Analysis

  • max time kernel
    12s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    13/08/2026, 04:33

General

  • Target
    2b11ac02b9d4f2681cb7352b4365c0fc2b02d8d4722811e1adb10322d48134ce.apk
  • Size 16.6MB
  • Sample260813-e6jk2sbk7x
  • SHA256 2b11ac02b9d4f2681cb7352b4365c0fc2b02d8d4722811e1adb10322d48134ce
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
  • Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
  • Reads the content of the calendar entry data. 1 TTPs 1 IoCs
  • Reads the content of the call log. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.liupait.tracero
    1⤵
    • Reads the contacts stored on the device.
    • Reads the content of photos stored on the user's device.
    • Reads the content of the calendar entry data.
    • Reads the content of the call log.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4829

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events
        • Size 40KB
        • SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 6aea0fc0bf70c763d37b9852106a7ecdba0cb469a266e6e08ade5eb152bda713
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 6cba87838171f96fa28986af03baec43391b803a807e5b62517668aa929a3dab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.liupait.tracero/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 de42334ba31873c05817dec4f19b5c60f3e81152a0b5a78f1b88ce1a4835540d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 12b7ccb95b5ae7b18017c59a39af867bf131991dfe415483b4469492db7f9a2e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 f64935b5a87c0e0c8cc09ffe47985b25901379ea96433a973f7ac52e2ba6b304
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 16KB
        • SHA256 5df4f7da5bc2288d0707d9200e8f0f49ae23cdade1f3039f455ca06bc9e33c7c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 f4e098c7497f6849564f724cf40adf38c5e221d002828f309b4f12edc7e4b622
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.liupait.tracero/databases/logsManager.db
        • Size 28KB
        • SHA256 f1e8d8221877afda0075f4b4bf5fad9a519f562624b5a178a6dba1430efbd0ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 512B
        • SHA256 701dbc35541c4d0ebbbc8ddfb308211e7752b963de98838d78b594fb86b4280c
        • MD5 SHA1 SHA512

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 8KB
        • SHA256 d2af5c2fe698540dd2de0235fb73e820b02b8caf4842c7c38190600d079b64c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 8KB
        • SHA256 35a5cd08905ee05684af24d9812abe911523da9d267f8f79a09a2f52dd95012a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 20KB
        • SHA256 c8113bcea5aafbeab9a36a4724e220364e4be88b8ebbaa7f479b0ce032c0f46b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 20KB
        • SHA256 40913423d171ee6eb9f1ae405bc04d319243778814747bbdc6622b1599661954
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.liupait.tracero/databases/logsManager.db-journal
        • Size 20KB
        • SHA256 fd38afa522e47c4b814d1b53cde0ccda773729042ae393a95118b2ed43ad24f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation5182452285942559673tmp

        • Path /data/data/com.liupait.tracero/files/PersistedInstallation5182452285942559673tmp
        • Size 568B
        • SHA256 b7dd86047e75978e0cf9c5e491aff5ab1ddd2c331bde872445070738ea53371a
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8667681874379829762tmp

        • Path /data/data/com.liupait.tracero/files/PersistedInstallation8667681874379829762tmp
        • Size 90B
        • SHA256 43b37fed640abe23d8a597d0307a0d7fb632d77f818f0da3f8a5b278589818ae
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 6c14f814e567c3485c9dcbed7e85b526715f3d3f44d6f2a82c72c072891922b4
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 d9d5ca8ae2d88e3833b88e65579902450be2fd5945efcf304768b73f2abf28a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
        • Size 173KB
        • SHA256 31a4c62b8de0aad3156e40bb074d346e89e139dd42eea406756e5c27b26d88d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.liupait.tracero/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 1be13867157b8ea3fe5013a62288d954e1c3c2071a448d2ee5a4a5a94a2aad4e
        • MD5 SHA1 SHA512 SSDEEP TLSH