Analysis

  • max time kernel
    14s
  • max time network
    154s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    05/08/2026, 04:36

General

  • Target
    a1b2f5be6850468dc6937f9e37090f1844e95c1f34dca4d3aa344cffe6431f22.apk
  • Size 16.6MB
  • Sample260805-e8lhesde52
  • SHA256 a1b2f5be6850468dc6937f9e37090f1844e95c1f34dca4d3aa344cffe6431f22
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
  • Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
  • Reads the content of the calendar entry data. 1 TTPs 1 IoCs
  • Reads the content of the call log. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.liupait.tracero
    1⤵
    • Reads the contacts stored on the device.
    • Reads the content of photos stored on the user's device.
    • Reads the content of the calendar entry data.
    • Reads the content of the call log.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4843

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events
        • Size 40KB
        • SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 c4838b11511f17f73c145f2bc035a61aeaecbf4dbd95e9c97016a90a17c074af
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 f69ea72d25c03fb7adc2a9e229a4a10d3627bafbfdf7e278278a2ac7d8a1db26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 e6f80c357fc16be2921c07989d0755891f1c288759c2eda1b42a71be4b2cf7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 419127ee24437194efc09ec46d7fc07f31f67f5c90e9f2fbdd20f261613536fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 0eac59e12669d8e34e7a49ed1dcbad0f5f3fa61e093d6564868f0fa8fcee4066
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 16KB
        • SHA256 135658c69e51413bd73c3c50ebc793b291b8af348d4936c5a9b336cd517cc901
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 0e6bb3c41d565cbd8c48bf860a0b6cfe14e2b5685895177034335ebea5aa289f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 eb2499a9f3d2393859ba456bec7d92c00b18fe7a565dcbae51650806cb456750
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 512B
        • SHA256 73025637e274abd317a2dbfe09bec4c10f95ff668ff74fcc68c767354357b6bb
        • MD5 SHA1 SHA512

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 8KB
        • SHA256 0f4f1f4f6268828be74463cf2e085f382dbf721ab8fe895c64dd8412cf89a581
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 8KB
        • SHA256 b67da89ed2399f32cb1340c35fcc632f77a4202c2802975422448dd595898d9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 20KB
        • SHA256 0d7fecacf3bd063cf1daf474da21b63a034fec6a01fcffe8163785f476d71c99
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 20KB
        • SHA256 f24c8aea96bd58ae83870e81dbb3436d391a678d6d7404b62600a532bf868aad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 20KB
        • SHA256 ede35408444350042da12970b29891bde60ac6cf39550a2ffee798b7b6cb42a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation3959325859525553816tmp

        • Path /data/data/com.liupait.tracero/files/PersistedInstallation3959325859525553816tmp
        • Size 90B
        • SHA256 d62fc34cffe39a0f2796e598515333ab7f3636fd8dc730a46d5b348348660f3d
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation7034614603151986576tmp

        • Path /data/data/com.liupait.tracero/files/PersistedInstallation7034614603151986576tmp
        • Size 567B
        • SHA256 80e0a8326e2f4ef82c6f5847d58c0378b0e077d8dade8bdbdaaa1b6c34c671d1
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 e790ffbb83a2e6116917b33cec2351837fbb605835ef23d56016a6e77629cab2
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 8393e75bc62cc4e9398b5f30c9ce8dcf023824b8490550d06a4a0b43d40ddbf2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
        • Size 173KB
        • SHA256 b7b3abc89d1a9e95c07ee63eb60fd6cdfbed24a2d056a1a625c0291abee256c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 0ac70539558dbad00ca1e4ae69e51003dc124b893266126bab96c965dd5f5748
        • MD5 SHA1 SHA512 SSDEEP TLSH