Analysis

  • max time kernel
    603s
  • max time network
    868s
  • platform
    android-10_x64
  • resource
    android-x64-20260325-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
  • submitted
    14/08/2026, 23:22

General

  • Target
    base.apk
  • Size 48.0MB
  • Sample260814-3cte6atepg
  • SHA256 e86f4c8752be0aa54b79fd974b76e005e1a17815cdbdcd3653a148ab8a437d6f
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Checks the presence of a debugger
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Enumerates files in the device's shared storage. 1 TTPs 1 IoCs

    Queries the system media store to list files across shared storage, letting the app discover what documents and media are present without opening them.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • voicechanger.voiceeffects.soundeffects.voiceavatar
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Enumerates files in the device's shared storage.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5070

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1785301552478.jar

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/app_yqzdkcache/rbp/1785301552478.jar
        • Size 19KB
        • SHA256 ed4d4cae0133a3dad1cdbd08010ac1d3cd946d67d100ceb3ff9871373bd487af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1785301552478.jar.cur.prof

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/app_yqzdkcache/rbp/oat/1785301552478.jar.cur.prof
        • Size 70B
        • SHA256 6cbcd695f08d5fff65bb3cf899d3a66b84a389a0883a88848be4ce1b5d86c320
        • MD5 SHA1 SHA512 TLSH

        com.google.android.datatransport.events

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/com.google.android.datatransport.events
        • Size 72KB
        • SHA256 2fcacbac0ae12428906501aadf938c501259075f843d1d6c16b5e663726d3b59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 9482935c81205f5f710c46def4c91d94377c2570a8a998623f1a479659501c16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 1483a1fe7adee97c6f822400099670778c3034cad4b8920a45adadfd7fffa2a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 6e1256d905432c7ed13351fcc7fcda46e68498e82fa41d77be666aeefba05a48
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 cadaa8d3c0437619aff11d68ed6fa18381082c7cf0f22105dccd0c86dc6d1a37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 ff3a4399ebd03ffc6e762319dc46f27c48f88470a13ac815fd31e786dd2a0fe5
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 1e4e502d90f20536d20f1489b3ebfad06a81451556620565b198d648dff9df4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        effectaudio-db

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/effectaudio-db
        • Size 20KB
        • SHA256 8631bb798836858e6c280ff5268d921964733de2f2daf99a73078bab5f44a739
        • MD5 SHA1 SHA512 SSDEEP TLSH

        effectaudio-db-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/effectaudio-db-journal
        • Size 512B
        • SHA256 7d4fc4750037e03fe9994ee2f8f16f4d9172302188f14a5c6712f7714dbedb50
        • MD5 SHA1 SHA512

        effectaudio-db-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/effectaudio-db-journal
        • Size 8KB
        • SHA256 89604b28bb7a78460e3891e6ea3ad2dc6668e6ade1adb015c9b3bd004d2ecc29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        effectaudio-db-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/effectaudio-db-journal
        • Size 8KB
        • SHA256 f504de2a35251e0ac9532e28cf756a13d004518def9535275ae900fead56185d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 60c0ccd987453f89ea3bc04d13e34c99f1fc4bcc4aee97c34e524d22f319b182
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 9ffe31fa5f4d4d11110b889de0201a3738f9d15bbe094c63413060403dab39d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 24c39891cd82a6251227b04a9f54c4de09af17252e167b737a9baf947339130d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2157650ab5063b725e21be326d5a4900ccd07a3452f884ac6123a8e4b4cc3863
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 3550feae1ab1a16ed4d76af836130cccd5c97171d5b38aaa84fca85afb63143c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 ced798e840c25ae97de7a5b80dfbe98e929a8ed02a647c334825dd92f591c324
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 e9dd7ab93888434c63df4699b289459a6865bbb5ab8785f2fa4cfcc59c29755a
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 079fc3fc74a4bed27a95512edd69c64e91c18154e8acd53b2d74ebb551a55bc5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 b43317dffcabe8e9097c0ea726895b92120dbb95c350efe0af2c42fd89e7bfb2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 17078d9ef68516dd1934a69ac80c34db81987ec54b6200397cb1ed2616dd0ff8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 d63ab77a6d723755123bdef99aad8318f2f17b8edfada061775abc45a3047a11
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 d2e02374371ae97961bfa2e8b28f84bf99dbd01fc9f87bfed193e16a7018b5f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.crashlytics.settings.json

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/.crashlytics.v3/7e1ced77f03d8084c17fdc34b5d9cdfe4b02e8a5/com.crashlytics.settings.json
        • Size 799B
        • SHA256 9ad2adfbcbf7c94b4e6b7573e20988e05bab619f6f13716395a7ecc409ddacc6
        • MD5 SHA1 SHA512 TLSH

        event0000000000

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/.crashlytics.v3/7e1ced77f03d8084c17fdc34b5d9cdfe4b02e8a5/open-sessions/6A7FA3AA02B7000113CEE0424C5D5B39/event0000000000
        • Size 5KB
        • SHA256 3bb8e4012051e582f507fbaec411d135b800cc4213c40f48b1a02aa79d2e5176
        • MD5 SHA1 SHA512 SSDEEP TLSH

        internal-keys

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/.crashlytics.v3/7e1ced77f03d8084c17fdc34b5d9cdfe4b02e8a5/open-sessions/6A7FA3AA02B7000113CEE0424C5D5B39/internal-keys
        • Size 207B
        • SHA256 4db42285eaa3696a27c8769850cad741bd168770b9a60b36d9195a7416046a7d
        • MD5 SHA1 SHA512 TLSH

        report

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/.crashlytics.v3/7e1ced77f03d8084c17fdc34b5d9cdfe4b02e8a5/open-sessions/6A7FA3AA02B7000113CEE0424C5D5B39/report
        • Size 850B
        • SHA256 2a2f9f7b5a8bc06d1eaafcbd6857e9325bafaf44ae7740157738ec95db38213a
        • MD5 SHA1 SHA512 TLSH

        userlog

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/.crashlytics.v3/7e1ced77f03d8084c17fdc34b5d9cdfe4b02e8a5/open-sessions/6A7FA3AA02B7000113CEE0424C5D5B39/userlog
        • Size 792B
        • SHA256 b61fbfc37648023a18db2b6554599a220ed92b02e81ad73ab10a0dc6f787f6a1
        • MD5 SHA1 SHA512 TLSH

        userlog.tmp

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/.crashlytics.v3/7e1ced77f03d8084c17fdc34b5d9cdfe4b02e8a5/open-sessions/6A7FA3AA02B7000113CEE0424C5D5B39/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        PersistedInstallation2665718629930108197tmp

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/PersistedInstallation2665718629930108197tmp
        • Size 90B
        • SHA256 9c28d1c09488c14533ef35283d410ed43d3a90f822db0d7b30417c4886911b29
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation4247235226935681834tmp

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/PersistedInstallation4247235226935681834tmp
        • Size 568B
        • SHA256 4b8aa7826653d700f0960f16db06b2037079a8b55bb1aeebf2e9cc9e896c7355
        • MD5 SHA1 SHA512 TLSH

        classes.dex

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/classes.dex
        • Size 5.2MB
        • SHA256 215dbef81a8373f008ab324db1d90458ccd44273b3621c331fa1f42374b6a70a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        firebase_session_dm9pY2VjaGFuZ2VyLnZvaWNlZWZmZWN0cy5zb3VuZGVmZmVjdHMudm9pY2VhdmF0YXI=_data.preferences_pb.tmp

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/datastore/firebase_session_dm9pY2VjaGFuZ2VyLnZvaWNlZWZmZWN0cy5zb3VuZGVmZmVjdHMudm9pY2VhdmF0YXI=_data.preferences_pb.tmp
        • Size 50B
        • SHA256 520106c9e82fd181351ecb7b04a69746f54acabc02c36a24dc1d5f16120f2788
        • MD5 SHA1 SHA512 TLSH

        firebase_session_dm9pY2VjaGFuZ2VyLnZvaWNlZWZmZWN0cy5zb3VuZGVmZmVjdHMudm9pY2VhdmF0YXI=_settings.preferences_pb.tmp

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/datastore/firebase_session_dm9pY2VjaGFuZ2VyLnZvaWNlZWZmZWN0cy5zb3VuZGVmZmVjdHMudm9pY2VhdmF0YXI=_settings.preferences_pb.tmp
        • Size 33B
        • SHA256 a4aaa2a4e0cb12123b405a9d33bdd7edf8cbb41ea92e75deb1ba21bf1db5b2a6
        • MD5 SHA1 SHA512

        firebase_session_dm9pY2VjaGFuZ2VyLnZvaWNlZWZmZWN0cy5zb3VuZGVmZmVjdHMudm9pY2VhdmF0YXI=_settings.preferences_pb.tmp

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/datastore/firebase_session_dm9pY2VjaGFuZ2VyLnZvaWNlZWZmZWN0cy5zb3VuZGVmZmVjdHMudm9pY2VhdmF0YXI=_settings.preferences_pb.tmp
        • Size 75B
        • SHA256 1e58e88b20702d0a80025c1fbacc9ad5fe2565311e2230d581d669fbd7e8b0ef
        • MD5 SHA1 SHA512 TLSH

        firebase_session_dm9pY2VjaGFuZ2VyLnZvaWNlZWZmZWN0cy5zb3VuZGVmZmVjdHMudm9pY2VhdmF0YXI=_settings.preferences_pb.tmp

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/datastore/firebase_session_dm9pY2VjaGFuZ2VyLnZvaWNlZWZmZWN0cy5zb3VuZGVmZmVjdHMudm9pY2VhdmF0YXI=_settings.preferences_pb.tmp
        • Size 121B
        • SHA256 232f9626cbee2e063e25f61a08f46575d019b62f02a6753c1325957a95e1c513
        • MD5 SHA1 SHA512 TLSH

        firebase_session_dm9pY2VjaGFuZ2VyLnZvaWNlZWZmZWN0cy5zb3VuZGVmZmVjdHMudm9pY2VhdmF0YXI=_settings.preferences_pb.tmp

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/datastore/firebase_session_dm9pY2VjaGFuZ2VyLnZvaWNlZWZmZWN0cy5zb3VuZGVmZmVjdHMudm9pY2VhdmF0YXI=_settings.preferences_pb.tmp
        • Size 163B
        • SHA256 7495b9faf55ff02d0a2906ca3e3f4b356abd96e421815f9d07f893682da6eaf2
        • MD5 SHA1 SHA512 TLSH

        firebase_session_dm9pY2VjaGFuZ2VyLnZvaWNlZWZmZWN0cy5zb3VuZGVmZmVjdHMudm9pY2VhdmF0YXI=_settings.preferences_pb.tmp

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/datastore/firebase_session_dm9pY2VjaGFuZ2VyLnZvaWNlZWZmZWN0cy5zb3VuZGVmZmVjdHMudm9pY2VhdmF0YXI=_settings.preferences_pb.tmp
        • Size 212B
        • SHA256 0d15b43588dc3829b1aa3a6d920ee048006aa14853dba844482e53e7906d9de8
        • MD5 SHA1 SHA512 TLSH

        google_mobile_ads_flags.pb.tmp

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/datastore/google_mobile_ads_flags.pb.tmp
        • Size 2B
        • SHA256 27c24fcb8474773e2af799d0848495ff053272d33c432dc26277993df45c9276
        • MD5 SHA1 SHA512

        google_mobile_ads_inspector_settings.pb.tmp

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/files/datastore/google_mobile_ads_inspector_settings.pb.tmp
        • Size 38B
        • SHA256 353de673d0f7669f6d7fc05721ce4fb95828e87364a45216ed74d16544b5b9fc
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 2af80e154efb03ee91e3666c74cc1f5b06da6f81a0cdb56d3cc781e57b5ed671
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 3fa0e1bb71614da883abb8798704f3db519a6a8a800f32b280f4fd86de74e17a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/voicechanger.voiceeffects.soundeffects.voiceavatar/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 e065bdff5ff9a37039f5f00572bd6b6ea235748b654aee51e99df64e300598f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1785301552478.jar

        • Path /data/user/0/voicechanger.voiceeffects.soundeffects.voiceavatar/app_yqzdkcache/rbp/1785301552478.jar
        • Size 32KB
        • SHA256 81f3024096d175237039cab10bc0008042acb77f9f4cc44706ed847c8b8695b9
        • MD5 SHA1 SHA512 SSDEEP TLSH