2492eac3fc15d882769edb91c76472887303f5e4bfc9248355f0bd31e7f958f0

Resubmissions

10/08/2026, 12:25

260810-plxmaaydkf7

10/08/2026, 01:08

260810-bhfbyaycpe7

Analysis

max time kernel
31s
max time network
133s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
10/08/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Totoro.apk
Size 18.0MB
Sample260810-plxmaaydkf
SHA256 2492eac3fc15d882769edb91c76472887303f5e4bfc9248355f0bd31e7f958f0
MD5 25ae26cbb326effceecb984cc084f37b
SHA1 e931df4a2ce35720b5b1a4a82c4dd0169b5959f0
SHA512 fd6e47a72e968562a23747f7110608e0a6ea118e5dbfde968729f62d84baffe69571fe375acbc5d9f1b9751337992cc894eab3bc7a64ad6a80e1bd9be9c89da3
SSDEEP 393216:ybKlML2mcXRMPNojyBc1WgtL49koljPRdcIdcE+itqIbZ8Cmw6:ykU2mWMiOBYWgtFolbnd6YqKmw6
TLSH
T1121701DAB318EE2FC47310B6485D23392A964D2ACF83978379183B1D35B75E44F196E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery evasion execution persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4870	com.aman.vanish
/system_ext/framework/androidx.window.sidecar.jar	4870	com.aman.vanish

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.aman.vanish

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.aman.vanish

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.aman.vanish

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.aman.vanish

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.aman.vanish

com.aman.vanish
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks memory information
PID:4870
- getprop ro.miui.ui.version.name
  2⤵
  PID:4974

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kotatsu-db

Path /data/data/com.aman.vanish/databases/kotatsu-db
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

kotatsu-db-journal

Path /data/data/com.aman.vanish/databases/kotatsu-db-journal
Size 512B
SHA256 54436785d5c134044eaaf6cc4f586d64187a35036669c61a04ca8d74ee83a27b
MD5 de40e409793ad13fff76e8c1c9560342
SHA1 8360d44638aeb756dff2b7f6221887521aed0015
SHA512 77bfdeeb5ff5f92ac5b2a908bc8a0f2d60aa29ffbbc7b90ae7bee6c7574da78dfcd574aca81713f406bd89bca672a1b5f9bdd7e54171c17984455cfe02750b45
MD5 SHA1 SHA512

Submit Download

kotatsu-db-shm

Path /data/data/com.aman.vanish/databases/kotatsu-db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

kotatsu-db-wal

Path /data/data/com.aman.vanish/databases/kotatsu-db-wal
Size 265KB
SHA256 be5215409d2535fbb2ffa213f2f99e89ad8d3f10c7e4c44bd5f7b0ada5842646
MD5 b52184b9150fc33070bf0a24d0557e08
SHA1 fd5a876d97d25638ff47682164501f1d8e3f9cf0
SHA512 24f400d5b52db39aa1119df14ea0fafe77c958f47bac09971dd1475c6036cd7fa74d8868ce94dffab7111b41a40799241743555057a293239ab4c90e2a12fe20
SSDEEP 768:wkaJEZOWrFJuVxGW3ZE2ZJSTwNHShsPv6Vm/6DqUJO6NHTAHmTFHfgnpmv0Z5qqV:wYZO1ZJSTU+GtSDFT+iZgpmcZ5L/FYkP
TLSH
T13F44E8ED757DAFEDEECD213850F03F4E042A237E72D54BE62E248C98AEB15424D14A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.aman.vanish/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 d95de1e3d536c0ddb8936df7d1af721a073dd95fdd90b7df3a19b5f8674afeef
MD5 3840d72301da9e6071c53454cfa18826
SHA1 e44adb35f8394fbdaaecbb7f8065745c7ffa4780
SHA512 4839a9269feee741bf1d33a5128809bd539b237d1b387c8715188f092ceb336e9de273d0264b1dcd616341146f821a800326f3dc7899e7438d7c9833c9742bd1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-wal

Path /data/data/com.aman.vanish/no_backup/androidx.work.workdb-wal
Size 253KB
SHA256 d4735ecda98520ca383bfda5792dd21b9186b07344df222dd02e005e24b3380f
MD5 d86a74541097b7fbe4a1d58c5778404b
SHA1 8b60b781ad0214b13095b3297b4a50b33bd1334b
SHA512 e04b20dec504e61002346bac34c5ee9b5c6573a014fc84ac3887cce9ccb669a7ef78cf0d5dafbd29ec6c1aa9f3c0d3c75b7bc31c3b6c4fd71f96cd64ccc1ae60
SSDEEP 768:mfWz03zSOeD86y7jl4FO5TCCFMZFk+63XIFO/z5lFO/U:HSzSOeDUjlkO5D27O/NO/U
TLSH
T10444528F0FCA4130DCE90579F4A0AFA6F63E9DFF825E83506D2025245EE6511C7369EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.aman.vanish/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 88f065520815940e5eceab8908439c6500ea4af902b257487e43b3e6e1c4c219
MD5 bd70f345db44a31ee06f86f95dc3b94e
SHA1 5edf26777cb14406279b8ac5509abb35809559b0
SHA512 3ec835ed4e17e09e0bfefb176498505343044c87402f7c5365b3d966b1cb5c82a57ce08719c68442c5a4c3a4d56c699fd3089690831dd27c8a5bfe54406fb66f
SSDEEP 6:KqhQMk8UB09FZde/kPlOERX4PBX4ogLugMBX4suuK+/83GLF1jgOw2:KasuzdeWRmBEyPbP/83GLEOw2
TLSH
T19B72C255AB940943EDC9133264D8C3421D31BFAE571BC70B5E910C156C4ABDCB2A0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

journal.tmp (deleted)

Path /storage/emulated/0/Android/data/com.aman.vanish/cache/http/journal.tmp (deleted)
Size 36B
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
MD5 SHA1 SHA512

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads