Overview

overview

8

Static

static

6

com_kwongw...re.apk

android-13-x64

8

Resubmissions

04/08/2026, 12:09

260804-pbnxdswsct8

04/08/2026, 11:20

260804-nfrcmsab988

04/08/2026, 06:54

260804-hpn1zstcpf8

Analysis

  • max time kernel
    65s
  • max time network
    308s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260708-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
  • submitted
    04/08/2026, 11:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    com_kwongwah_android_3.6_APKPure.apk
  • Size 23.6MB
  • Sample260804-nfrcmsab98
  • SHA256 a600912c5be815dacd60afc2a97377d22503e1862fbf0d7de685878a0c7bf9d0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryevasionexecutionpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
    defense_evasion
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

    defense_evasion
  • Loads dropped Dex/Jar 1 TTPs 5 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Checks the presence of a debugger
    defense_evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.kwongwah.android
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:4093

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OneSignal.db
        • Path /data/data/com.kwongwah.android/databases/OneSignal.db
        • Size 52KB
        • SHA256 8413c63e50eefd69ccafc07a38585e7c4827fa7c978b3e21d06104cd5ea5f97a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OneSignal.db-journal
        • Path /data/data/com.kwongwah.android/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 57943406e56856d9b78167c14916b9e80cd8eae25e308c787c14ad0edb184a3d
        • MD5 SHA1 SHA512
        Submit Download

        OneSignal.db-journal
        • Path /data/data/com.kwongwah.android/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 51ddd46a09bb6303a6a274710379cbc7f3e69b6de149c1fb9525647c92a79bed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OneSignal.db-journal
        • Path /data/data/com.kwongwah.android/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 f8adf1c7035e53778b2b4333544d1679e141e53ffdd964ca7f38316c117ff0b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartApp-d6864f2502af7851
        • Path /data/data/com.kwongwah.android/databases/StartApp-d6864f2502af7851
        • Size 16KB
        • SHA256 c457077ab3d9cd500a2729eb8a3ce86fd08411ca58f9c94c15e634313149a9f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartApp-d6864f2502af7851-journal
        • Path /data/data/com.kwongwah.android/databases/StartApp-d6864f2502af7851-journal
        • Size 512B
        • SHA256 2941469edc009ca662108f5ea4115803762037b57b4f7b570feebf66d779089f
        • MD5 SHA1 SHA512
        Submit Download

        StartApp-d6864f2502af7851-journal
        • Path /data/data/com.kwongwah.android/databases/StartApp-d6864f2502af7851-journal
        • Size 8KB
        • SHA256 01b0f980668e4af184af2ccb35f81c712b187ad5058e39bf5e530c54edfbae57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartApp-d6864f2502af7851-journal
        • Path /data/data/com.kwongwah.android/databases/StartApp-d6864f2502af7851-journal
        • Size 8KB
        • SHA256 b44c2ae08201835859a8ee4fed4b0cc2031182ee679bfd395b5a0b5f46574ae6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events
        • Path /data/data/com.kwongwah.android/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 dd299d1d19bbba78c35622cbcc672de80fc9c3dca041a663e3c95ecc5e51a531
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.kwongwah.android/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 3f520f4ea5d9f540d9fd328a7ffcc2370c26c88ea3cf126b130afb5b5fd034c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.kwongwah.android/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 3c8d3b424e03e195f194af4601eb36adb9c001c640a558c2340e867e55cdef74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.kwongwah.android/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 3e4588a8720c6822903eb5a17b55b1afeb8aa1566872bda2b6b0979c2152fc63
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.kwongwah.android/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.kwongwah.android/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 8dc45647483fee017ae70951a2f666056ee263b9fdc85780d2f68017f3294f3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.kwongwah.android/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 c5d1708467fa8dc8085ff6c87504b692c9afeac8ed9346579c349261b2ebdadc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.kwongwah.android/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 d83c0237fd7260fe43c8542911c2404e93d3d66727e504a86a3f181605dbbb3f
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.kwongwah.android/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 0711b6b2cf927d6c6c09523c271a5eb57379706ea8e4fb4d471d5a30d1b2032d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.kwongwah.android/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 fee0215d2d7bd3225d335ba64f469d002e82cb15e730f1e86946d7647b37ea7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.kwongwah.android/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 ba321b2ba638d445bcb115ce05346c751fd049d9da30399f09f4af62639d273f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.kwongwah.android/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 d045f129460e526ec866a7bbc1137fd7f42f687276ceca6d82d137ea7a5d490d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.kwongwah.android/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 dd1d6ad3c7d804c104080bcee310d7e3a1cee5061b05094a6f4343157c7ddf61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.crashlytics.settings.json
        • Path /data/data/com.kwongwah.android/files/.com.google.firebase.crashlytics.files.v2:com.kwongwah.android/com.crashlytics.settings.json
        • Size 769B
        • SHA256 0fdb5ca89d4ac27018e9497c8317f73cf041fdfd547ce0c67abf82fb473acf51
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        report
        • Path /data/data/com.kwongwah.android/files/.com.google.firebase.crashlytics.files.v2:com.kwongwah.android/open-sessions/6A73440703C200010FFD60C18EFB05F9/report
        • Size 738B
        • SHA256 e403d8e79201287aeafe89d14efe1d27e1d7cb08a3a587aff2067d2246582d16
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        userlog
        • Path /data/data/com.kwongwah.android/files/.com.google.firebase.crashlytics.files.v2:com.kwongwah.android/open-sessions/6A73440703C200010FFD60C18EFB05F9/userlog
        • Size 88B
        • SHA256 447a82542be4b4dc08eb3062983dc5f1ed0fc8fe9d6e3177e4d1ea11be2f3957
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        userlog.tmp
        • Path /data/data/com.kwongwah.android/files/.com.google.firebase.crashlytics.files.v2:com.kwongwah.android/open-sessions/6A73440703C200010FFD60C18EFB05F9/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512
        Submit Download

        PersistedInstallation1544969122218203739tmp
        • Path /data/data/com.kwongwah.android/files/PersistedInstallation1544969122218203739tmp
        • Size 90B
        • SHA256 9325f5b2966720a74d6aa7bc9761c2c893a03e51e78a8704e68ba6a0407329ff
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation3956740966384910763tmp
        • Path /data/data/com.kwongwah.android/files/PersistedInstallation3956740966384910763tmp
        • Size 90B
        • SHA256 a96c4313a4a26f1a27682e57550e2ba6d8bd96f65642e701e338cef0ff70478f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation4018587367312502834tmp
        • Path /data/data/com.kwongwah.android/files/PersistedInstallation4018587367312502834tmp
        • Size 558B
        • SHA256 8653ed46b413796a707dbe053fe5978275547d52740d70a20c4d81ff2066aa19
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation8488815264677658965tmp
        • Path /data/data/com.kwongwah.android/files/PersistedInstallation8488815264677658965tmp
        • Size 569B
        • SHA256 e5b4f3c33f1b2b1937ae8f5509dcb6c398219d103188a57800dcb3a2cdc76a1b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb
        • Path /data/data/com.kwongwah.android/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/com.kwongwah.android/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 a82582277c693a4ce5aeddf43eb6d63e9c379d8ef68295d325876c928d08325a
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/com.kwongwah.android/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.kwongwah.android/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 82d55a78e55ad31f60dcf9e1691f3aaf654cfb13a15634d26e5642b500319481
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.kwongwah.android/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 47260e0ad42ece0618c4522069c5324d244b32b3e7661ca19f8cdc87f0191418
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        [email protected]
        • Path /data/data/com.kwongwah.android/oat/x86_64/[email protected]
        • Size 60KB
        • SHA256 2bdd20086110e4aa2b93581a433f8cc68e82aa79890165c3be6b06e344e16201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        [email protected]
        • Path /data/user/0/com.kwongwah.android/[email protected]
        • Size 3.6MB
        • SHA256 581ea975c0ab7a38f4d0f7fea8573ac3bbb795201b9e81a36b24ec299a82aa0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        androidx.window.extensions.jar
        • Path /system_ext/framework/androidx.window.extensions.jar
        • Size 123KB
        • SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        androidx.window.sidecar.jar
        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 25KB
        • SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download