Overview

overview

8

Static

static

6

base.apk

android-11-x64

8

Resubmissions

12/08/2026, 09:37

260812-llymsstdnf8

12/08/2026, 06:15

260812-g1ar3azgkc8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    12/08/2026, 09:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    base.apk
  • Size 3.5MB
  • Sample260812-llymsstdnf
  • SHA256 3bcc3fbdefd98b037860f1e5270cb2076cbc07db2bb6b968499d8b04003757fa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
collectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
    defense_evasion
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
    collection
  • Reads the content of outgoing SMS messages. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads device software version 1 TTPs 1 IoCs

    Uses Android APIs to read software version number for the device (IMEI/SV for GSM devices).

    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.batch.android.runtime
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Reads the content of SMS inbox messages.
    • Reads the content of outgoing SMS messages.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Reads device software version
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4889
  • com.batch.android.runtime:watchdog
    1⤵
      PID:4972

    Network

          MITRE ATT&CK Mobile v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          google_app_measurement_local.db
          • Path /data/data/com.batch.android.runtime/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 efa830fc55107a3f20359b89aa3d74f08c33145ac9da0a1ebc0ae974bf28137c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          google_app_measurement_local.db
          • Path /data/data/com.batch.android.runtime/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 984c7513bf80e104a66b1a6f22815724e779429e0c7d88d4da83d36537b618b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          google_app_measurement_local.db
          • Path /data/data/com.batch.android.runtime/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 39409c62502bdb1ce0f7eae81c439e33016585c6c45bb250a3ea6e90c5d79431
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          google_app_measurement_local.db
          • Path /data/data/com.batch.android.runtime/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 00801215c2301d6f701fafb250362d1dfa1e08db7747bcc295a6add319cafd64
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          google_app_measurement_local.db
          • Path /data/data/com.batch.android.runtime/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 6128f34d0a88e08c1e470e620af004a0c498c864a96d3ecdd7be83d0714eb1cb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          google_app_measurement_local.db
          • Path /data/data/com.batch.android.runtime/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 c72de32d8750fd5c64a052fa142eb9dff5bbd67268c766919404cad0b3cef9d0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          google_app_measurement_local.db-journal
          • Path /data/data/com.batch.android.runtime/databases/google_app_measurement_local.db-journal
          • Size 512B
          • SHA256 d139f024840abe831357343cd70ce21868b3e0e25eb87ab6c8c096b2e2bc6f5c
          • MD5 SHA1 SHA512
          Submit Download

          google_app_measurement_local.db-journal
          • Path /data/data/com.batch.android.runtime/databases/google_app_measurement_local.db-journal
          • Size 8KB
          • SHA256 455ba43c72115ecec4bd8dc2a35936058e76d1f4dfb7f0aa6892e214a36d475d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          google_app_measurement_local.db-journal
          • Path /data/data/com.batch.android.runtime/databases/google_app_measurement_local.db-journal
          • Size 4KB
          • SHA256 42ec36cd30304dd753d8a9d42318e8c1d946da715816e6dabf85f49378f584d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          google_app_measurement_local.db-journal
          • Path /data/data/com.batch.android.runtime/databases/google_app_measurement_local.db-journal
          • Size 8KB
          • SHA256 e68f554aee385172ebfe8b3c2a933a69050f1bccfed4ea6498ed344924673745
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          google_app_measurement_local.db-journal
          • Path /data/data/com.batch.android.runtime/databases/google_app_measurement_local.db-journal
          • Size 8KB
          • SHA256 b3afbc25f93f3faeb72a9dadcf9c708ab8f7442fcef822ab2d9dcd83b329573b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          google_app_measurement_local.db-journal
          • Path /data/data/com.batch.android.runtime/databases/google_app_measurement_local.db-journal
          • Size 8KB
          • SHA256 366691218dae8e0a461d1e6dd91f832a8504ad23f4574a2edf842ad0249a9a03
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PersistedInstallation422636511722264860tmp
          • Path /data/data/com.batch.android.runtime/files/PersistedInstallation422636511722264860tmp
          • Size 90B
          • SHA256 3f8893ef508405220adc1fa8b88c8f7752b4b0b200d86b8b14a3473b48b6970e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          PersistedInstallation6239933746013054834tmp
          • Path /data/data/com.batch.android.runtime/files/PersistedInstallation6239933746013054834tmp
          • Size 570B
          • SHA256 514e5cefe74dbb62df8d5210224a70bd9e433c157c7109eb82a1b085958f2e0f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          frc_1:651390976306:android:75b2e2d669a5b3936f972b_firebase_defaults.json
          • Path /data/data/com.batch.android.runtime/files/frc_1:651390976306:android:75b2e2d669a5b3936f972b_firebase_defaults.json
          • Size 2KB
          • SHA256 53b37c9bb39e0177583cc4dce2a05f0ed368334a4eb07db4bab1764459f6e77b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          frc_1:651390976306:android:75b2e2d669a5b3936f972b_firebase_fetch.json
          • Path /data/data/com.batch.android.runtime/files/frc_1:651390976306:android:75b2e2d669a5b3936f972b_firebase_fetch.json
          • Size 400B
          • SHA256 1bf44a1de904750fcdf8e11fef6a0d47efe179fe211c8f926dc9e5871c88ddd8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          frc_1:651390976306:android:75b2e2d669a5b3936f972b_firebase_fetch.json
          • Path /data/data/com.batch.android.runtime/files/frc_1:651390976306:android:75b2e2d669a5b3936f972b_firebase_fetch.json
          • Size 400B
          • SHA256 def644dc4d2d7310dfabeb65bd5a9c258049f5590e1658af1898ac63687075a2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          profileinstaller_profileWrittenFor_lastUpdateTime.dat
          • Path /data/data/com.batch.android.runtime/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
          • Size 8B
          • SHA256 ecfead3045abf62a1fdf63f727cdc01b355a05a26c49d60b372bc60f1b126e0a
          • MD5 SHA1 SHA512
          Submit Download

          androidx.work.workdb
          • Path /data/data/com.batch.android.runtime/no_backup/androidx.work.workdb
          • Size 104KB
          • SHA256 08c2fe98df1a3902e27b35d1d0984f1cd880dde2447f49fed5f96fdc820b0724
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          androidx.work.workdb-journal
          • Path /data/data/com.batch.android.runtime/no_backup/androidx.work.workdb-journal
          • Size 512B
          • SHA256 28965182665b868f01dd2466a1d4c4bb58a57818416bd187412755a598a49eda
          • MD5 SHA1 SHA512
          Submit Download

          androidx.work.workdb-shm
          • Path /data/data/com.batch.android.runtime/no_backup/androidx.work.workdb-shm
          • Size 32KB
          • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          androidx.work.workdb-wal
          • Path /data/data/com.batch.android.runtime/no_backup/androidx.work.workdb-wal
          • Size 116KB
          • SHA256 be11ad2d2f3080645fbc34b40244866aad8b725db4ac0689af75288467c1bb90
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          androidx.work.workdb-wal
          • Path /data/data/com.batch.android.runtime/no_backup/androidx.work.workdb-wal
          • Size 410KB
          • SHA256 09f891549a0acf052771832cd370ae177c013b9560bd96ce53f952c1c560e047
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          androidx.work.workdb-wal
          • Path /data/data/com.batch.android.runtime/no_backup/androidx.work.workdb-wal
          • Size 16KB
          • SHA256 110c79654eab57a7cc929feaa68f5ae157b0e8cda521bba97cc134eff6031b9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          [email protected]
          • Path /data/data/com.batch.android.runtime/oat/x86_64/[email protected]
          • Size 352B
          • SHA256 76803caba1d217a14ecfa0b324bf1793a108661a645870d3072eaedaa0508ed2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          primary.prof
          • Path /data/misc/profiles/cur/0/com.batch.android.runtime/primary.prof
          • Size 5KB
          • SHA256 8746e2327d02b3b1735382101c772478b671b156c654a8b7122f62c4912872e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          primary.prof
          • Path /data/misc/profiles/cur/0/com.batch.android.runtime/primary.prof
          • Size 11KB
          • SHA256 a2d9a6bed105ae94646b49a08ba6efbb6a61eda217421e92fddf8e2cb8c60a66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          [email protected]
          • Path /data/user/0/com.batch.android.runtime/[email protected]
          • Size 88KB
          • SHA256 915539838cf16d91332e5b61337645ca0c9dc012c5bca1fdc2a92892b4a1ceaa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Download