Analysis

  • max time kernel
    125s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    13/08/2026, 03:59

General

  • Target
    86708ba639c7795a7c263ab11fa59ac24a2510cff1b03b648824c13d65994774.apk
  • Size 209.0MB
  • Sample260813-eka2sagf87
  • SHA256 86708ba639c7795a7c263ab11fa59ac24a2510cff1b03b648824c13d65994774
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.pt.bark
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4797

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        environment.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/environment.json
        • Size 12B
        • SHA256 80be2eb0944c0453a6ad339a56e1c8f39f8cc57a4e627758246ccfd274176fd8
        • MD5 SHA1 SHA512

        release.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/release.json
        • Size 24B
        • SHA256 06baa5c76d16efce43352feb8fc3384036971802240b158a77988ea4535aca06
        • MD5 SHA1 SHA512

        sdk-version.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/sdk-version.json
        • Size 591B
        • SHA256 e115d8303649f07b36cf88a09bc3c87ef3d092c36448321f6b80eac809b9f511
        • MD5 SHA1 SHA512 TLSH

        tags.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/tags.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512

        breadcrumbs.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json
        • Size 4KB
        • SHA256 38fe04aaea85d95fa093e52724dc6e871ddc05ac849f511ea8526909d4f3bff1
        • MD5 SHA1 SHA512 TLSH

        breadcrumbs.json.tmp

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json.tmp
        • Size 12B
        • SHA256 ae1afdb53fc94d62b6862659f839a20634382b65a7354f32b5e81cd29fb4270d
        • MD5 SHA1 SHA512

        contexts.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/contexts.json
        • Size 63B
        • SHA256 dda403ea3f2dc79793e354552c63edfb2be6a7676df6d0ecdd02a12055fcdad8
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 927868cf86a9c3e2cd8e23d82bfb96295a14944f2a89e10585e04afc73476413
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 188B
        • SHA256 b0c5cd3d6d9e699424607d29d48c137eb1bff324d7626d70e8348fc43d4ea282
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 29d7f6e8b10a74629a660c7f593cce0c7f3f87ad721e45a41465700db4ee78bd
        • MD5 SHA1 SHA512 TLSH

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 18B
        • SHA256 96f7a5db03a7c5ec7847b1ca053fa92d19552fe07cf22a21a004e4aabed4a95c
        • MD5 SHA1 SHA512

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 16B
        • SHA256 96c4b7db81f09c9990c9e856e2d350b49f8ca5e0657620be9a6632cc3d7aaf1c
        • MD5 SHA1 SHA512

        installation_id

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.sentry-native/installation_id
        • Size 70B
        • SHA256 2927e1db0c634b82bf0f588b2c801236f47a9828f37c27e709e40cff4041dcfd
        • MD5 SHA1 SHA512 TLSH

        94bbaaf2f12d495284e28a081e4a8977.envelope

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/94bbaaf2f12d495284e28a081e4a8977.envelope
        • Size 886B
        • SHA256 a9b9e30f01ff7fc3f4c50564e25d3f41c7a6c9eacac36675e18f260263be8871
        • MD5 SHA1 SHA512 TLSH

        session.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/session.json
        • Size 268B
        • SHA256 72cf2eb5b0a30250182a4a5b2d50d96a1f9051196c42ed08284e4859ff566bee
        • MD5 SHA1 SHA512 TLSH

        OneSignal.db

        • Path /data/data/com.pt.bark/databases/OneSignal.db
        • Size 52KB
        • SHA256 491c9687657ca71661a5cf42a763249f88fa222edaef20eaf552c4599458f99e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 4b1b26f04e0bc5c6e17f5689488df895232cc663c4e9e228f5dddfca919cd81d
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 be344e4baf4c8f9e6ec24f8a8839e7947201544be1b5ecdbcb8d8c23ebe94de3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 67ab5c80834ce9f16033c2a61a243d877bc2a2802996710145cf66f80feb853a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 4fd2db4eb72aa0fdd91f78b97fe88540d7ceed340ef121ab32102e69ec3da7dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 418e52bdee594b325f0324bb7b64b493e70a093b792a368d2dc7c42a7d2d96fc
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 ad4d9829b442adbdb96840778633450563288ebfb7e2752bf798036d56ceadb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 e9709807f8212bbf885cba108ef1fff316ea511f60e4cd6bea7f230dc612f3df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INSTALLATION

        • Path /data/data/com.pt.bark/files/INSTALLATION
        • Size 32B
        • SHA256 cf588af0dfc776a61ee8a15aafa0ce86dd5b3495ca1cd0cf8915d0a8a052013f
        • MD5 SHA1 SHA512

        PersistedInstallation2242199023303142254tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation2242199023303142254tmp
        • Size 90B
        • SHA256 dab20b6e6bfaaef56b3a2ba57b755a619f60aad1b703d44620e64b0f6049e51f
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation3389836301759257240tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation3389836301759257240tmp
        • Size 90B
        • SHA256 f3c422ce64f6e467daa28d0079dd9c1858dcf4316dbd12c4dc49ee8ba3eaf8ac
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation4652822769869635349tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation4652822769869635349tmp
        • Size 567B
        • SHA256 bafb2fc95fbbc914c9849fa5c1624270def4ed4b652ca6f7b1736075912c1d04
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation4936995876382960805tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation4936995876382960805tmp
        • Size 569B
        • SHA256 a37ab30ee74dd35da1a66401f94935d19078cc4a511729c4c0ec90e145ccbc96
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.pt.bark/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 6a0c2a27a35654fd5151e85c1335536400f813e4ee8993e97a2fdd5af1d4ecdc
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb
        • Size 100KB
        • SHA256 a19f8f121e7bbb1957710ebac55b4ac7b914955164f5c7eda96a170746aa7823
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 10dbb6c2bd8c5e58cf45d2233488d49ebd5e1535098f29b56542a58edb4c4043
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 07f12ca63a73e468773e9598fd48401fa37b16d4b105762bda2f6901db6de16c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 f474b551a9b4145dea049b9f5358c690e12b05a1e2a323ac1f4502d24b0c8014
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 414KB
        • SHA256 7dc5f0b0508736549eb7eacc88768823e61c4efc316f9647953317bd16e41159
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 1KB
        • SHA256 2dfb52c687862dd9939a07fae37f61fff3e733b3c934cffeb7f286b2c38b16b7
        • MD5 SHA1 SHA512 TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 16KB
        • SHA256 906f4b835fb4eb2812198e7530bbedb41a2a1261feb62aae7968f8ccbdea5c75
        • MD5 SHA1 SHA512 SSDEEP TLSH