Analysis
- max time kernel
14s - max time network
154s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
05/08/2026, 04:36
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
a1b2f5be6850468dc6937f9e37090f1844e95c1f34dca4d3aa344cffe6431f22.apk
Resource
android-x64-arm64-20260325-en
9 signatures
150 seconds
General
- Target a1b2f5be6850468dc6937f9e37090f1844e95c1f34dca4d3aa344cffe6431f22.apk
- Size 16.6MB
- Sample260805-e8lhesde52
- SHA256 a1b2f5be6850468dc6937f9e37090f1844e95c1f34dca4d3aa344cffe6431f22
- MD5 3165dd8fe6a8e21868de37ca344403dc
- SHA1 36fe55ad21856fcb1b56e1927693610934e0645d
- SHA512 4214f43bd4dd6d9f37ba2aaf2a3d890aaa53f35785db986f4594e382ffd5dbcb46e33c32442114352c3cdfe019945e4106c27f791682a93a4bdde4e87391b7e3
- SSDEEP 393216:rnG07B+0Z7YwPwVJAVTFXu9e91NVhJcn7NQr4yVRyE0skCNAvksjmsmy89mN:7G07BdFhPYLe91Ne7NQciXk2nDgN
- TLSH T118072351E3987A87E831903A4656FB3075866C686B02E682791C33FC3B737F44B6A3D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/data/phones com.liupait.tracero - Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://media/external/images/media com.liupait.tracero - Reads the content of the calendar entry data. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.calendar/events com.liupait.tracero - Reads the content of the call log. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://call_log/calls com.liupait.tracero - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.liupait.tracero - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.liupait.tracero - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.liupait.tracero - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.liupait.tracero
Processes
-
com.liupait.tracero1⤵
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4843
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events
- Size 40KB
- SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
- MD5 1cf3f63c021d755a21623e6d0e86dbc6
- SHA1 e40e0f1faa61abcca7ba3394c54c92ff7334b49b
- SHA512 38d72e14f3513ffd26989cbda3df46ed3dd6e731bdfae56440eff6b64760cc13f91014281c9add61e018fe3529e49c63a6892ca22479515816c768b546244466
- SSDEEP 48:TfkL3u59MENZBdUdndVd/7T9IvdldHlq8/JqYpqPS:zkL3KMEX0xIyNYMa
- TLSH T1AF03EF5D4A202611C2BE083FD7E257931B3CE35F6B2387612E904CF6DDC68B6B821998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
- Size 512B
- SHA256 c4838b11511f17f73c145f2bc035a61aeaecbf4dbd95e9c97016a90a17c074af
- MD5 d5fae249af0df0e5a535c6da167e81bd
- SHA1 6154f323cc5367d9c2f80ba1633c2fc40498a560
- SHA512 607f4b23e63d629bf452d4c6b3ad8c64df053012603780d86c133d3c9657fb3de527c39de8792fe0d1672a625862a598c48e3a08609b61e0778494466e6a3849
- MD5 SHA1 SHA512
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 f69ea72d25c03fb7adc2a9e229a4a10d3627bafbfdf7e278278a2ac7d8a1db26
- MD5 09719bbab390b3e82ab446e44d46b738
- SHA1 9ce9d1793196c9a11f171a514e86c2c007df3635
- SHA512 d727b26cb602002000a2d31cda4a2fc38669f2267ec49d9597cac7920d4a5645c015930e97a40b6eb6c61e90b98ef576a74ca588e16d18802c172d30a92df4ba
- SSDEEP 6:7+/l91/gn1lng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKS:7+tbwnqLiuWdYRmBEyPbJ
- TLSH T19E02C09CA3803B23C83D167798D5C3500D00E73981B1CB27169108A47C074CCF8A0D04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 e6f80c357fc16be2921c07989d0755891f1c288759c2eda1b42a71be4b2cf7cd
- MD5 414d917554268d0932a8091f6f305edf
- SHA1 2edd6bf167c43745d64a7a6e0cdae6b97765faf5
- SHA512 d8023dc87f0cea8004e40fd99a6b6bf3aac624e82328e31326e37388dfcf7a331ae52ef41b48a6fffdd94245fd3d476e4fcdae3d3fa98ba30856aaf601416d72
- SSDEEP 6:7+/l9hHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKSKC/7u:7+tXvqLJdeWRmBEyPbxKS7u
- TLSH T1F602228963420803C03D9BB7A0C883901E19E72E9223CB072AA128642C076CCE890D04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 419127ee24437194efc09ec46d7fc07f31f67f5c90e9f2fbdd20f261613536fe
- MD5 d514e1d21c949603bd35340c18eb87a6
- SHA1 a52883f8162d2a926ba712215e65e24109836b7a
- SHA512 4f398d2af9e934ced86f5f8f28d8ddab2f52c8b5d11fb9faf4372d8fa5688021b6f77877935b9089df3c2d628309f409983e65145f444c4a423d44d744f006e8
- SSDEEP 24:TLErtAn9uBUZgFjde3QUGSioMwQ5Z/8tm/lMJUM:ToZaye3KSShZ/8tm/ly
- TLSH T112D289D9D2FC7303D275513BA026E352B9451D8CC1A25B5765822CBC0D93909A9BAA3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 0eac59e12669d8e34e7a49ed1dcbad0f5f3fa61e093d6564868f0fa8fcee4066
- MD5 7c74eee4420f5028ef5000fc6be14414
- SHA1 0587f966e0b7725b02a569d17ffac7bac75a4fa5
- SHA512 3301612deee8835e714b905ee8f1c9df3f195912a0920fd5868d028202f9a18dffda4ca83490e0eb8109a5e362fae6c31a7e18b2c1991667309c68182e2a7e4b
- SSDEEP 24:TL5tuan9uBUZgFjde3QUGSP//swQ5Z/8tm/lMJUgR3x:Tuhaye3KSP/khZ/8tm/lGR3x
- TLSH T103D2DDD9D0FE6313D2A55176A0269151B8051D8DC2B35B46AE822CE90D83818F4FFEBC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 16KB
- SHA256 135658c69e51413bd73c3c50ebc793b291b8af348d4936c5a9b336cd517cc901
- MD5 6931ad72e31039a9c99ef86ec1454f1b
- SHA1 021478ee74672268affdf225cfe32f7d17745b62
- SHA512 48bba7a9745fa2911e50c6b70da42df771edea96876a35f6b27c98da219993d6872ed9e0a003dcf64465577a1a9a56e0ad9574989c1db9af06503152533f2f45
- SSDEEP 24:TLqtun9uBUZgFjde3QUGSP/qaQfN5UwQ5Z/8tm/lMJUQ:TUaye3KSP/lSOhZ/8tm/lC
- TLSH T16172CCDEA0FD6313D275207774665202B9051E8DC1A31B96A6933CEC4D83819F9BBB3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 0e6bb3c41d565cbd8c48bf860a0b6cfe14e2b5685895177034335ebea5aa289f
- MD5 1a9537de7452d0f96b7e735647d3ba74
- SHA1 45d52b521f02421b30345250880e6cdbfdff3262
- SHA512 c2ac5c4da8696cc6c85a404b782abfb024361a3431e0ba0ae0c3c714d73e69953a601e8681983cf12056093abea579e2532e1a31ff28ba7aeecc1e7799c82fcd
- SSDEEP 24:TLbtNn9uBUZgFjde3QUGSP/hsBQAqiKZf3QfN5UwQ5Z/8tm/lMJUtQw/w7:TEaye3KSP/hBZiKZf3SOhZ/8tm/lzQAA
- TLSH T19DD2E1DDA4E92713D2B42037B0274542BC05194DC5630B91E5A33CE90D93855F9FBEBC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 eb2499a9f3d2393859ba456bec7d92c00b18fe7a565dcbae51650806cb456750
- MD5 e4e4f70419dec28f83b98c0316b65e00
- SHA1 4c5b3df174ad32ea229414715b018e1786cc7209
- SHA512 af2a96f7449e6c3752d0cf36a10ff788db14964451854d894e188dffd028d0ced79739ea901ace285e8dd3747700cc81a38a78e6d4f49c9d249d2ab8fe70bfca
- SSDEEP 48:T0aye3KSP/46XxkZ/pm/lnCZiKZf3SOhZ/8tm/lm:Q5GPQ6CZ7ZvCOhZkv
- TLSH T101D2ACDDA4F96703D3B4203BB0679642BC052988C2A20F55A5932CFD0D93C19F9B7AB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 512B
- SHA256 73025637e274abd317a2dbfe09bec4c10f95ff668ff74fcc68c767354357b6bb
- MD5 3316e116031d36998523135dc418c13e
- SHA1 69f23808cfc5821ba5c8e4b4d52922589ddf30eb
- SHA512 4d769b03f8dc8aa38dcb624bab092c647e2431ef204f5ea8a493bf4e88c61f9ed73d7619d0544396943d4bcec6438a0e44560bba48139ca601e5bf9643533ab1
- MD5 SHA1 SHA512
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 8KB
- SHA256 0f4f1f4f6268828be74463cf2e085f382dbf721ab8fe895c64dd8412cf89a581
- MD5 13978cc427c94f4b49ef3ba37e310e1c
- SHA1 ec15df5e17b8cac8b96a80f895e84311b78fb4ba
- SHA512 69ebfe0f32d30b55fe850942f022d63a1215d2b5623ba905d5b61b7eae38aa082cb2e13f7f363e63b4c5b97c3efebd8153b4371b60f7b5e7098064f2868262c7
- SSDEEP 6:7+/l9LOn10IRg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK4Xn:7+txVIRqLiuWdYRmBEyPbJn
- TLSH T18702C0AC63820823C92D37F7B0D583400D00F7298671CB1F56A00C943D074CCE4A0D84
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 8KB
- SHA256 b67da89ed2399f32cb1340c35fcc632f77a4202c2802975422448dd595898d9f
- MD5 db9e9b21014e9a772780176518c5c2c4
- SHA1 15e2da5bb6389689ae92c03a1a46e3b2d86dd6ad
- SHA512 611eb7d34c3c2717d5fad0b417ef18aa283eccd5e3a2a4b7b462375944693f9894559e35fd4f7881c51d124469fd8062a6b53e312865f94cc14d8b31bd4f0969
- SSDEEP 6:7+/l9a2FPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKMl//Sh:7+tEsqLJdeWRmBEyPb1lXY
- TLSH T1CE0222A8AF400923C12917F7A0CA83401E18A728A223CB271A930D552C066CCAC94D04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 20KB
- SHA256 0d7fecacf3bd063cf1daf474da21b63a034fec6a01fcffe8163785f476d71c99
- MD5 8574200ef831170fa00b275575e31b26
- SHA1 fd095da374c60916f5afcb912bcedac73ee8dd7d
- SHA512 30e6cc236714953c4e8662f0d20b2bbfda26a7ebffe773bac20facee732c9aa1bd7d61edaecdfc39dd682ad75a927978e9dacd31b01ed70b37562b0a2ed1976f
- SSDEEP 12:7+tWLqLftvRnCM5fu0QHSk2F+DugFjJAOsEexOGQGTuRmBEyPbHx:7+tWLqLftJn9uBUZgFjde3QUGSHx
- TLSH T1DC9299E9C69D2320C1095171956191908D2A0E8DC1E7B7A749D23CAC9E93519D8FEE7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 20KB
- SHA256 f24c8aea96bd58ae83870e81dbb3436d391a678d6d7404b62600a532bf868aad
- MD5 824f123d6501894d0a4fc48020f8adb0
- SHA1 2bb558fcd27d2def494485cec2f793f920c02d9f
- SHA512 c487aa7befba563850c50cd96b607cd82a95f3ca41a22194a01c33b703ef5af1f78ca79fabac5da11d65205118956d37ebf01c03c0fb9cc2cd2339ebf2325534
- SSDEEP 24:7+tW2fMwQ5Z/8tm/lMJUnqLErtAn9uBUZgFjde3QUGSR:7MW2EhZ/8tm/lBqoZaye3KSR
- TLSH T19292C9EE91FE7303D271513BE0669252BD011D8CC1A25B6655C22CFC1C83809A9BAA3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 20KB
- SHA256 ede35408444350042da12970b29891bde60ac6cf39550a2ffee798b7b6cb42a7
- MD5 36a0e1e6113e201451f6b58e5d426482
- SHA1 1e3c7f956c4f7a0531fef17081c60f162ce44e86
- SHA512 08b56f2e6f27439e694519f09df9a435e377e700e9a1c8a99b17bbf4796a856659bcd78e0a00ee4ddf0588920f372073ab1ce3e9e1454a91ca575ebc20e1d3c4
- SSDEEP 48:7MLhrXtHZiKZf3SOhZ/8tm/ltqEaye3KSb:78hxHZvCOhZkaN5Gb
- TLSH T13392DCDEA4F92313D2B42037B0664542BC191D8CC5A30B91A5A32CA90D93895F9FBABC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/files/PersistedInstallation3959325859525553816tmp
- Size 90B
- SHA256 d62fc34cffe39a0f2796e598515333ab7f3636fd8dc730a46d5b348348660f3d
- MD5 0e1a63ea18ae7eb91c38cf655c0bf567
- SHA1 fdc42760bdb425602f995d4a0024d71655194795
- SHA512 86f171f3996c6f957bafec670d2fac3df0439f4dd149bfb3c70557cf9e893098087c449678cea693db5365dd14b769a1096d30e99e1c91e0b35119e35389cdab
- TLSH T164B01290D6708782858DB3021C4C92103D915840040ACB144E19D84410D12E58183BD4
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.liupait.tracero/files/PersistedInstallation7034614603151986576tmp
- Size 567B
- SHA256 80e0a8326e2f4ef82c6f5847d58c0378b0e077d8dade8bdbdaaa1b6c34c671d1
- MD5 3f21bf86dbe9212bde7fd121fafe4f56
- SHA1 f91d9d9e164cb7a8d7cc97a54986d0d3245a218c
- SHA512 a8205b517f786c185095c87ea2698cf41f45d368fed78c8576bf4bb8f97cb634ca0eede94509e885379f22b8b74972854957176332cba51f64fd24450f0542aa
- TLSH T16CF090D22BB88F94C75C3202228CAC11DE224881018E82EAAEE28970A3E04A7A343000
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
- MD5 7e858c4054eb00fcddc653a04e5cd1c6
- SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
- SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
- TLSH T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 e790ffbb83a2e6116917b33cec2351837fbb605835ef23d56016a6e77629cab2
- MD5 9a0ab97dc4b96c3760eb0e9ca722adf9
- SHA1 a7a74dd5dc36d2722fdc607ccfd28fe468feea8d
- SHA512 0b86a165a5a3ed78799a6b688b957652c898335504413cbcb42674c01e74802032b4903710fdf35e539f6752a5ef8be826bdeec87e14e4d39a97a3fc91311aed
- MD5 SHA1 SHA512
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
- Size 108KB
- SHA256 8393e75bc62cc4e9398b5f30c9ce8dcf023824b8490550d06a4a0b43d40ddbf2
- MD5 d2fede2a52ab161bd38fc024faea68d0
- SHA1 435ec970d44ece6d10481b0824c08cf316f19a52
- SHA512 ba840f63e359d84167e2e0a300fa3444bce6c09979f0c6b3929a4bff3ef1d79b52a4390b9696274b1133ddce87d1ff6cdfef04ce2ce17aa5b3e152b86cfab2bb
- SSDEEP 96:o6+hdjnHtDRMpf8UzS6+BD8q0ExPE/N/c:sdjnHt9Mpf8UzS6+BD8q0E5E/N/c
- TLSH T13DB30F4E0F193980C59964F4A9900FE1793E512F9397E3E66E910076BEC2921DE39CFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
- Size 173KB
- SHA256 b7b3abc89d1a9e95c07ee63eb60fd6cdfbed24a2d056a1a625c0291abee256c0
- MD5 aa31ce9f37aa7d3efd77f735fc59b3d7
- SHA1 8810fd35e42f8155fb67b8386a39f13a15a1bb4e
- SHA512 3310ef32ff0f30ed2ab5692b33401f1947d51a350c4491254c1c273911ca5b13f0cf063eea06331aca192ae0af844efa77e54d435842af2b77fc4b9b30d256bb
- SSDEEP 48:7gL3tYkygLvhvgLRlvgLtC7gLvgLJgLIgL14gL3tYO8gLMgLx:kL3tYeLmLwLtXLYLCLzLpL3tY4LHLx
- TLSH T111044BE6CAD89844DEB484BF9C469FE60D843C5507ACD1DE3AD9F1363D074162A38C1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 0ac70539558dbad00ca1e4ae69e51003dc124b893266126bab96c965dd5f5748
- MD5 bcd71edd3a2e4533f98cc38b072f1f0e
- SHA1 94c16f49a77d8e9964f46d95f5d074b56de465eb
- SHA512 32ed3542d411d276274e0957412cd46fa74c1bbe4bbbff5d800476ea0ceda6d58a70dd8d72807586f59b64ced543b50d2cf0e01fc76adb7b3176e145d7612ebe
- SSDEEP 6:Knn4LtN5Qv9FZde/kPlOERX4PBX4ogLugMBX4suuK+/hlmMRHATGiOw2:K4BQlzdeWRmBEyPbP/zRiOw2
- TLSH T16F72C26493806F83D6184B7A58C5D3D00DA5771F275BC7CB1F8204167E42BC8A1B0D0B
- MD5 SHA1 SHA512 SSDEEP TLSH