Analysis

  • max time kernel
    126s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    08/08/2026, 03:47

General

  • Target
    86708ba639c7795a7c263ab11fa59ac24a2510cff1b03b648824c13d65994774.apk
  • Size 209.0MB
  • Sample260808-eb878azbqe
  • SHA256 86708ba639c7795a7c263ab11fa59ac24a2510cff1b03b648824c13d65994774
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.pt.bark
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4679

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        environment.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/environment.json
        • Size 12B
        • SHA256 80be2eb0944c0453a6ad339a56e1c8f39f8cc57a4e627758246ccfd274176fd8
        • MD5 SHA1 SHA512

        release.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/release.json
        • Size 24B
        • SHA256 06baa5c76d16efce43352feb8fc3384036971802240b158a77988ea4535aca06
        • MD5 SHA1 SHA512

        sdk-version.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/sdk-version.json
        • Size 591B
        • SHA256 d77dfab06d0ff15358895f39832d867731f97ea3bab797784422cb6ff8deaf97
        • MD5 SHA1 SHA512 TLSH

        tags.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/tags.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512

        breadcrumbs.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json
        • Size 4KB
        • SHA256 6fa0f9d32176757ce92f73c24f14b1e719a153708e004551a2c0969437a0c58f
        • MD5 SHA1 SHA512 TLSH

        breadcrumbs.json.tmp

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json.tmp
        • Size 12B
        • SHA256 ae1afdb53fc94d62b6862659f839a20634382b65a7354f32b5e81cd29fb4270d
        • MD5 SHA1 SHA512

        contexts.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/contexts.json
        • Size 63B
        • SHA256 dda403ea3f2dc79793e354552c63edfb2be6a7676df6d0ecdd02a12055fcdad8
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 182B
        • SHA256 93616507cce03bac624b75e599a8dcd3ece2c8b438f65feac2f399a38396a7dd
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 188B
        • SHA256 e26ebbe35a22425c4a895177bdc460636e2182474e2564d2f93ef66d0f8b0cdc
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 2a1c8adc468c934fed61b13629d8baf30692bf3ccd5fac9b3d75196c357a91f9
        • MD5 SHA1 SHA512 TLSH

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 18B
        • SHA256 96f7a5db03a7c5ec7847b1ca053fa92d19552fe07cf22a21a004e4aabed4a95c
        • MD5 SHA1 SHA512

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 16B
        • SHA256 96c4b7db81f09c9990c9e856e2d350b49f8ca5e0657620be9a6632cc3d7aaf1c
        • MD5 SHA1 SHA512

        installation_id

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.sentry-native/installation_id
        • Size 70B
        • SHA256 26e065cc9469dd61e5107564e99c8b2a2311bd5c39ea16a5b3ea83cea52ff4f8
        • MD5 SHA1 SHA512 TLSH

        35e4680e072b4c259b3323ec3fbccf76.envelope

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/35e4680e072b4c259b3323ec3fbccf76.envelope
        • Size 935B
        • SHA256 3e2693d3d2d2c92715c8538b5d8d1b85f85a87799f29d2672d2a09c520c47333
        • MD5 SHA1 SHA512 TLSH

        session.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/session.json
        • Size 268B
        • SHA256 1243928043e3357f7e75ba9cd1842356ccd788c0ef1afe02b28a97690cc93457
        • MD5 SHA1 SHA512 TLSH

        OneSignal.db

        • Path /data/data/com.pt.bark/databases/OneSignal.db
        • Size 52KB
        • SHA256 491c9687657ca71661a5cf42a763249f88fa222edaef20eaf552c4599458f99e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 b7b2193b68a38c45da1b265325e6878d26f81b04b93f38ccc623bcf44b6d2922
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 3b20071ea73696a2c021715ffab82aa0dc8405006daad5b42ada816d11a159cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 6a65897dc1f39907ab3dabf20b61b75b251ea0f606bb831f9d1f9b70cd3277dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 4f5e5c4769c5beca0c7b6cff2686abd72e8301bb6ddd6443a4d661b1efe548b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 6f3a536a1b8e15ba72dbb8841477ee0bf35fae90aae99071556508347407b079
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 e647b43e7187bad5e0f8aa86e22aa5dbdab8d4f73d1ca3443cd3af8895418f07
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 492ba1e3e7f7ec5ef768628984b2650a64ef8554c28d9314e6414d5116b2959a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INSTALLATION

        • Path /data/data/com.pt.bark/files/INSTALLATION
        • Size 32B
        • SHA256 312985c09686c22d3fc4e30232bfcb1a6b2413b1797d6eb90d6b7d166a509177
        • MD5 SHA1 SHA512

        PersistedInstallation2369187672052476623tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation2369187672052476623tmp
        • Size 90B
        • SHA256 f2989729db472568c6603d40a7407806f9ff9c408138f2b18f16bb45218865cf
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation3335765903447632263tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation3335765903447632263tmp
        • Size 568B
        • SHA256 dd716571eed5c870c8a4a675de51a770c1b89c3347c82445e9b21562f0e908b0
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation6441838733331764752tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation6441838733331764752tmp
        • Size 90B
        • SHA256 6a2c6a3b185d422bf2dfcfd0b867f6d49904c30808884cdd5de97df550f5a552
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8384562087509946165tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation8384562087509946165tmp
        • Size 569B
        • SHA256 09401c29cb6b3acac40b4d4a2d66fde9ccf742af1252dc574b10cde2760ca28f
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.pt.bark/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 9da9a0e8278a2d66161dcde0b256c4c6cb8db0b8221e0ea47d9cb2f0c6a5344a
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb
        • Size 100KB
        • SHA256 f55b5a3627bef081c8e652d80b933f46c2723db747936727df5a908b2c563ae5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 fde7cf7468c26dec9fc8309b62ce3cfa495e3bb7e4cc47085e7f3e490b2b7570
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 6ac4987e482abcf5aee7a04392a2065152d0cc3ad9a130c34084ee567d7e7ca7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 3b9e84abc2374cc19e3571749d8d0e7c860bd4a0694b1cae91037d5480496954
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 410KB
        • SHA256 86104eee84a56de77771ee048f01d68987a96f1508cd1a9af65b15ebc3fbf691
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 1KB
        • SHA256 2dfb52c687862dd9939a07fae37f61fff3e733b3c934cffeb7f286b2c38b16b7
        • MD5 SHA1 SHA512 TLSH