tCGqLDATfkBHnvJGSS9
TLSH
T13E02D58E9F003103C33B72BAA8E003103C2C972D03B28B834C6000206C024CBE6C9CA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scan_cache.db-journal

Path /data/data/com.hydradragon.antivirus/no_backup/scan_cache.db-journal
Size 512B
SHA256 b4cb0ca08b3de146f4a9ad32b8196d1bf40480cbe5cb70b87a62a7e408983209
MD5 eb5877fab4f53c96e0bc38d04561b134
SHA1 d196c730b86d3c3de5e61209d00f6d3890b0f2bd
SHA512 350cb2a6c7b3b98243e6dab5fa9be17c5f21d7ec3adcc755c0fc17e7281e7a5b65b000ab4f08f1da9c87057131359a27bfc804ff4edf477086d2455a5876938d
MD5 SHA1 SHA512

Submit Download

scan_cache.db-journal

Path /data/data/com.hydradragon.antivirus/no_backup/scan_cache.db-journal
Size 8KB
SHA256 73ab13e403e34309cd7b82c0bbccebc8e0ae8fe79f10934f64e2ad7225dec3df
MD5 8da54e6967eac11b9a3d2a5881670ade
SHA1 9876c6ee7c494ae6827b127636018b6dffda43d2
SHA512 f62f807bab317aa98664f26a22c4c62e683b8d4178ec18fae948ffec219c4d79114f40995bfcc9dc6b109a5bd49a9fe101723c768f40168dc63e31fbc58fe0a3
SSDEEP 6:7+/l9tQGn11Qvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKD:7+tL4qLiuWdYRmBEyPb8
TLSH
T1DE0222C86B800C52C83D167790E483600E08A7688A62CB2736D00C9C2C0B4CCA4A2D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scan_cache.db-journal

Path /data/data/com.hydradragon.antivirus/no_backup/scan_cache.db-journal
Size 8KB
SHA256 660b98631e6c0f1a521fbe0634d690d47b9ee0936afe7e3a44086b2662ed1b5a
MD5 3310a22c5a2441fd8349e66c46ccdf5a
SHA1 fa1b368512c4121baeb4021363b551ff435de931
SHA512 b5424200cd49a2211cad7bb2eb5cb9648b751692514291966e315cf43722ce038a2f27e150b53f44f279b5a72974b6713bdc03d72a387d439d2ac9a38674c04d
SSDEEP 6:7+/l9DUhOlFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKEt/Ar:7+thjqLJdeWRmBEyPbN1Ar
TLSH
T1FE02809D67810913C52D7777A0DD83541E14EB29F373CB5B56D508547C476CCF890D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.hydradragon.antivirus/primary.prof
Size 1KB
SHA256 456e0bc82420fc1f0ce25606468a453355683688bccf4e5ca82ee88de439f669
MD5 06c65e1d967ac191073975eebde3072d
SHA1 c1f58eb006db37912f093253a2a51d5004124443
SHA512 d7517ad1ef84d83d0aeb5c17f5aaf749b5c50f188191021491dbfe79d528ccbef99123dc43ff36f27b08d59d7c460e945d94e62f275b987bd3f5fcc1b1cf7550
TLSH
T12A410A1BEB14238F0D7A0A6C39702713630701B95864640B69CBE4DB47753C995FC659
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads