Analysis

  • max time kernel
    12s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    06/08/2026, 04:25

General

  • Target
    4092dd77ee1ef7783f603afd31b7711961197e24a568e284a6d27325ba39cf56.apk
  • Size 16.6MB
  • Sample260806-e18yrashqe
  • SHA256 4092dd77ee1ef7783f603afd31b7711961197e24a568e284a6d27325ba39cf56
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
  • Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
  • Reads the content of the calendar entry data. 1 TTPs 1 IoCs
  • Reads the content of the call log. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.liupait.tracero
    1⤵
    • Reads the contacts stored on the device.
    • Reads the content of photos stored on the user's device.
    • Reads the content of the calendar entry data.
    • Reads the content of the call log.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4772

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events
        • Size 40KB
        • SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 e0dcc56f12c03d0d163fbb76c74393de16c8fd9759ac244e4f31a495c3363e38
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 cc341105e89751554d1619bb888c5c8dac52a8d09c327df4980f3b58a136ae3b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 3d99e4ae7c9fe8c03fe889878a88a07985118b006a3cc9d721e3a7ccb5b4c277
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 8a03fdf292e3504fdabb5f81946bbb084fa91c553752a236a811e199ce317c04
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 9781babd78506b0437a4716e412fa4434719db527d19a628dd21c84f8fee4e19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 16KB
        • SHA256 c133e59dbf1f1de4223f9cc4967db6887b5c52da7733551c99d9779f7933fedb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 78cf03a672b2b9689e96df6b78370df587f744bc59327d665fee3672ce2bc482
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 df631e1202b7d4e40594e830edb0b5e2727e1e750bd86c9aff42fad54d6bfd18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 512B
        • SHA256 4f3fa580817b4bc6ee27348ffaf74656d63ef6fe158bece6b90b1c51602a6fca
        • MD5 SHA1 SHA512

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 8KB
        • SHA256 1cbb6ed142a9e90bf36675cf4b1636eccdb153c8844293ef805fc66a32d0f9cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 8KB
        • SHA256 8dd10b6d9792e10fef91eb7db10fd45f5659865c78db41da7acaefade684736a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 20KB
        • SHA256 14e2ba33fff9c02eb0abeacc273ee5bfa5a1d3e341a8c2f3fd09adf095572510
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 20KB
        • SHA256 ef4d847bafe4fd62efa71ab7a0284715ac6e915548b215adddf2f046f73911ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 20KB
        • SHA256 fefc65acddaeee70af150370f669d8c8bf88e7c3ec4303c0dc0223911dbfe24f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation7390340007781167298tmp

        • Path /data/data/com.liupait.tracero/files/PersistedInstallation7390340007781167298tmp
        • Size 90B
        • SHA256 e6de34bdfa506ae8af5b1b9902d1621ba345eb1a4034ce2d838d60b91cefba80
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8253367571525923806tmp

        • Path /data/data/com.liupait.tracero/files/PersistedInstallation8253367571525923806tmp
        • Size 570B
        • SHA256 749e4e757fd7dedb2bb006c2f9500c4e01203c5308c400ecdbf7fb1c6605dc68
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 031e807bb70489986938e873ce538469ec135d40f9aca331e1264f1f7505e8b7
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 39c3db4f24cddb4ddf8bb24ca95ddebbe6de4b9f566a45b00215d4a2ac4f0647
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
        • Size 173KB
        • SHA256 2bfccb6453bf214d37645a49c5f645328a0e152ad32354bbd04dd481b2da8f3c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 5ea2d35fb1fb8cd10ffc41f430ff6cc2eb92443f1cde7f389ecf00217f7c6368
        • MD5 SHA1 SHA512 SSDEEP TLSH