Analysis

  • max time kernel
    12s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    08/08/2026, 03:44

General

  • Target
    4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9.apk
  • Size 16.6MB
  • Sample260808-earlsazbpg
  • SHA256 4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
  • Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
  • Reads the content of the calendar entry data. 1 TTPs 1 IoCs
  • Reads the content of the call log. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.liupait.tracero
    1⤵
    • Reads the contacts stored on the device.
    • Reads the content of photos stored on the user's device.
    • Reads the content of the calendar entry data.
    • Reads the content of the call log.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4909

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events
        • Size 40KB
        • SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 024b7f1190251a55a007672ee6d51b5476888f65e80233f8826171651683ef6c
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 6e6cd18ee7c6c935527c75b8517ac72d3425040ff58533dbf666a0fd17962e40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 f585f12469e924b66ad835cceb0a8c85d1a656a685b2771dcfe106d9d493280a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 612ccf9329fc26668b1ffe1cb2c54843e525970d965f01e72695f63b5be81edb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 0f9ac4227e502a7a4c5440e662d6f77f97d3bb3d1b48746bde98efcb4eeee564
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 16KB
        • SHA256 e98c8d4c46fb83e45547168ce3ef8352ea137f515d0d68f072c32ed7341ae917
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 fe7229cfebc4e94b8b8451ddfcb27470a2a72d7061aeb1d030db61493904effb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 0dff30711a2dea524b67a89e46ee775dc657ad8b1301bac54821ad816fbc3456
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 512B
        • SHA256 cc6eb773f638fe497901ed4f2ef6410a06f77c953e6b72ec270f0ecaedeb7389
        • MD5 SHA1 SHA512

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 8KB
        • SHA256 62548aa852a4c573eba0ed611151ea09b7b2be142605b34dd8494b36f3bf631a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 8KB
        • SHA256 21147b674830809349fa85ccfa476b18bc54d4e4a2bb871df0437e5ef3b6d4f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 20KB
        • SHA256 99825a974fbb91a6b2dfce14ad5decd96f0c86d8ed8bd3e36d0d82248e2d91e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 20KB
        • SHA256 60176b24af2dcd1ada157f7088df0865817c014612e0c09b885a881cffe17d82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 20KB
        • SHA256 4bb671b8445a21d818050dc207623157a76e0ba00461f080437274ba2e725886
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation2211109980489600601tmp

        • Path /data/data/com.liupait.tracero/files/PersistedInstallation2211109980489600601tmp
        • Size 90B
        • SHA256 d1654c78346244a022851d9897ee4bd8d084034f866ab32c674e55135d340971
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation5769101850858296320tmp

        • Path /data/data/com.liupait.tracero/files/PersistedInstallation5769101850858296320tmp
        • Size 569B
        • SHA256 114dd9713143206e9c80ab7e0139bfa57296ce1406e98fb9f67ffe7934347370
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 ea0d83c42c82caab7de6e31b83b00bb498230df47a964640e6cce107435d4537
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 4a0acd18c7e05ea56df04d346edeb54359c9332f7c4aafe67229ae8c1ed32b06
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
        • Size 173KB
        • SHA256 1af407a085a0c59030cea7a312915f5f102feee1789df7276aae1d63ad8ec30e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 34eefa3a6dd1a630de55f353833e69a6dbb574ebff4011a820946ffe7b704acb
        • MD5 SHA1 SHA512 SSDEEP TLSH