187b9f5de09d82d2afbad9e139600617685095c26c4304aaf67a440338e0a9b6

Analysis

max time kernel
18s
max time network
17s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
08/08/2026, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4c7d493dafb443a9e03a0f7634ba2a2_SharkBot_187b9f5de09d.apk
Size 13.6MB
Sample260808-v7tems1gre
SHA256 187b9f5de09d82d2afbad9e139600617685095c26c4304aaf67a440338e0a9b6
MD5 33b9fc2e5c1972186c9c552d4720f321
SHA1 9c306e6c6d8bcbef3ae77d9f0dabba68f0411d8e
SHA512 4dcc98df8a690d23900f49b32720608380340f041e715176452b1d1c78258cae3e0dbe39de94da8c88bab3a5498bfd7b5cba4b274d581cd311bff21f7e7e23e5
SSDEEP 393216:hfnH5macX7X52NWdXJq2TNhyWfwcVpMrfum7u:pZqgY5Uvaqu
TLSH
T1B6E6228BFB98C51BD8771632C917453372A31E082492ABBA2315F32819B7D425F56FCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker defense_evasion discovery execution impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.pagnotto28.sellsourcecode.alpha

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.pagnotto28.sellsourcecode.alpha

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.pagnotto28.sellsourcecode.alpha

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.pagnotto28.sellsourcecode.alpha
Framework service call	android.app.job.IJobScheduler.schedule	com.pagnotto28.sellsourcecode.alpha:BackgroundService

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pagnotto28.sellsourcecode.alpha

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pagnotto28.sellsourcecode.alpha

com.pagnotto28.sellsourcecode.alpha
1⤵
- Checks the application is allowed to request package installs through the package installer
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5079

com.pagnotto28.sellsourcecode.alpha:BackgroundService
1⤵
- Schedules tasks to execute at a specified time
PID:5193

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

dbytes.db

Path /data/data/com.pagnotto28.sellsourcecode.alpha/databases/dbytes.db
Size 20KB
SHA256 9e761455795a869d11b49007eb34906012745e08aec3b520951bf57d06258d14
MD5 db7b0648990b45f2a526912b7e57ebbd
SHA1 cc95fbf5d60978c759c58d1f90bb8d5f0449d0dc
SHA512 7fecfa0b0a97a710c238dabeca6aaa12175761355e6def5fd8411adf9f2c488f993995f545439640f167c9b868a3a28be03809d6d78197cf5e06ca2f5288474f
SSDEEP 12:TLyKEVwTUDz/RmBEyPbAVOwrkJx3VhU7Qx39:TLy9VmUDwGSEsx3IUx39
TLSH
T1559205D3770D3107D33676B2C4425750AFE06364037A835775D321D43C416456851E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytes.db-journal

Path /data/data/com.pagnotto28.sellsourcecode.alpha/databases/dbytes.db-journal
Size 12KB
SHA256 e8841123ee74ccbe2182fef068fabfa25e138c6487381b48b5dd4564b0f55b07
MD5 5e8a51844c447db6e5a590907f9f17ac
SHA1 a73c72ffdcdfaa88f95f6483e9ccfebf843f607a
SHA512 24c8929db99c60652faba67b1927f25da9d44877d6adab02dfd71f30ad85b5ffcdd1d55cde75427f23982c12efd49ef7ee3666d3cebd895c793f45d73cba7266
SSDEEP 6:7+/l+8wEZpg9bNFlq4yl1Wl09d3RRztLu6fNZ74LoDp7t8ERX4PBX4ogLugMBX4R:7+t+8fqLm3wTUDz/RmBEyPbPE
TLSH
T1E3422046AF012633D139D2B5C8920760ACFC735D4165C7EF26A52858BD8269850FBE60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytes.db-journal

Path /data/data/com.pagnotto28.sellsourcecode.alpha/databases/dbytes.db-journal
Size 512B
SHA256 b5f7925c034e12751a78d8e1f727da3e3402b3be5f96b1e794dbcc05a5394476
MD5 ea9bb0e48a903d63c5faebfe78cd6e0a
SHA1 28c9877a5a2941b2aa503de191f7775f12d7172c
SHA512 1640a296c1483f07f304a75d5c18aacd5b4ec0dfd067d59ad46730fa8d8df59b058d97eb4a030db582a13f30a3f49fade05905819cb5304e65d574e5efbf2310
MD5 SHA1 SHA512

Submit Download

dbytes.db-journal

Path /data/data/com.pagnotto28.sellsourcecode.alpha/databases/dbytes.db-journal
Size 8KB
SHA256 1e03c1afe55fea9e269c209bfb578d69dd5976159791ab7c9e39e3b847524971
MD5 247661eb4809d54a904715a40047c209
SHA1 8c38699bcc0859af615533f31c8d869691db7923
SHA512 750d78288315c3af777c7eb5bf4318920a1375dd5c217eec9fde0958abbc9985826aa317bba247f79d253aef893d94ec136d5d1b0cfeacb0e29b8c487faa77f4
SSDEEP 6:7+/l9cn3n1OUg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKun:7+tgbqLiuWdwRmBEyPbZn
TLSH
T1340222AD63C10822C82916B7A8D483480D40E79A82A1CB8769600CA83D034CCA4A1F24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytes.db-journal

Path /data/data/com.pagnotto28.sellsourcecode.alpha/databases/dbytes.db-journal
Size 8KB
SHA256 3d4740aac65516d6c6b607c74df708af8e6ee96415e8de096fb2945de8d116cf
MD5 af249f25c3806226350fa0278966109d
SHA1 800fcb778a95bc94bd1c1a6bbaa409f6afb48368
SHA512 c443e07c09b3e534fc87514d604198221ce66c7441ceaf856a2687c7fcab5a0387e30604f3463b5d00691a64205206d0f0756a91ba78d3cc4c14d079d789a3ef
SSDEEP 6:7+/l9NOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKcC/ucn:7+t7iqLJdTRmBEyPbLSln
TLSH
T1A302228967400813C25A2FB790E883403E52AB9482E3CB17196008983C036CCA8F0D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.pagnotto28.sellsourcecode.alpha/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.pagnotto28.sellsourcecode.alpha/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 43b57087deee4be5b47db08094f2f558734efaf81d0cb803374d1bdbeeb9a825
MD5 0767f835d7c2a1b2e9905caf6027cb0e
SHA1 346dce43724976f59782f817267c59e19fb5eac3
SHA512 3e563df89c3e9d8dfd689c24b96b6a5746c3ea1201740fd8c56acb8a3df8f2ecdb2089da113b3fd8782b8f952ed01b7ef7db9124fc2a37061e50abe2afecb2cc
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.pagnotto28.sellsourcecode.alpha/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.pagnotto28.sellsourcecode.alpha/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 ad0395e3e79165e15e89119dcc871c5eb5269cf73dfa698d314b8b0f3972dfd6
MD5 86b209b6bd117e8251af98a1fe62a567
SHA1 6e89c934d9983a8e9d1f7735db160219a4f2d721
SHA512 871508fcc0299778435445e7f670b9b3458506229f391e3bb5edcf169104569829fa0d0d787e50c5baeda2396616b25217f0b6ce67809dfdde3fdff93b59dfe7
SSDEEP 6:KSQh6+oV29FZdrlOERX4PBX4ogLugMBX4suuK+/Llldjz/ZBDuOw2:KmPwzdTRmBEyPbP/BnryOw2
TLSH
T11C722B74E3820D53C70853B344E8C3010DA35A085353CB0B79F8ED6D7C02BCCA459E0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.pagnotto28.sellsourcecode.alpha/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 a92450ee5ee0f2a18bedcc63a2b67253edeb7051e01d6a79f9e55ba18909b538
MD5 b1cad504e2e35e299bed1a58140f8dff
SHA1 f9e0e59661a4d1882f43ff89cc099eab8167bb74
SHA512 f7069d5d73f3709b0d945ba40c214727124b2b79315fd4ec7bb6291e28b7e1b3be7d162561295980f89642d1d23ef2261df3de0ac0c93977c2b2b880726a4ad2
SSDEEP 96:FrkZ6+hdjnHtDRMpf8UzS5+TD8q0ExPzSr3Hd:FYVdjnHt9Mpf8UzS5+TD8q0E5E
TLSH
T132B3014E0F0A2541C59954F095A00FA17D3F412ED393E3E679A1807ABEC2920DE2DCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads