Analysis
- max time kernel
12s - max time network
151s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
13/08/2026, 04:33
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2b11ac02b9d4f2681cb7352b4365c0fc2b02d8d4722811e1adb10322d48134ce.apk
Resource
android-x64-arm64-20260325-en
9 signatures
150 seconds
General
- Target 2b11ac02b9d4f2681cb7352b4365c0fc2b02d8d4722811e1adb10322d48134ce.apk
- Size 16.6MB
- Sample260813-e6jk2sbk7x
- SHA256 2b11ac02b9d4f2681cb7352b4365c0fc2b02d8d4722811e1adb10322d48134ce
- MD5 91670da2a575b6894bfa3f416f49cca2
- SHA1 dceac238ab46343a1c1e9092ff2f9f69e0199770
- SHA512 0c426cef8aef8f99fef9cb462c4177fb7feb1b6e7dc249bc37078b6de41ad355c07659ea3511db12aea4525ab3d88927ca144266344e99de8d5c3b0b8965468d
- SSDEEP 393216:lK+ps7YwPwVJAVTFXu9e91NVhJcn7NQr4yVRyabhmb2mjm3vksi2sqj:7ChPYLe91Ne7NQcitAb1qT
- TLSH T149072311E7A87A87E831903A4656FB3075966C686B02D682791C33FC37737F44B6A3E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/data/phones com.liupait.tracero - Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://media/external/images/media com.liupait.tracero - Reads the content of the calendar entry data. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.calendar/events com.liupait.tracero - Reads the content of the call log. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://call_log/calls com.liupait.tracero - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.liupait.tracero - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.liupait.tracero - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.liupait.tracero - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.liupait.tracero
Processes
-
com.liupait.tracero1⤵
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4829
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events
- Size 40KB
- SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
- MD5 1cf3f63c021d755a21623e6d0e86dbc6
- SHA1 e40e0f1faa61abcca7ba3394c54c92ff7334b49b
- SHA512 38d72e14f3513ffd26989cbda3df46ed3dd6e731bdfae56440eff6b64760cc13f91014281c9add61e018fe3529e49c63a6892ca22479515816c768b546244466
- SSDEEP 48:TfkL3u59MENZBdUdndVd/7T9IvdldHlq8/JqYpqPS:zkL3KMEX0xIyNYMa
- TLSH T1AF03EF5D4A202611C2BE083FD7E257931B3CE35F6B2387612E904CF6DDC68B6B821998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
- Size 512B
- SHA256 6aea0fc0bf70c763d37b9852106a7ecdba0cb469a266e6e08ade5eb152bda713
- MD5 2555f3ab84a3b817aa2094fc84943f62
- SHA1 ab8b11142dedbbb3d752bd8cd5cdefb0dc47aa82
- SHA512 c478246a80fa3b54ece2bef89a8be973da168a8a72f4ae38723d1c5948b367cf20c1b3d5d9c704fe3ab22f2464021eb1bee84f2eae8b6c270c5a196dbb46c935
- MD5 SHA1 SHA512
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 6cba87838171f96fa28986af03baec43391b803a807e5b62517668aa929a3dab
- MD5 884d693b62088ab5236e2e21cb456ff6
- SHA1 7d080ebe42ed251902ba3bac235287d3d86bad96
- SHA512 f69fcfe94c09c2cad55aa207ebac0632b9f437a7cedefb9d00cfe40a27de238ac7d6a6629417a414a19985137d9629f5136a9249676a0e8fd76afe4af59a43bd
- SSDEEP 6:7+/l9xYBDn1mOxvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKqZn:7+tUrRqLiuWdYRmBEyPbbZn
- TLSH T12E022288E3800822C92A367790E583400D48A728827ACBAB2B9008A43C078CCE4A0D84
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 de42334ba31873c05817dec4f19b5c60f3e81152a0b5a78f1b88ce1a4835540d
- MD5 b253b5b1f113935bd3cb0e91258eec61
- SHA1 0593502caeea22457d14872dc3372c3586bd8756
- SHA512 44cd7abcd10d5168dbbe58201665d7ecdd2874d1e3c0324f8783c0e4d7aa8647ccef7b7ac2d5db96d0ae484ddafc92cd81fee2b17fb4d9547357b6b816ccd737
- SSDEEP 6:7+/l9EGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKow9M/M:7+tFqLJdeWRmBEyPby9sM
- TLSH T1B702128DA7412913C53D57B7A0D9C3545E14AF29B2B3CB57269108946C46ACCA8A0E54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 12b7ccb95b5ae7b18017c59a39af867bf131991dfe415483b4469492db7f9a2e
- MD5 77209cf7d9c5b42fb6bc739f7781fcbd
- SHA1 1381595c89d95225ba47ac935b51cf66c74d9b74
- SHA512 8de839b4269f387995f61d02a5a11e876d17430c3451abb98fcb60e6592f29967c75ca21b2fdd074f42f1986227a9872cb4a6dcdf904bb2ccba6fb57f09509a8
- SSDEEP 24:TLErtAn9uBUZgFjde3QUGSi+1cNm/X+Mdkbvuvv:ToZaye3KSr0m/u8kTuvv
- TLSH T16BD2BAD5C3EC3313D2604137A023A7A2BD452D4CC1A36B5759C13CA84D93809ADBEA68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 f64935b5a87c0e0c8cc09ffe47985b25901379ea96433a973f7ac52e2ba6b304
- MD5 ca6195f5fb0edd95d7a30e670a99edf2
- SHA1 5f5ceb0e2182436c6a1a467070246728c146bcab
- SHA512 61451cd7018fe8fdc8aa5403510c860ce49e23a68afb3515a94be97571fef8d5f1f71c0edf6fe2142aa551ad5d595572de24468b5a68c6b3f7b681c9a43b74e3
- SSDEEP 24:TL5tuan9uBUZgFjde3QUGSP/Ck1cNm/X+MdkbvuvhR3x:Tuhaye3KSP/V0m/u8kTuvhR3x
- TLSH T1C4D202D4C1FE2313D1610136A0279192B8052D4EC3B35B465EC13CD50D43809B9EFFE4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 16KB
- SHA256 5df4f7da5bc2288d0707d9200e8f0f49ae23cdade1f3039f455ca06bc9e33c7c
- MD5 5e41ba47bd6e98b0ae15a7cd08cfdfd3
- SHA1 34e1cbb7161b7a79fb079a3ace7b1ac4c8fc924f
- SHA512 7c2d1219c67f5a547cf868921939857c0503c9d6301bdaa7840df8e0760d0cadeca524474caf56ceaf6913144ddecd69f2b67b58f6c2bec21a6b64b69c60b349
- SSDEEP 24:TLqtun9uBUZgFjde3QUGSP/AQxs5t1cNm/X+MdkbvuP:TUaye3KSP/A0s70m/u8kTuP
- TLSH T1B2722DC5D5FD2713D2701033B0276142B8092E4DC1631B966AD23CA94C83C4AE9FEB78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 f4e098c7497f6849564f724cf40adf38c5e221d002828f309b4f12edc7e4b622
- MD5 d2351d84e04d10245c2cbf5e2193d632
- SHA1 db3427e1218273d21840a3ea01b82948c8ed4078
- SHA512 a7dacb8ad68d0ff2d91dab0cd7e3347806f5d3dde0bab6bfab39d026aa122b05cac4c09a5accd452fdcb8685a9cdc34a2ebaae5a3e3c7c8a83f8a96ef862d9d7
- SSDEEP 24:TLbtNn9uBUZgFjde3QUGSP/htrQqhr3Qxs5t1cNm/X+MdkbvuveQw/w7:TEaye3KSP/h+qhr30s70m/u8kTuveQAA
- TLSH T1CFD20FC498ED2B13DB741033B0275542BC092E4DC6635B91A9E23CA50D93886BDFEBE4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db
- Size 28KB
- SHA256 f1e8d8221877afda0075f4b4bf5fad9a519f562624b5a178a6dba1430efbd0ac
- MD5 a356f2e853af4b4da3ddd7614887d011
- SHA1 c73a1e5a17c4118399364cc9440e2d57724fe2f9
- SHA512 f9bfc3b7e9385315d8c0617579b261dfcc7cea3158ba6031d904c36d4248bc3356f6882e2177a9f77648feeb60bb683baa53c788679c9fe47b58587d94525c93
- SSDEEP 48:T0aye3KSP/a6M98Rm/TTEqhr30s70m/u8kTuvL:Q5GPCeaEq1N7NOw
- TLSH T1C5D2AFD998F96713D7B12037B027A542B8052D89C2A30F5575D32CE90C53C46FABB6B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 512B
- SHA256 701dbc35541c4d0ebbbc8ddfb308211e7752b963de98838d78b594fb86b4280c
- MD5 9014b932a93666864a8ea27de0c64d88
- SHA1 92ae0cc70469730f41c50188239a55912a9d1be2
- SHA512 e9d34c2c88843c68792cfef73f864062eb648f76b8472c87e99becfb7e5d39a67f3e18eb9cbfc671a851123c1500edeab3e20b1e0b41c654e924a174f37a77bb
- MD5 SHA1 SHA512
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 8KB
- SHA256 d2af5c2fe698540dd2de0235fb73e820b02b8caf4842c7c38190600d079b64c7
- MD5 36aa4e22929b21f79ed65774073b36f0
- SHA1 7b3da214ece901fd53571be57f6e49ad395c0c1c
- SHA512 618e23086c9d6b8c662c0e611d54eb99d24ac8e3ea95b8f211a0a287e11907bd4600c9a04c6604c2eb53862607ef35056d8f4487c63c84b2cabe8ea29868a557
- SSDEEP 6:7+/l93n112vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK5:7+tMvqLiuWdYRmBEyPbq
- TLSH T1CB02C08C63800D13C82F76B7B0E683490D10EF28D271CBBB169C08947C074CCE8A0D04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 8KB
- SHA256 35a5cd08905ee05684af24d9812abe911523da9d267f8f79a09a2f52dd95012a
- MD5 10453ddde930dd15c7135a9c21ad8dc8
- SHA1 0d19e7cfc60fdba08579a786e0d183624540d556
- SHA512 abd16ff513388806b0a3aa14b96ed3ee3944313491f262af1e96c3429f421e2f5bd496dbd9d4717bb7b4b151566b3c129df6eef1631a11a5077db09b4f70a324
- SSDEEP 6:7+/l9nQ0FPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK8Skt/4:7+tFpBqLJdeWRmBEyPbss4
- TLSH T13502C08863400903C03D2777E0C883401E14B729E333CB271E920C5C7D077CCE894D00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 20KB
- SHA256 c8113bcea5aafbeab9a36a4724e220364e4be88b8ebbaa7f479b0ce032c0f46b
- MD5 f5dd5b8c657f433de9ba44ddcc3c7bfd
- SHA1 95f6567a22b508006b50210445b2283fdeb2ba26
- SHA512 6702097ee55d987c438de70c2d71b79812c8b29336bd66a29c0910c2f4e8f49da50be4320eb6a49412188a6ba6b3978bbb15ef142238554764b3ef2a48cb1217
- SSDEEP 12:7+tZ73qLftvRnCM5fu0QHSk2F+DugFjJAOsEexOGQGTuRmBEyPbT:7+tZ73qLftJn9uBUZgFjde3QUGST
- TLSH T1C892DDE9C58E6330C0695171847951508D2E0E8DC1E367A789C03CA86E8352DF8EEF7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 20KB
- SHA256 40913423d171ee6eb9f1ae405bc04d319243778814747bbdc6622b1599661954
- MD5 e27af2125212ea61d4745ccec6c4f7cd
- SHA1 59e502bcf8662fe5cff862ecf29df5369b206eb9
- SHA512 871de306e05a21c29857284a656ef3034d56b2253a2cd0e3699f17a7eddab48f249d59d9066fd5ef41f1f879ff86893d62b1561e22345c4fb57cc25f47f0bf9b
- SSDEEP 24:7+teg1cNm/X+MdkbvunqLErtAn9uBUZgFjde3QUGS1:7Meg0m/u8kTunqoZaye3KS1
- TLSH T1A692D4D9C6EE3313D271513BA063A762B9091D4CC1A35B5715C13CAC4C53809A9FE57C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
- Size 20KB
- SHA256 fd38afa522e47c4b814d1b53cde0ccda773729042ae393a95118b2ed43ad24f9
- MD5 84f8197166a6f0cbc87a51e4f1f4638e
- SHA1 9407c6065a80d071cc3159e858761f3c6e03ad93
- SHA512 5c499baec238e422880febe940b91c9a0a23e49a343dee6adf9b97a9ea37523e329fba996aac2fb5904d890e4bc1c6580bb543fcecf8abfc98bb80b3ef951649
- SSDEEP 48:7M8rYC3qhr30s70m/u8kTujqEaye3KSMK:7Jx3q1N7NO6N5GL
- TLSH T1A89220D898EA2B13D6701037F0670441B8092A4DC5631B9165E23CA50E93882B9FEAF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/files/PersistedInstallation5182452285942559673tmp
- Size 568B
- SHA256 b7dd86047e75978e0cf9c5e491aff5ab1ddd2c331bde872445070738ea53371a
- MD5 649248548f03f3a1bea51e52f8472d2b
- SHA1 29ec045768d1ef035f3b3c380ac1c847d04c441d
- SHA512 9a880bcc874857c77ec07ae72af1398c957c867b5149e22138b0dd20102507d3094c56e2f1646eb72f6d22119541a94fe8fe0be0456e05a3babbf0e3306d5d26
- TLSH T17EF096812E048605EFCB070364897E0C1E0C06B4349F4AF7BFBD287122E8969A32F104
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.liupait.tracero/files/PersistedInstallation8667681874379829762tmp
- Size 90B
- SHA256 43b37fed640abe23d8a597d0307a0d7fb632d77f818f0da3f8a5b278589818ae
- MD5 9fedb754767d4c7def748948ca4924a6
- SHA1 75121ff11c1b485dd7299387e61e08a796a55082
- SHA512 b233abb2d1bc25f28e41bb95628aa9385a95f7e9d9baf8ac1a0a75412fb5e8d56ff6305296d023df278956b6cd4a988f121ad4d8bca94b6e7c5e658ffa72f275
- TLSH T138B012008BB04241D79EA7035CCCA5102DC134C08809CE560F3CD15001D11D4C153A94
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
- MD5 7e858c4054eb00fcddc653a04e5cd1c6
- SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
- SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
- TLSH T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 6c14f814e567c3485c9dcbed7e85b526715f3d3f44d6f2a82c72c072891922b4
- MD5 91302b28bcb388d1e0c117628a9530c2
- SHA1 0ea72f90a7ed3c76d6ff6efef17d4f83f8531c36
- SHA512 2c58874e2deed2af12ebce47c6da7c0a09d2fd434e5912b5b1fcdf37b109a883ec23f38c29ae0f2d512faa9686845fbb3f6036c4d7667bf581f4eff01a37ec7b
- MD5 SHA1 SHA512
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
- Size 108KB
- SHA256 d9d5ca8ae2d88e3833b88e65579902450be2fd5945efcf304768b73f2abf28a5
- MD5 1526c7a852112246d3f616937da8dabf
- SHA1 1c1bf880980e8021b27e5ec2654bd6457d37f5a9
- SHA512 206de88b843ea6087005708983baff0e10078f34f35804c94f0616bf470678843dfbb397fee7b435e7d6059b41a8f572b4333ac77e11be510950593f2236d5a5
- SSDEEP 48:1FY66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI9I:D6+hdjnHtDRMpf8UzS6+BD8q0ExPVhXV
- TLSH T15BB31E5E0F193504C099A4F1A6900FB17A3E453E939BE7E179918065FEC2932DE29CFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
- Size 173KB
- SHA256 31a4c62b8de0aad3156e40bb074d346e89e139dd42eea406756e5c27b26d88d9
- MD5 3f8bfbf334aaf8b6659b333f1f1c2bcc
- SHA1 e1bdfed9b554907fa4e90ea215b7be6b87ff472c
- SHA512 091d5b231559b4087535c11fae1b8f39142d7c7a4e084c6b316aaf4784cdcae7991150b4ca3f1e302a5dab5c48b7689eee8c49333c097370604167a143e00e76
- SSDEEP 24:NWwbX4tYAbbIE9YvuubICCubI3bInXQ3ObIywi3ObIjnbIHwbX4tYAhCbIIbIO:F4tYrEOOCycm2js24tYgxO
- TLSH T1AF0459B1C34163B9D164013E9F8B0BFFBB006CB54A2CC89232E9D236BE9894B0E74055
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 1be13867157b8ea3fe5013a62288d954e1c3c2071a448d2ee5a4a5a94a2aad4e
- MD5 a7e15d44a979f8ee26c5f149b4f3b1f8
- SHA1 23888893e2e3862a9d952efca09a21e259d60323
- SHA512 38677cdd93dfbba50111ba28688d96af6326093bb90d3f40202c09c7258282b2e27d789783f54863136d663ae9b08876a3bc170f592892b08f31413017e84048
- SSDEEP 6:K+RHXGqfHa2lv9FZde/kPlOERX4PBX4ogLugMBX4suuK+/oHJXwHHvDQHOdil+qD:KUrPtllzdeWRmBEyPbP/qJXi+MTOw2
- TLSH T19B72C2B0A3807966C41912735688C7700F60DEBD639ECB0736E18951FC0279DA550E0D
- MD5 SHA1 SHA512 SSDEEP TLSH