Analysis
- max time kernel
12s - max time network
151s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
08/08/2026, 03:44
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9.apk
Resource
android-x64-arm64-20260325-en
9 signatures
150 seconds
General
- Target 4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9.apk
- Size 16.6MB
- Sample260808-earlsazbpg
- SHA256 4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9
- MD5 0ef3e53ce3d70fffb46045a6616eef2a
- SHA1 44cb71b1c453585a07dcca99d99e7bfda0d2b6cc
- SHA512 ef42c9a79255fbe653f9b6ff0ede5b6d575c9a67ddfeed922cafdf784a5d7e0a4b70f25233acfc6a93ba3cc729dcee18b059dc80bf566ab993aa2dcf00516e07
- SSDEEP 393216:YvZ7YwPwVJAVTFXu9e91NVhJcn7NQr4yVRyVmDmWje80vksqu9mms:kFhPYLe91Ne7NQci7KWCXs
- TLSH T103072311E7A97A87E831903A4656FB3075866C686B02D682791C33FC3B737F04B6A3D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/data/phones com.liupait.tracero - Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://media/external/images/media com.liupait.tracero - Reads the content of the calendar entry data. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.calendar/events com.liupait.tracero - Reads the content of the call log. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://call_log/calls com.liupait.tracero - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.liupait.tracero - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.liupait.tracero - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.liupait.tracero - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.liupait.tracero
Processes
-
com.liupait.tracero1⤵
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4909
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events
- Size 40KB
- SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
- MD5 1cf3f63c021d755a21623e6d0e86dbc6
- SHA1 e40e0f1faa61abcca7ba3394c54c92ff7334b49b
- SHA512 38d72e14f3513ffd26989cbda3df46ed3dd6e731bdfae56440eff6b64760cc13f91014281c9add61e018fe3529e49c63a6892ca22479515816c768b546244466
- SSDEEP 48:TfkL3u59MENZBdUdndVd/7T9IvdldHlq8/JqYpqPS:zkL3KMEX0xIyNYMa
- TLSH T1AF03EF5D4A202611C2BE083FD7E257931B3CE35F6B2387612E904CF6DDC68B6B821998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
- Size 512B
- SHA256 024b7f1190251a55a007672ee6d51b5476888f65e80233f8826171651683ef6c
- MD5 b80b785c264f1b792dd53ba7fe4cbe5c
- SHA1 1238d8ee875bacfa2ef657c01048243d18b5b489
- SHA512 47339e431cd5606156655b5d1e89206bfc6ab8b9ff4d5b10c3b6e44e12952cb9aa4f2c8426a59ff78cf078b9d4824456c6c4fc801fd7c0a05915a772d76c7698
- MD5 SHA1 SHA512
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 6e6cd18ee7c6c935527c75b8517ac72d3425040ff58533dbf666a0fd17962e40
- MD5 5318dcb19cbd741324894a551bee91ef
- SHA1 6b74fb7382d48e46ea2c16bd7f600c7eaf7f4b4d
- SHA512 28115187b1923645ff781f0fb87624e0d9e0da732a47b37a369b9b9de82058f0111fba5b4553d9ceb31f3917d96ea21ed77eac4a3dc185dc3a22599c1b628edd
- SSDEEP 6:7+/l9u/SFn1Wng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKIo:7+tJuqLiuWdYRmBEyPbY
- TLSH T1E702228AB3800A12C829667B90D483890E00AB2C8A61CB1B169008942C074FDA4A0D04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 f585f12469e924b66ad835cceb0a8c85d1a656a685b2771dcfe106d9d493280a
- MD5 5ab820658351bdc95e70244c92a93647
- SHA1 9e457944f59b970804d07d35ee05a32a6a231c25
- SHA512 2a4597a0788afe951c6dc0c36acea7a4462d0e6c4ab7aaf5bfd881dd22086e3e65717638ea5e39f9babfdc927815d48e43d99529cb66eea915c0bf7cf81f2339
- SSDEEP 6:7+/l9YOPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKU/mVn:7+tWiqLJdeWRmBEyPbPQn
- TLSH T1BB02128967410913C62A6777A0DD83981E35A7299263CB5B1B9118547C466DCFC90EA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 612ccf9329fc26668b1ffe1cb2c54843e525970d965f01e72695f63b5be81edb
- MD5 dcb73e2250961d6040d265cdb7f566d5
- SHA1 6aab59ce15d7385e75819205e59cee679568f60e
- SHA512 df229839943d3dc6686733f29c06136e9310ecc5889084921bb09e179c1e5d901dd07d66143a859c5c7d75806181ad4010f75283f81bc0d8dd4cc0fc7de845a8
- SSDEEP 24:TLErtAn9uBUZgFjde3QUGSiwDAC/lMJkb5Bv:ToZaye3KSFDF/ln9Bv
- TLSH T133D2DCD9C2EC7303C2604137A026A7A1A9451D4CC1A36B6799C13CA84D93809BEBEE3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 0f9ac4227e502a7a4c5440e662d6f77f97d3bb3d1b48746bde98efcb4eeee564
- MD5 26167c208fd67423f5cdc35491b971bc
- SHA1 aae4bc5e6744eb9877407c68db3e90871c368ec9
- SHA512 eef2dd255e0f8925e244d900b2be508d216ab3619b1bf40c5a7c09e120ead0e3bb0fcfbd1893bcd4b3a2c73fd0dabe25c7225a62da6f91480c41e60e66328474
- SSDEEP 24:TL5tuan9uBUZgFjde3QUGSP/AJDAC/lMJkb5BhR3x:Tuhaye3KSP/KDF/ln9BhR3x
- TLSH T1C6D2CED9D1EEA303C2A51176A125A051A8452D4EC2B35B569EC13CA54E83809B9EFEA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 16KB
- SHA256 e98c8d4c46fb83e45547168ce3ef8352ea137f515d0d68f072c32ed7341ae917
- MD5 ea06e15503a28b8ad7a49335ad483a82
- SHA1 64a2255d497fd17576384121cd8bf0e5c14609cc
- SHA512 2e4c3091b8e157ece84200162aaa1328c49d85aadadd4a1ecaf8a328fbf93d9377759db2e4a8e637df7ba3da046f3b83a22de90e56210848745d0813d37eb907
- SSDEEP 24:TLqtun9uBUZgFjde3QUGSP/eQG5bgjDAC/lMJkb5B:TUaye3KSP/eFb2DF/ln9B
- TLSH T1F172B1D9D1ED6703C2741177B4552151B8052D4DC1A31F9796D23CA54D8380AE9BBA78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 fe7229cfebc4e94b8b8451ddfcb27470a2a72d7061aeb1d030db61493904effb
- MD5 a6195ff237a0c15f829450e3dfa8099b
- SHA1 7eb198f20d7bd199065bd03c0178826620adaea8
- SHA512 1a7099b708b67dff249c148f696c7bac64a233aa46a8224a3c7f356d521c607690a6de545114a8a79520877fe43ddc3b08bfdd205f088770610352cbff174f8a
- SSDEEP 48:TEaye3KSP/hFcqHGZ1R3Fb2DF/ln9BeQAA:g5GP0qHWl2DGU
- TLSH T14ED2D2C894ED6703C6741037F0165542FC0A2D4DC5A31B92D5A22C954D93846BAFBEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 0dff30711a2dea524b67a89e46ee775dc657ad8b1301bac54821ad816fbc3456
- MD5 a93b81e80954c818b094a4470e20f9d7
- SHA1 11a118eca51365d2a44d78e3a82bc96c678a169e
- SHA512 b63539c6dae5a7a9804bce32a19697f7ebe367589e7ab40d0dce374e3f45356cabdcc8100ec4c513cffec89e764285f233e0ba83b1d700dc83f6a24b038957a1
- SSDEEP 48:T0aye3KSP/e1x3LSZ/m/ln9tuqHGZ1R3Fb2DF/ln9BL:Q5GPix2Z1qHWl2DD
- TLSH T12DD284DC94F99703D7B4203BB0576902F8053D49C5A30F56E5A32CA94D53C46FAB79B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 512B
- SHA256 cc6eb773f638fe497901ed4f2ef6410a06f77c953e6b72ec270f0ecaedeb7389
- MD5 45513d929ce026850bc98b1ab642b862
- SHA1 2efb2499d530e58b40f31cff0bfd47d3a11890b4
- SHA512 b261e3f2b2893f87626e13057bdbc0b4dfd089904f39328a6a72c7d1238f352a5c0c4eb02ae9d83ee35a5bdecffc4aff11c7c6071f8d2358082cfc3771317318
- MD5 SHA1 SHA512
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 8KB
- SHA256 62548aa852a4c573eba0ed611151ea09b7b2be142605b34dd8494b36f3bf631a
- MD5 2bca1de82fceb9b499e95e9de05db3ac
- SHA1 bcafd4b8dd21a70185e84785d5388f1eb7eced10
- SHA512 bf6c86fa859c85fd99f57c3135fec4ae4456a6542be08935f1cb801fb60b1469a832b3a69cac9243716a7b76049a2f3e3a3f2e4c5aaf63d07834684d281f5b0b
- SSDEEP 6:7+/l9ORGn1kvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK0s:7+tExvqLiuWdYRmBEyPb6
- TLSH T1A10222A863841822C82D96B790D483480D00B7A88A71CB1716D008942C075CCE4B1D24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 8KB
- SHA256 21147b674830809349fa85ccfa476b18bc54d4e4a2bb871df0437e5ef3b6d4f8
- MD5 639795783a69c83c1b372055200ea08f
- SHA1 6e9205f5dd49809c5e7e8f8114dea2d581e100e8
- SHA512 b6e1dcac9f34a78989bf1b10618fc4c497afeb29fa117c8b43e1e7395a5d27e9c26317e0bfbdf02d0e83e29756bef4c6e049e42d94e1a54824177fa1ccf34545
- SSDEEP 6:7+/l95Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKJU/y:7+tPqLJdeWRmBEyPbxy
- TLSH T18D02228A63800803C02E577BB1D883401E14A729E323CB4B169208D82D07BCCA890D40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 20KB
- SHA256 99825a974fbb91a6b2dfce14ad5decd96f0c86d8ed8bd3e36d0d82248e2d91e5
- MD5 dd9175eaff436bc8939c85f43bed3e86
- SHA1 f8a31db132f6d74f7053fc514afc2f4c033a3555
- SHA512 0cac900fb060bcf943273728f7f86038f3e97afdd90484f4ab0f4628efd1259bbb82eca36ff7335eb14dbafc851d02129e38104c964d4557bc4fbf3a391d39c3
- SSDEEP 12:7+thYytlRqLftvRnCM5fu0QHSk2F+DugFjJAOsEexOGQGTuRmBEyPbfS:7+thvqLftJn9uBUZgFjde3QUGSfS
- TLSH T104924ED5C95D2720C0055271845552508D350ECDC1E367F70ED938985D8361AEABEE7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 20KB
- SHA256 60176b24af2dcd1ada157f7088df0865817c014612e0c09b885a881cffe17d82
- MD5 0e1aaed2af17f7f4d341289ea4fd1ce6
- SHA1 3b9dff80c9373f5deb59b7fce7657031009ffdc3
- SHA512 9d52e986b380fb70b6abd1ed4e0eeb5cbb04dfa4e968cfb192790cbbdf310ce6a99f660f36ca73031eb3640473b7ae044d2485d3f0b9a5f9449a0cdc53488040
- SSDEEP 24:7+tUAbDAC/lMJkb5jWWqLErtAn9uBUZgFjde3QUGSm:7MLbDF/ln9SWqoZaye3KSm
- TLSH T101921CDCC2EC7303C264813BE02256A1B8412D4CC1A36B6359D13CA98D83C09AABFA3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 20KB
- SHA256 4bb671b8445a21d818050dc207623157a76e0ba00461f080437274ba2e725886
- MD5 611f249e38b4cf762033f2618bd6f147
- SHA1 89b4e30d34180b02b9fa26c7ab4338137609a68d
- SHA512 a28e125f154edc032ca2bfd0a07ae2f69124d09158ac44ec1081a7c74b50a20463d8e785d847f1a2955af770ddb2aabce47599b8eaa7d6fcb6b7da7d0db2bffb
- SSDEEP 48:7M/rFzFcqHGZ1R3Fb2DF/ln9WqEaye3KSq:7qRqqHWl2D8N5Gq
- TLSH T1589212CC98ED6703C6741077F1221442F81A2D4CC9A30B9295A32C954D93846BAFBEF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/files/PersistedInstallation2211109980489600601tmp
- Size 90B
- SHA256 d1654c78346244a022851d9897ee4bd8d084034f866ab32c674e55135d340971
- MD5 0da7f9772901872e52afe583f78a0e41
- SHA1 ad5881d054facfc44bb262a759b165068eb06d4b
- SHA512 3b59637dcff9d42017e9b932cacd13f736b19224a71367710014834cd49c471e31c3751ebd136979d576c38f22d4f5c7ee1f8cc6076b2ddf08910581ae1578d0
- TLSH T150B01201CA31816AC8D5F2065D4D91406D501480584ECA580B0DA07050CA2F18647DA8
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.liupait.tracero/files/PersistedInstallation5769101850858296320tmp
- Size 569B
- SHA256 114dd9713143206e9c80ab7e0139bfa57296ce1406e98fb9f67ffe7934347370
- MD5 a2c1d1ccfce3811d94b7c379d22f61c2
- SHA1 937cc4bbd6e43772c5058e36b328d303edbdfa84
- SHA512 01e27114db361b22f736b12606f739cfdfcef1271f3e3fe7aa714b1cfa023af2d9103f557d549d8f19da040f8e7908423113a8a2c13c79d1117ccc92aa387cfb
- TLSH T1D6F0E14A196186EDD58631222BCDAC409D59041919D91AF4BE2F5030DA6C9BA9117414
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
- MD5 7e858c4054eb00fcddc653a04e5cd1c6
- SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
- SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
- TLSH T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 ea0d83c42c82caab7de6e31b83b00bb498230df47a964640e6cce107435d4537
- MD5 1fc715a8ed68acd35e9b353bef7682cd
- SHA1 ac9b862e25f0385826d5423045fe438c7801289b
- SHA512 6442ac7bb636f52a5a7731cb04f66cccfed28c5de65d606f93b5d877974ba00ce5850142b0a63a4d3f9f3f72dd1b594e575eafc55d655004a0d727f7168d24c2
- MD5 SHA1 SHA512
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
- Size 108KB
- SHA256 4a0acd18c7e05ea56df04d346edeb54359c9332f7c4aafe67229ae8c1ed32b06
- MD5 df4888a2dc281ac6b02723b32fae7a29
- SHA1 8cf92224d989ed7fd51328d80829610b6b7a8359
- SHA512 d162ed77f8962a6c02f46ae4c9e1c6d24de2b8e8736dc04557a7f4d0c30efff6ab06473ae6bdb084fdc9b376de855de56296c988f70ec56fde28b7724f6634ae
- SSDEEP 48:oFY66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI9F:u6+hdjnHtDRMpf8UzS6+BD8q0ExPo
- TLSH T1C6B3104E0F092500E09DA4F0A9900FA17D3E512FA793E3E566E10075AED2930DE29DFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
- Size 173KB
- SHA256 1af407a085a0c59030cea7a312915f5f102feee1789df7276aae1d63ad8ec30e
- MD5 e988a81dc1e3077d7bd1a6fddfc737d7
- SHA1 60af1e4b7bfda4e86361ef80d10ef3ee8b74223a
- SHA512 b2e1c47bbfa7efe72b2c3c2a0f051e6695a68172ff79df956dae852d39145b082b84737b91dd2475ff1e4d522d089ed295abf4df27f2cd70a04b166a865d8ab2
- SSDEEP 48:aEgtY6/EQYYQmccQjUQ3Q91QzQRgtYFQxQ9:aEgtY6/Eebx6U88EUgtYFuG
- TLSH T15C044E8A7F51A068F2A809FDAD83CBF22D05E9537D04D18727F1B3721675C29147E218
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 34eefa3a6dd1a630de55f353833e69a6dbb574ebff4011a820946ffe7b704acb
- MD5 397e19ad7f8510a8305ffa062391d20b
- SHA1 a21166413b3adad1dac8ef14d2437a8667664cb4
- SHA512 1efc322276423c2614c7d4bf235f1d9130ccd7a5dc39e70289e69f52276a2d37ad807327e38b2eee8fe173d666dce50b28d48cc55741200fe68e09770a66649f
- SSDEEP 6:KoJoy4TPTB9FZde/kPlOERX4PBX4ogLugMBX4suuK+/ij7mZbymZmH/4Ow2:KyhKvzdeWRmBEyPbP/4SZbyXHgOw2
- TLSH T19472C2A89F8005A2F16D1276ACC5C3453DB0B61EB612CB4B17A12816AC12BECB298F0D
- MD5 SHA1 SHA512 SSDEEP TLSH