Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    13/08/2026, 04:22

General

  • Target
    6194aa250a7ec0c9e956c5a661ff9a3fe7db7135177a130fe97e0e3c8421115e.apk
  • Size 17.0MB
  • Sample260813-eze92sbj9z
  • SHA256 6194aa250a7ec0c9e956c5a661ff9a3fe7db7135177a130fe97e0e3c8421115e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.alienmanfc6.wheresmyandroid
    1⤵
    • Acquires the wake lock
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4966

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 cde87bc8c76e5e2f703bd1abb498324f8debfbff78e03657b7ec16763d5aff1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 3dc1d856f02e6b7e7854a7ca915c1cc84971535b6423b3a48fa2d4e46d1c791b
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 6a5100b507962f8cfe3890aa0bf4f3da6e286c6b5e118e4d38802539d8f71f5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 33aa43b8ecd5fbed9cc88bf6ba77d89b814ec6a5bc9eed2b857db7bbccb0cb4a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db
        • Size 28KB
        • SHA256 7fefe10534b9b430c1b6f120c42535b9b27c788ac6b4ea35eb8cf3f433177b76
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 512B
        • SHA256 7c0650b090d97be5d27fd23af53e90e49fe92a303e6251f1ec53ae974402a01e
        • MD5 SHA1 SHA512

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 b5b7a3f6e2236808cfcb5797dbd18945be4d2f837956eb9554191cc70f5f0f28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 4KB
        • SHA256 887d451d2a422be12c5e272848dd627660d400f7ddbad869ae308942507a3049
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 64bed0774d094a78285e76933722891a0b6c6c87044aa0bedff35db95fa24787
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 31309a3d24f5427d1300f21e3a60ab5a9aa3dcb984bc18184d3e8d29cc1c5ee9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 12KB
        • SHA256 3d1163b4f8597378f4766c18c94e3cc1c97a6777da35137d3f3ab95209f20b85
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 d0f744c535ff5409654e6640d9a222f327d9b780940e29f714689af4d5d22b64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 f0de3b443b78aab7af4c8e1fcecd6a2d3b012386aecf685ac5016a618113d6a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 1d87db8ac889d447344de6580161fb751514d8cca6163c880452446edaf500d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 b4156e9d5953c0acc8589919baa4b903635043b5d24e363b174e16b78f0d2f1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 b0b63a87432b7a3e63f22203c036adb36c4801f6de19638226107cc4bc94c68d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 9244f0ff5c25e69444e7baa94ee2483e1acb9dcb058376bd70cb6deefdb3c020
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 a5109f838cb7823c33de861f98c84bd037639a6743c7479ac12f4bf1324e77ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 7ae2c41aca2570aaa4cb34fcc6037bbd39e2267c762af390788c86930b8f557e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 a6b9e5bdb34a174dd14eda03cd5a3731886e6e17ba0de770f0f9ac82ee45c258
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 cb049ba98dec8da554fd0ff59bab2d818104019188afdc24a4851afbf7e995fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 1e8579acd55e72d432643a0c4d5e8dbd07de836edd95bf1fcc6db5982f53b8f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wheres_my_droid

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid
        • Size 4KB
        • SHA256 67b04eef2b7a7688059f1380a23ef18e84479f610b0807a1a4a8ef1e9baea525
        • MD5 SHA1 SHA512 TLSH

        wheres_my_droid-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-journal
        • Size 512B
        • SHA256 8eef7e0dd05989fcabce547b776505392bab53882f572d119dba7e20c913693e
        • MD5 SHA1 SHA512

        wheres_my_droid-shm

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        wheres_my_droid-wal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-wal
        • Size 321KB
        • SHA256 6d5913abed185843d89d87c74fc57f563eb3d2c7d0cd197798b7122a9f36e38a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation2938006758007982501tmp

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/PersistedInstallation2938006758007982501tmp
        • Size 558B
        • SHA256 7be65ffcca87fa6a790759799550881b3af6291cbc50c1f01503cac0ebf9391a
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation6736334921084386326tmp

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/PersistedInstallation6736334921084386326tmp
        • Size 90B
        • SHA256 653e841694ed95ccd94bbd28a33abfa99cdd6807d7402bae1d332d3aacd222d3
        • MD5 SHA1 SHA512 TLSH

        coverage

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/coverage
        • Size 65B
        • SHA256 e1258d71654a7f76feffad7ed7f7fa0ef99438f8b111582e3cfdea661874aa89
        • MD5 SHA1 SHA512 TLSH

        coverage

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/coverage
        • Size 54B
        • SHA256 b2c3de313ddbe97841fa2256287f0b03a7b86ceffe6056c4402eb6a114efe24b
        • MD5 SHA1 SHA512 TLSH

        gaClientId

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaClientId
        • Size 36B
        • SHA256 78297740a16e1fc42c9f3134af214a2748223dd312899315740a3fb027d491ba
        • MD5 SHA1 SHA512

        gaClientIdData

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaClientIdData
        • Size 32B
        • SHA256 e836cffbec4e75471026f95376fec1df1687b108113b7eb4c8b0986f09c61ddb
        • MD5 SHA1 SHA512

        gaid

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaid
        • Size 85B
        • SHA256 4da8790eae77fb6aa1060cb0f41e336cfeba3591eb33b6b261fc4b338119fc93
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 65d1cb2177b758640cc047ef9c2efb9b8c7fdbdc85b6615280a323f7def86c77
        • MD5 SHA1 SHA512

        regulation_consent

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/regulation_consent
        • Size 1KB
        • SHA256 c7d0c076b2e682f8becf697fb423c539eb1ca09cee15c0cf23d9e9a5312a8928
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 113B
        • SHA256 f91c4758326194d12adaa31e40111eed67827c442d7118e37aa5e6e828946c02
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 98B
        • SHA256 94363d4079068c5b103f3d7fd19942f69d783974e7b97c50feffd75aa8621c9f
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 161B
        • SHA256 54dc7360e4f3c0045ce8ab87e75120b1015dbc38611437bd0c11b4f3971bcc16
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 160B
        • SHA256 75285ea6e5a478c9f496911781f9b443a88c468ff26e75cea50fcf42f31c98e3
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 602B
        • SHA256 de1ef3bf255414323689a019375f9c4c04b8c1c523bbfec739630cb600d88f08
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 602B
        • SHA256 94dee8c991212dc903a43f1364af25a0d875e7c0c3df67bffab053870b57c00f
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 695B
        • SHA256 24b0c7bdf3206bda27ab86c1ad8693db04e0f62c21b0d6ef0c6fa314e4524bc3
        • MD5 SHA1 SHA512 TLSH

        should_attach_if_allowed

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/should_attach_if_allowed
        • Size 31B
        • SHA256 53ade896a4b756ca5058942117acbe4b3d069c77c64b75662da74d2fcc558e3c
        • MD5 SHA1 SHA512

        primary.prof

        • Path /data/misc/profiles/cur/0/com.alienmanfc6.wheresmyandroid/primary.prof
        • Size 2KB
        • SHA256 4fdb914bbb522d296fcb021cb703ab975e3d3eb44a016b9c1a17696a9e1d563e
        • MD5 SHA1 SHA512 TLSH