Analysis
- max time kernel
12s - max time network
150s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
06/08/2026, 04:25
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
4092dd77ee1ef7783f603afd31b7711961197e24a568e284a6d27325ba39cf56.apk
Resource
android-x64-arm64-20260325-en
9 signatures
150 seconds
General
- Target 4092dd77ee1ef7783f603afd31b7711961197e24a568e284a6d27325ba39cf56.apk
- Size 16.6MB
- Sample260806-e18yrashqe
- SHA256 4092dd77ee1ef7783f603afd31b7711961197e24a568e284a6d27325ba39cf56
- MD5 8977bd27b0dc747c6850706d9123378d
- SHA1 9d8e985691bfa66ed83d58dac895bdf6f933b407
- SHA512 98a0e85f7fa1f18a3b4230aceb203011ba018ca2f3f969452c50548d3d3249e62971696f69391ae809d7b99e955ecef2b919fef46faba1b176c842cab0d5a07b
- SSDEEP 393216:ZPzcJ7YwPwVJAVTFXu9e91NVhJcn7NQr4yVRy7+m1mcEm/Igvksobsh:Zo1hPYLe91Ne7NQci6ocvFh
- TLSH T13F072351E7987A87E831A03A4656FB3075966C686B02E682791C33FC3B737F04B693D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/data/phones com.liupait.tracero - Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://media/external/images/media com.liupait.tracero - Reads the content of the calendar entry data. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.calendar/events com.liupait.tracero - Reads the content of the call log. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://call_log/calls com.liupait.tracero - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.liupait.tracero - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.liupait.tracero - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.liupait.tracero - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.liupait.tracero
Processes
-
com.liupait.tracero1⤵
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4772
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events
- Size 40KB
- SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
- MD5 1cf3f63c021d755a21623e6d0e86dbc6
- SHA1 e40e0f1faa61abcca7ba3394c54c92ff7334b49b
- SHA512 38d72e14f3513ffd26989cbda3df46ed3dd6e731bdfae56440eff6b64760cc13f91014281c9add61e018fe3529e49c63a6892ca22479515816c768b546244466
- SSDEEP 48:TfkL3u59MENZBdUdndVd/7T9IvdldHlq8/JqYpqPS:zkL3KMEX0xIyNYMa
- TLSH T1AF03EF5D4A202611C2BE083FD7E257931B3CE35F6B2387612E904CF6DDC68B6B821998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
- Size 512B
- SHA256 e0dcc56f12c03d0d163fbb76c74393de16c8fd9759ac244e4f31a495c3363e38
- MD5 39be40159ce1dc81eec842328e67a9d6
- SHA1 d2173225e517b21be7b791ff6626760a26bc2fa3
- SHA512 0edf715c5f1dad9be7b01e2a10f383f5970151765db3c957478ecbfc07da70dae92dc5718b99f21585a44aeb6d237de7488326b97ad520cb7e173714a35cc7c3
- MD5 SHA1 SHA512
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 cc341105e89751554d1619bb888c5c8dac52a8d09c327df4980f3b58a136ae3b
- MD5 4c1d04a8c03d299c71f76d5d1151a1f5
- SHA1 6ecc1d7de33f76f58588180ba3ea5c568b6afde0
- SHA512 c40a413bca15171c661fd0fff312c55ad961a6cdb472a4ed4026ed8be6644eeb71bfa69b35f65b04cab00f6e69cce3a6d57e2a3832168ff62df26663c3b23fbf
- SSDEEP 6:7+/l9VUlFn1NWWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKs:7+trUrRqLiuWdYRmBEyPbj
- TLSH T1A002C08C63802C13C83E167790EC83540D11E7388272CB1756A008943C0F4CCE8B0D04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 3d99e4ae7c9fe8c03fe889878a88a07985118b006a3cc9d721e3a7ccb5b4c277
- MD5 1fd62279af62218b73b7ec892cef4411
- SHA1 4790e07232df4ac775c9a56fd6fc19c6436c920a
- SHA512 402590efd3c459b6641c0e0061b979b6e20e5106a46b6caac6cb411e74a2023c8659ffe46ab4d0a2e104c75316b85a7d548d82d3f824698d613dad2dddb242d6
- SSDEEP 6:7+/l9/aSFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKkakt/8v:7+tdaSBqLJdeWRmBEyPbMs8v
- TLSH T1C6022288B3810803C0696B7FA0CC83801E12A7289323CB8B179108687C8E6CCA891E00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 8a03fdf292e3504fdabb5f81946bbb084fa91c553752a236a811e199ce317c04
- MD5 aa4d4de626df7e120d0eb85812f7b512
- SHA1 ddff789f1feeeee18a36e63927d16fcfb3814c00
- SHA512 f03ed38ace98939a08d7e71bb6b665a751293fc176e11941e8975163a9acc18f04a5567168f647f9f2a497965ba2d3f0b0d6437f554eb1d90de2f6510a0d3b02
- SSDEEP 12:TLErtURnCM5fu0QHSk2F+DugFjJAOsEexOGQGTuRmBEyPbGtOwOSsd/Ex0Kz:TLErtAn9uBUZgFjde3QUGSiOSsdI
- TLSH T1A2D2DCD5C38D3300C504423AC016C6A08D4A4D4DC1A767A789C038A89E83519AEAEE6C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 9781babd78506b0437a4716e412fa4434719db527d19a628dd21c84f8fee4e19
- MD5 4cf861d12a73c5fcb7b225ee1ad6279c
- SHA1 06aafaf8fb24c790ba04cfef504e5f52ab2f2c5b
- SHA512 d47845fbb700e0733b5870d8ca7eaf1c3c6a113c2b57090d19e54398e291a40a2df9276515eabde3298d9bcd5d5702a0cdcb82facc162af8c10a039abef337ef
- SSDEEP 24:TL5tuan9uBUZgFjde3QUGSP/uDJArSsdsR3x:Tuhaye3KSP/F/dsR3x
- TLSH T1B4D2C9E5D09F2200D5455278C02988909C4A1A8FC6B7679A9F813CD58E83419AADFFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 16KB
- SHA256 c133e59dbf1f1de4223f9cc4967db6887b5c52da7733551c99d9779f7933fedb
- MD5 3c89b97bedc033331c5d4027934cefb4
- SHA1 d3ca1cfdfc55e0d8277f7c491efc473e83cf13f9
- SHA512 67144c8ea36f2770134bd45126146fa20005019f5096daed7521119909083d0c4b133d556eb353ee14f2382aabcfbbf0a07a0cecf9ed79904d98c3bae940bb39
- SSDEEP 24:TLqtun9uBUZgFjde3QUGSP/+QA8bAZSsdM:TUaye3KSP/+N8b8dM
- TLSH T1A57225D5D4CE2302D2155175E0551450AC0A1E4EC17327D79AD23CD4CE8341AAEEFFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 78cf03a672b2b9689e96df6b78370df587f744bc59327d665fee3672ce2bc482
- MD5 75440d2960371842f619a597c746d807
- SHA1 5e80a50e8ec1393431114b7d6fe153ac17804a02
- SHA512 e1d729d1c9c3446613ab751e16c3cf81ef50b6a601a1b764e6e34ef53d2f753cb3c8fc51ad150f18cb155503fd7e017130f3e06e6aff7d6815b9ce8df62b769a
- SSDEEP 24:TLbtNn9uBUZgFjde3QUGSP/hjQ9429HR3QA8bAZSsd5Qw/w7:TEaye3KSP/hU9429x3N8b8d5QAA
- TLSH T1D4D2E2D498CE2303DA241076F11A4841FC1E1A4DC56317D1D9A23CD18E83446BAFFFE4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 df631e1202b7d4e40594e830edb0b5e2727e1e750bd86c9aff42fad54d6bfd18
- MD5 ef404e17bb0fd83a8bff3deb8b233c92
- SHA1 f5ebcd1a564f287ce0a6564f28e4e05e74c21716
- SHA512 8d4585a89193b7104c2ed80faf1e5892aa2d5c5c7960fc05ea9c62ed92966f7f77f8bf4ab0f0ba70a713a1461e4898df2b38262cfb44afd87fad9455ec99511e
- SSDEEP 48:T0aye3KSP/ydjcoZ/m/lnMu9429x3N8b8ds:Q5GPqtZNu9HnS8y
- TLSH T15ED2D4D998FA6303D774503BB0579841BC0A2D49C1B30B95B5932CE48E53806BABBEE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 512B
- SHA256 4f3fa580817b4bc6ee27348ffaf74656d63ef6fe158bece6b90b1c51602a6fca
- MD5 939ed9dc6bde1bd27a79dfbba2c40c79
- SHA1 272f57dbdb2c2b58381f342224a7b7fa08602496
- SHA512 cbc95f6ff7bb1c7e8278874c74c5515ef287d52fea784710af05cea8ac0c4ad47f7a2e765d000a070578214dc833915e3497a51ee1b472833863576f189bb7cf
- MD5 SHA1 SHA512
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 8KB
- SHA256 1cbb6ed142a9e90bf36675cf4b1636eccdb153c8844293ef805fc66a32d0f9cb
- MD5 4affdee3283e8a35938d5d14260293f6
- SHA1 20c7f22add8eb9d8e041f4756fa3f06cf38a52d9
- SHA512 cfc8966f1f5598c5569ecb44727a563f18495f4e67623817bfbe47977cbbed4f93184a2c651bb883b23ea8e880307c87ba2d8e683573d356ec20e04a2d764871
- SSDEEP 6:7+/l9Xn18g9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK8Yb:7+tIqLiuWdYRmBEyPbQb
- TLSH T19402228863C20922C8A916B7A0D483601E00B7A881E1CF17169008942C074CCA4E0D88
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 8KB
- SHA256 8dd10b6d9792e10fef91eb7db10fd45f5659865c78db41da7acaefade684736a
- MD5 417134b3ce39b9b88c9428adb0eb8a2e
- SHA1 df5656278e65268a311375a7ef6f9f09177d99aa
- SHA512 8ec94068d8bd84eb66d1f4262506404f84c0cd712762e386a6bcdf2435f88a9584e32efdc7f12c879d495906a75a60e432cfdfa4fd7aa64af91c11a3fd572673
- SSDEEP 6:7+/l9IPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKMRM/1:7+tCqLJdeWRmBEyPb9s1
- TLSH T16B0280C967C10923D72DB7B7A0D983541E34AF2DA777CB5B1A9108947C476CCE890D54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 20KB
- SHA256 14e2ba33fff9c02eb0abeacc273ee5bfa5a1d3e341a8c2f3fd09adf095572510
- MD5 79d2ec2576c829cb28ced76df7d3811c
- SHA1 9396c31d9969dd9cebf0340fb74954eeed4fd729
- SHA512 9c8bf89006b5704915820f0afa07b0d44b14f7118e479781301bdba94a90c68ccfd38072288f8a8b5783dd23d4781d456911f97d96d690f54a21ea943f4a77b3
- SSDEEP 12:7+tBAyqLftvRnCM5fu0QHSk2F+DugFjJAOsEexOGQGTuRmBEyPbv2:7+tBTqLftJn9uBUZgFjde3QUGSv2
- TLSH T16392DDDDC98E2331C0095171CC518E508D3A0E8DC1E367A719E03CA85E9351998EFF7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 20KB
- SHA256 ef4d847bafe4fd62efa71ab7a0284715ac6e915548b215adddf2f046f73911ca
- MD5 e2ed8451987f0f8c187b2b5fb2d7bd30
- SHA1 04539fc797ec8a6ebf5d4ae724c7092dc0377235
- SHA512 1686ff96cc2bdc4c63c6a2033904c691b0efaaae9aaeb6a2b63eb1839ba08c4f4cbd67f9faaf6d232a873eff9aa9e2b2b16dea8045c910955bc19a335a177bfe
- SSDEEP 12:7+tTmRDHX+Ssd/EsqLErtURnCM5fu0QHSk2F+DugFjJAOsEexOGQGTuRmBEyPbv:7+tTLSsdpqLErtAn9uBUZgFjde3QUGSv
- TLSH T18C92D0C6C54D7300C10181BAC45A85A099660E9DC1A367B775C038F89D8341D69EFE7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 20KB
- SHA256 fefc65acddaeee70af150370f669d8c8bf88e7c3ec4303c0dc0223911dbfe24f
- MD5 ef3b12b895f58f8cdb4ff63e157ae554
- SHA1 fbae30776e0dba5f83d1c81cb1b548a8a0a111b4
- SHA512 4a26ee34b8e54b6f0d3d32cc4109dea7d987e84cb582d861abcc5af5e1416e72859850214e48f00ca7f08df7ecfa7cf814c23b941e01ef0f78b5cd81be7c9418
- SSDEEP 24:7+tdhrwywcZJQ9429HR3QA8bAZSsdGqLbtNn9uBUZgFjde3QUGSw:7Mbrp3Z29429x3N8b8dGqEaye3KSw
- TLSH T17E92F3D898CE2303DAA41076E11A4C50B81A1A4ED56357D19BE33CD18E838467AFFEE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/files/PersistedInstallation7390340007781167298tmp
- Size 90B
- SHA256 e6de34bdfa506ae8af5b1b9902d1621ba345eb1a4034ce2d838d60b91cefba80
- MD5 48bf0a2a0c70f587c77410e168993e37
- SHA1 6418ee3bad847ebcd2727ab9b879c188c3a00a0f
- SHA512 49808e5fc6de6bb2bfce6b07f93b950513ed301dd547deea7e1fb9daa6754e65c2ebaa9f134da0b11c174d7ee75aa939818b47b03e3ad08c6bfaa1b77d738bf3
- TLSH T106B012084730C18589C9A3021D8CF2802F502C410C098B158F0DD05141D12D08103DDD
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.liupait.tracero/files/PersistedInstallation8253367571525923806tmp
- Size 570B
- SHA256 749e4e757fd7dedb2bb006c2f9500c4e01203c5308c400ecdbf7fb1c6605dc68
- MD5 16244d7bc3cd9e67851ab036ed61a7dd
- SHA1 f5e3021da3fb82c3e14d7281a9d7ea69abdd65a0
- SHA512 52302bce4a576d8836d07f08cde97b3f2016cfd70a5974022503172f9506e533ad9cb8e0f713586f0ce64bd8efb3d553e98f9edd9266ba4f5dd7bbccd34a035f
- TLSH T131F0268EDE318B4C8D59360215CCFF847E3A084218888BB57E9E64E447E4E9E5265044
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
- MD5 7e858c4054eb00fcddc653a04e5cd1c6
- SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
- SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
- TLSH T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 031e807bb70489986938e873ce538469ec135d40f9aca331e1264f1f7505e8b7
- MD5 ed63a18c29a6c7891ea35430c1d3e8f1
- SHA1 62f177b77f58d23bca98846c9a5731a6f2f61530
- SHA512 55366b16e35a32e7e7daee5a1b7a2e49402910ddcd0f1f794e7954d70401712f243a4f5fba9d8210bdedde096fce8417e166f5d5bbc9c1f8eb8fab32c9cda0c0
- MD5 SHA1 SHA512
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
- Size 108KB
- SHA256 39c3db4f24cddb4ddf8bb24ca95ddebbe6de4b9f566a45b00215d4a2ac4f0647
- MD5 d4ff0374cd9475a5095274a941428d2a
- SHA1 be8448ed05eb913c8d85bd33c14a8ee4375bc9cb
- SHA512 1499536aa91023fbbb8305cd348df5949728910d7b1dae4e5659fab807717cf3e56cee6f862f0dd44d3ec48efa7673d4fdaa859a620aa62c1f5a9eb2aff21326
- SSDEEP 48:WFY66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI9Z:U6+hdjnHtDRMpf8UzS6+BD8q0ExPeJ
- TLSH T16EB3254F1F192540C49AE4F0A5D20FB17B3E512DD393E3E9A5910079ADC6A30DE25CF6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
- Size 173KB
- SHA256 2bfccb6453bf214d37645a49c5f645328a0e152ad32354bbd04dd481b2da8f3c
- MD5 1497598050d59852868b17e6ddb80d1c
- SHA1 e4510affc6cd1515b502582d1bc1c92051845ecc
- SHA512 607acb51ae6f28256558cf0df988a777250c3504053bef098821503532aeff708e1b58628cf03df00327ef0d9b4c52deed10f90cf88f84521af9dc3e1c2d03d7
- SSDEEP 24:jAxktYAyfuKvaymmWcQmV98xktYA3/+E4u:kxktY5vaymmKW98xktYO/3
- TLSH T16E049E9F1350B121EA624C3EA44373F02A6CBB51DC27186EE099F2793CCDB55656C07C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 5ea2d35fb1fb8cd10ffc41f430ff6cc2eb92443f1cde7f389ecf00217f7c6368
- MD5 d019967cef94e43042506940c67399c7
- SHA1 2899f1097207426005eb1c0aabf64bbcebea8944
- SHA512 95fbbd5fe6dfc3de01f5365c667877f66c5fc13ffd6e7800215dfb2b6b344a39b23fdcac744b4701518905894688c2d37d1a391f4bc63db03c5e891219bb32d1
- SSDEEP 6:Kxxw/UEnJ9FZde/kPlOERX4PBX4ogLugMBX4suuK+/IEwX9QnQVOw2:KxW/vXzdeWRmBEyPbP/IEwg2Ow2
- TLSH T1C5722BAEA3C01662E917C33394C7D3040F6036192397C70FE562153C6C83BCCE160D08
- MD5 SHA1 SHA512 SSDEEP TLSH