821362bb4a7334688cc8a635f8d198f28a192dedbef309b25e39790efcfd4946

Analysis

user interaction
yes
max time kernel
62s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
07/08/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
base.apk
Size 7.3MB
Sample260807-s8texsgf64
SHA256 821362bb4a7334688cc8a635f8d198f28a192dedbef309b25e39790efcfd4946
MD5 9ea0935a3dcefc6245e2f6065f628842
SHA1 58378c7222d6fa62449e36daa7f9d5aa858cde79
SHA512 4e39971f18f95ede2ce92da592fcc305d542554f9ffec806add18b410d5ac9db0ccbb84e9767744dede9aa59808c0ef2a1ef5c106f124d9b992e59d498762d4c
SSDEEP 196608:rD/TOANNEUTK37aDIjCEk3XlvuMiwfCPyshwbFNsppo:ruANG7aFFDZfCPyGwbfspW
TLSH
T19276129AF31D902FC93B65724ABA232113A74C4649C3AF937944B20C2AB79C45F5EFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery evasion execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/data/local/bin/su	pl.rs.sip.softphone.newapp
/sbin/su	pl.rs.sip.softphone.newapp
/system/xbin/su	pl.rs.sip.softphone.newapp
/data/local/su	pl.rs.sip.softphone.newapp
/data/local/xbin/su	pl.rs.sip.softphone.newapp
/system/bin/su	pl.rs.sip.softphone.newapp
/system/bin/failsafe/su	pl.rs.sip.softphone.newapp
/system/sd/xbin/su	pl.rs.sip.softphone.newapp
/system/app/Superuser.apk	pl.rs.sip.softphone.newapp

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4902	pl.rs.sip.softphone.newapp
/system_ext/framework/androidx.window.sidecar.jar	4902	pl.rs.sip.softphone.newapp

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	pl.rs.sip.softphone.newapp

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	pl.rs.sip.softphone.newapp

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	pl.rs.sip.softphone.newapp

Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	pl.rs.sip.softphone.newapp

pl.rs.sip.softphone.newapp
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4902

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/pl.rs.sip.softphone.newapp/databases/com.google.android.datatransport.events
Size 56KB
SHA256 797ee7ea127560e22df6130473a612dabd701e9463d7d9544a56630265aacdb7
MD5 3655a4e7d95bdae457859dd5213f2494
SHA1 b8b57e1f509f9a795828f50dd95afdeee641a852
SHA512 d9946f111a829bfd5310da2cb879eb0a34ec31dc141622fd68ca771a2b1ff979ca5882e4d008c9c5f178e3ec92d76d4c85f719d8ba904b99b2718fe1ff1be42b
SSDEEP 48:TG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSq3:WMEqzAiwIyNja0
TLSH
T15043635D5A3C2220C57E283ED3E243A35B3C93DF5B22922139948CEA8DC246974355AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/pl.rs.sip.softphone.newapp/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 fa92854a02fa568d1a0287859cadde86edbd94c76c6af15abf5018182c1897d8
MD5 b8c097d4c4eea43997c5c2802ca7ed8a
SHA1 d919b549d7bd47d8f346648b866d9096be16d3b0
SHA512 c48c2ec481a346112e58a18e4366564111bfc9ba5328b51b8964ec41f4582804051c3af8b9de40510c2fe4abcca3560b06009b67e845f066afda0dcd8270e60f
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/pl.rs.sip.softphone.newapp/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 7fcc46d4ac2fd0dbd49f9636d490438aef5e15470d2ebc124aba4dc12ee81f4d
MD5 b3f2f473306bdec3f26c04ec3448a0c4
SHA1 20fa1d922de3a06b0f299a3c9d7c99b8aac2ef3c
SHA512 e0ed88c22b686278599c0b06dd9cd5feeab4d5d573a10d5d8406a7f30cb31d14ec6ad1f770fa90e4135cf06829d0d8b33d5b6a84f6707197a5a8935351fcd530
SSDEEP 6:7+/l9mzn1Hg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK23:7+tsFqLiuWdYRmBEyPbH3
TLSH
T11102229C73810812C82E177798EA83800D00A72CD161CB9B179108A9AC079CCB4E0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/pl.rs.sip.softphone.newapp/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 58f65c30e1928722b9c3150a95b242abd49e1cbb62a28d034fa5f556c7665885
MD5 5cd6cd857f90b6ce1854c42eae7c141b
SHA1 e9ab866582d0b4eae3639262784eec782dab22d2
SHA512 a4433e879e5466d9a6d1cba5974ed7e64544677ce6f65b1298f07c6a164a1e9c6c53f6d3bdbc508b79a9c8c0dfe6d772ec88bb81085cf86cb5466c57525483f0
SSDEEP 6:7+/l9d/lgPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKAns//0+n:7+tz6qLJdeWRmBEyPbBsX0+
TLSH
T1B6022288AB410813C02E2777A0E8C3401E18A72893A3CB0B569208542C0B6CDE894D84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/pl.rs.sip.softphone.newapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 11827f5319637452ec0b491c6e60b2e5959d284be4f6c73a857ebd4bf76ebc6a
MD5 4883aecedf5a4bdd143503d0afa7e097
SHA1 a6986af92e07e760323bd7474f2ecd549c9ff5e3
SHA512 b0d91fc229d0729f386a6b5f50c7b4bf5b13aab170e341810265a459efa11f35d58031834f982ed65c3b5b7468b43d3072e35f97fd2295e55067ba60512c2dad
SSDEEP 12:TLWuEmO9zmzrfRmBEyPbBvOwhk/0RT/VM/QCo:TLROpmzr0GSNh/RT/ae
TLSH
T19D72558EEB20E307E17B4736E8DAE3D23D74326A0337CA077A910B5C5D8224565A1F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/pl.rs.sip.softphone.newapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 94621c89d90f0bf34b957b259c513ee6877efbb53abd564c1ceac935832ba493
MD5 b83f77ae13cb2e59ceae4bd538380700
SHA1 38365c85c64be003aaf78b8a6e4245a16b585783
SHA512 909fde169475c86a69e57ab772deb3f92700bd0875cb714eb7317f0d144ac3cc94796c647dd9c01d281510b48173e28705990849dd830c15eb6bab1f128d758f
SSDEEP 12:TLiEq9zmzrfRmBEyPbP/3p/0RT/VM/QCo:TL4pmzr0GSP/3SRT/ae
TLSH
T1887255CEBA209703E277433AA4CAD3D23C24326A0373C9473E510A2C5E82645A1A1F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/pl.rs.sip.softphone.newapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 be6969b6491a1506d5d5764636f460aeb9209661c17f4a39e093405d16ad317e
MD5 46295d54f1da220a99546de01c3bf124
SHA1 5b8ab5ce13f90c50ad50f4bcd6c5e6fe5875d0be
SHA512 b658670e839e9f814af448cee59d564e1469d5116f79f805eced38ba1be1f3115fb1148e7dbd99cda76bd7259830ebb6c83ac3cb5ffec60d786f6f9d8982f0a4
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hZt1kn+/0Fl6HP4p/0RT/VM/QCo:TLopmzr0GSP/hZtunlFjSRT/ae
TLSH
T1A972599EBB10D707E27B4732A4CBD3E22C3432654727CA163E511B1C5D822815152F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/pl.rs.sip.softphone.newapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 94a98b3a20c8b40bca6320240fec2eb519133ab1accd16388e380a4a16b6f384
MD5 3ecf789c84be3b68aff6f1f33636deec
SHA1 68202a698b9943b004d312eccd1df6c6cf7bcb63
SHA512 1016780ab2001cacc136aa75136d36ccb91728b6aa1e4bc6f741eecf623c0c7cd152ffc21b07c497aa9f7049708757fe2c59381bc4f371847f1f8ab7d7074ca3
SSDEEP 12:TLIEU9zmzrfRmBEyPbP/QH49blqYFlsv8+n+/0Fl6HP4p/0RT/VM/QCo:TLYpmzr0GSP/s499FqrnlFjSRT/ae
TLSH
T1C97278EAB624DB07F63B4735A0CBE3E23C3432620723C6167D121B1C1D823829262F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/pl.rs.sip.softphone.newapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 22c7caecb0b1df7fc7f96aae9851f1bfb30fe8d14563c618d926950f0fd3fd17
MD5 5dfc91a4efab8d609e792d6e8224bec0
SHA1 8cc09b6f7ee4a38fd52fb79b8ff5eb3bb8ce505b
SHA512 0d1b7f0eac4bc615f8d662431a70e057495b3d18d12f4a24236750856120936772eb5b266af9a790f347a577440a8d528a8d199a59ec04b28984f20741765b05
SSDEEP 24:TL6vpmzr0GSP/oOl5hKamNZ2u6X499FqrnlFjSRT/ae:T2vArSP/o0camNou6I5qrnjiX
TLSH
T1167226AAB668DA53F67B4B3991D7D2D2393931A60727C6167D021B1C1D823829161F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download