Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    08/08/2026, 03:36

General

  • Target
    6194aa250a7ec0c9e956c5a661ff9a3fe7db7135177a130fe97e0e3c8421115e.apk
  • Size 17.0MB
  • Sample260808-d5wcsabe55
  • SHA256 6194aa250a7ec0c9e956c5a661ff9a3fe7db7135177a130fe97e0e3c8421115e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.alienmanfc6.wheresmyandroid
    1⤵
    • Acquires the wake lock
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4891

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 c779c47ba61c91fc56474949e7b64b69653553984a646a17e12c0948ff0dcf7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 ab92da989635f110a00e7ecf0c792900b6408eca2cc61e9391c24cc3a7541dcc
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 7c26f63a64e854d065e380cb287b284b54116b5c19b1a176f87b6b0069ff6a20
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 c574c1afdb5901b357e3af00a39c2dbbd503d0690f952ad9baa683cb018e5d38
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db
        • Size 28KB
        • SHA256 a26db39c9e170c1511e600b0bcfec29c92daef826de0dd3cbdf31b4b8a7c7f71
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 512B
        • SHA256 e0599f085c9f081d906b1cc5bc4606f3675e5fdd605cf3f7530c73af6319e956
        • MD5 SHA1 SHA512

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 ee44e6d48bee954c5e1c737c514f0d313d07bc3d610df520af66bb8443ba0348
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 4KB
        • SHA256 0e80b5e8f80b9907fe740b7da63d8a44fa8b6ca7b1fef97b7c7e3aaf277b3ff1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 31a0ee48a0e72b7a80c80dc4e986df6b83bdfe6f6d3622689486b6fb0b53ded1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 16014252cf7a2beeab19bdaeaa60ef458715b3956cc10979136e584946f34dd6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 12KB
        • SHA256 2e9d6134feeba6b2c9bb056a94a52170d0006ec31146392a34841f8040fe7fcd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 4aa23f4ae6a73c5547db71445dc2929a0a022034067eccfab3cd90c2c8d0f523
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 1679182b5e596c2f3c860ad37684b8367f4bf914198c1da2de037ea294451211
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 a5b31553bebcb8bc56f2ba8c7a179271c8bd7b81c104ad6bfcc436ee113ae492
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 67d34f51a2f629fea2e2bb13108094d0c0d31a35a363d04a84498c754106b6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 b0b63a87432b7a3e63f22203c036adb36c4801f6de19638226107cc4bc94c68d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 9adef21255bc4e52ab14a64ca5e57a9f3da4cbaf7fe1859b797b5b08a71fa338
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 cb8ca12b58f213a283b04fcbbdd4567c9309db88083346c7572331131b648d26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 45f0feace98e678ffece0d04d693508e2192c355434769f706b6d953bb6c19eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 f934ae99991cccfc0edffaa9c1ae580109b7a6eac00c321466962e2f26cf3d90
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 4dc36f75176ac84416d5f7a9a2516f00bbaaf0199d9e1d0cb949e1e7923206d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 898d9cd310fae39ed3fa8af7dc9fc8402652a62913d0747795c034de4fbef4c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wheres_my_droid

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid
        • Size 4KB
        • SHA256 93a4b40c4472ace9dfd44a0401c67a01af2f813800ea6df933479a97e047094b
        • MD5 SHA1 SHA512 TLSH

        wheres_my_droid-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-journal
        • Size 512B
        • SHA256 c5058a421d79fc42aee27c096654d3eba237365d8591b2c95495b8a77daae6c8
        • MD5 SHA1 SHA512

        wheres_my_droid-shm

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        wheres_my_droid-wal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-wal
        • Size 321KB
        • SHA256 c8b59e2f1bfae5787932b5c03bb3043988a3f105c4f3052774bc197e748c3a96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation323588812991692078tmp

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/PersistedInstallation323588812991692078tmp
        • Size 90B
        • SHA256 79359e4f4e8698016c5c6e09b1ba8d4c3425243dc566122c12d658cf8c0c47a9
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation6252222890399848102tmp

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/PersistedInstallation6252222890399848102tmp
        • Size 562B
        • SHA256 65bc766478307534bb9f96d7679daf2d9cecc78addc993cf16ea17b9446e61fc
        • MD5 SHA1 SHA512 TLSH

        coverage

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/coverage
        • Size 65B
        • SHA256 5a9e6d035a64fa01cff2bd7411780918db0aaf4b63d6e47bff973e83086d654e
        • MD5 SHA1 SHA512 TLSH

        coverage

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/coverage
        • Size 54B
        • SHA256 b2c3de313ddbe97841fa2256287f0b03a7b86ceffe6056c4402eb6a114efe24b
        • MD5 SHA1 SHA512 TLSH

        gaClientId

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaClientId
        • Size 36B
        • SHA256 53358c4891ee3ec9d8a93bb6caa3d44bcca3073c41e036704566032420662336
        • MD5 SHA1 SHA512

        gaClientIdData

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaClientIdData
        • Size 32B
        • SHA256 49ef79cfa68cc5ebb338a87808993e1a423845a0ec66e1b0fb219a7ba25cea7e
        • MD5 SHA1 SHA512

        gaid

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaid
        • Size 85B
        • SHA256 4da8790eae77fb6aa1060cb0f41e336cfeba3591eb33b6b261fc4b338119fc93
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 d3f49758fc60751bc8c6636d60884a00a67024c83601f866fa3109de138abb28
        • MD5 SHA1 SHA512

        regulation_consent

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/regulation_consent
        • Size 1KB
        • SHA256 bd5eb308eb704ea2f1f94d2334ef331863e81bb8cd55ba11a21973118699b6ef
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 113B
        • SHA256 f91c4758326194d12adaa31e40111eed67827c442d7118e37aa5e6e828946c02
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 98B
        • SHA256 94363d4079068c5b103f3d7fd19942f69d783974e7b97c50feffd75aa8621c9f
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 161B
        • SHA256 54dc7360e4f3c0045ce8ab87e75120b1015dbc38611437bd0c11b4f3971bcc16
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 160B
        • SHA256 75285ea6e5a478c9f496911781f9b443a88c468ff26e75cea50fcf42f31c98e3
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 602B
        • SHA256 de1ef3bf255414323689a019375f9c4c04b8c1c523bbfec739630cb600d88f08
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 602B
        • SHA256 94dee8c991212dc903a43f1364af25a0d875e7c0c3df67bffab053870b57c00f
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 695B
        • SHA256 c32863cd1469d1df90f2379cbf72d230cb08ecbe7f7bc97d551559719369b224
        • MD5 SHA1 SHA512 TLSH

        should_attach_if_allowed

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/should_attach_if_allowed
        • Size 31B
        • SHA256 53ade896a4b756ca5058942117acbe4b3d069c77c64b75662da74d2fcc558e3c
        • MD5 SHA1 SHA512

        primary.prof

        • Path /data/misc/profiles/cur/0/com.alienmanfc6.wheresmyandroid/primary.prof
        • Size 2KB
        • SHA256 4fdb914bbb522d296fcb021cb703ab975e3d3eb44a016b9c1a17696a9e1d563e
        • MD5 SHA1 SHA512 TLSH