Analysis

  • max time kernel
    122s
  • max time network
    153s
  • platform
    android-10_x64
  • resource
    android-x64-20260325-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
  • submitted
    17/08/2026, 04:38

General

  • Target
    8e5fa795072ebba12d16b2abf5e13a953fb1607d9fc04b1bfee26d5bd23dc77b.apk
  • Size 14.1MB
  • Sample260817-e9ljtatblf
  • SHA256 8e5fa795072ebba12d16b2abf5e13a953fb1607d9fc04b1bfee26d5bd23dc77b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 4 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.color.cool.wst
    1⤵
    • Checks if the Android device is rooted.
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:5050
    • getprop ro.miui.ui.version.name
      2⤵
        PID:5234
      • getprop ro.build.version.emui
        2⤵
          PID:5327
        • getprop ro.build.version.opporom
          2⤵
            PID:5356
          • getprop ro.vivo.os.version
            2⤵
              PID:5411
            • getprop ro.smartisan.version
              2⤵
                PID:5441

            Network

                  MITRE ATT&CK Mobile v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  ApTridentEvent.db

                  • Path /data/data/com.color.cool.wst/databases/ApTridentEvent.db
                  • Size 28KB
                  • SHA256 de1a51a22d1c9c9d4e5c42ab2922151095f0d29d8c6d54b7a3519d7ab7a61c61
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  ApTridentEvent.db-journal

                  • Path /data/data/com.color.cool.wst/databases/ApTridentEvent.db-journal
                  • Size 512B
                  • SHA256 3e112c8debda9047ee8d45fe18dd1b5ee3d91dcd457a79cd8c76311656ac916a
                  • MD5 SHA1 SHA512

                  ApTridentEvent.db-journal

                  • Path /data/data/com.color.cool.wst/databases/ApTridentEvent.db-journal
                  • Size 8KB
                  • SHA256 89514cf716abb5275c0d4f5329e7d20157abc54a3842dcf6ee6a9a70ad6c4757
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  ApTridentEvent.db-journal

                  • Path /data/data/com.color.cool.wst/databases/ApTridentEvent.db-journal
                  • Size 8KB
                  • SHA256 cb3523a785868087c5b7188fba884f4d8c05d30a20e89cc083d8411ec308f883
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  ApTridentEvent.db-journal

                  • Path /data/data/com.color.cool.wst/databases/ApTridentEvent.db-journal
                  • Size 20KB
                  • SHA256 1e9c8e1739a05da8bcc9ee5bfbf0ea66722fc326f596465baa84c452f5c7bb04
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  ApTridentEvent.db-journal

                  • Path /data/data/com.color.cool.wst/databases/ApTridentEvent.db-journal
                  • Size 20KB
                  • SHA256 b13a1ac4c5d00942eec1b3c61f1480cda94d1bdd1759467fc68dce4b3120ec43
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  androidx.work.workdb

                  • Path /data/data/com.color.cool.wst/databases/androidx.work.workdb
                  • Size 4KB
                  • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
                  • MD5 SHA1 SHA512 TLSH

                  androidx.work.workdb-journal

                  • Path /data/data/com.color.cool.wst/databases/androidx.work.workdb-journal
                  • Size 512B
                  • SHA256 34015b0adb8c1dd21f36767b9cf6adcae96ac85f19cd890037b8e0c42d71f11c
                  • MD5 SHA1 SHA512

                  androidx.work.workdb-shm

                  • Path /data/data/com.color.cool.wst/databases/androidx.work.workdb-shm
                  • Size 32KB
                  • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
                  • MD5 SHA1 SHA512 SSDEEP

                  androidx.work.workdb-wal

                  • Path /data/data/com.color.cool.wst/databases/androidx.work.workdb-wal
                  • Size 16KB
                  • SHA256 262a1d9cdeb3711fbd2086a82a52108be3eb47d29108ce52918b51d42be64829
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  androidx.work.workdb-wal

                  • Path /data/data/com.color.cool.wst/databases/androidx.work.workdb-wal
                  • Size 88KB
                  • SHA256 7d484582b2c733f28e4cab33f6d06d03f62169db0e0dd5a5aed1c0734b1b2401
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  bugle_db

                  • Path /data/data/com.color.cool.wst/databases/bugle_db
                  • Size 104KB
                  • SHA256 c0b63067ee6892bb8af3540ffd774aa242578024fe2521bc4509aaca77cf54b0
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  bugle_db-journal

                  • Path /data/data/com.color.cool.wst/databases/bugle_db-journal
                  • Size 512B
                  • SHA256 da84a2813503f2257915f2069c0e0823b3610561e6211417dd4813a2e2236696
                  • MD5 SHA1 SHA512

                  bugle_db-journal

                  • Path /data/data/com.color.cool.wst/databases/bugle_db-journal
                  • Size 8KB
                  • SHA256 c5fbf6563b8df68980431aeba835485847d642a0ab39c1dcbccde924db65b1e9
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  bugle_db-journal

                  • Path /data/data/com.color.cool.wst/databases/bugle_db-journal
                  • Size 8KB
                  • SHA256 e60cd47f58b434c20c8c38b6419bfebe640be82e486a578baea81c0a468fcd0f
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  com.google.android.datatransport.events

                  • Path /data/data/com.color.cool.wst/databases/com.google.android.datatransport.events
                  • Size 40KB
                  • SHA256 e802fdc1ccd833b91d80bb1d8f54cab2b585393e6a07622c4d9feaab07633370
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  com.google.android.datatransport.events-journal

                  • Path /data/data/com.color.cool.wst/databases/com.google.android.datatransport.events-journal
                  • Size 512B
                  • SHA256 b0a0798eae186c0c32b6388deb2d3ba2be19ba7a4ffd28a1e0d662b80e8dcb10
                  • MD5 SHA1 SHA512

                  com.google.android.datatransport.events-journal

                  • Path /data/data/com.color.cool.wst/databases/com.google.android.datatransport.events-journal
                  • Size 8KB
                  • SHA256 eb90884a85ee99f97316aee519b214c1e68a829e8c670ac74522873b43ba8037
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  com.google.android.datatransport.events-journal

                  • Path /data/data/com.color.cool.wst/databases/com.google.android.datatransport.events-journal
                  • Size 8KB
                  • SHA256 c2b33fa0c9d220629c2cc86de5e5b8f7c87fc274876e1ab0fdd5c8dac869b26e
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db
                  • Size 16KB
                  • SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db
                  • Size 16KB
                  • SHA256 305ecc80fd6120fffa6fbd08fae9f4ff8cdf42775d5b31a72e6e32d786608a45
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db
                  • Size 16KB
                  • SHA256 f45e8ca8a0eb5421d2b81eb187fc97763f9c2e5260f78497e47b73297a2cfce2
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db
                  • Size 16KB
                  • SHA256 2e3358ec51807279c9a454f272868a35e5c87fafd7d6b8006d0e76c4e285fa7e
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db
                  • Size 16KB
                  • SHA256 504b6606ff4a6f40835aa3657d2236157798698447ce5bbef8b795e55ea2d7bc
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db
                  • Size 16KB
                  • SHA256 02aab80d440391c1d8dded776080b8ea2894bb23166e2d53e596d17d3eff4c18
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db-journal

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db-journal
                  • Size 512B
                  • SHA256 ac45b07531683d9594cca4a542cbf7cd1703a1de892be474cac4da8720f1d5c0
                  • MD5 SHA1 SHA512

                  google_app_measurement_local.db-journal

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db-journal
                  • Size 8KB
                  • SHA256 cc7ff03a8a1a86deda340b2a3909b3858a16e1d5f9ba8416aef104c69302bcff
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db-journal

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db-journal
                  • Size 4KB
                  • SHA256 31a0f7c4bbc9ad21d30e7c23dae06d4c0b7f7d0a38616b03e50f7dd184416099
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db-journal

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db-journal
                  • Size 8KB
                  • SHA256 321ad054b2c8606a4041b46bc68775cebbb7b74c838d070442a6c1a32d62fecf
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db-journal

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db-journal
                  • Size 8KB
                  • SHA256 a62671491eee9ffae0b24162e2e4d763fbe8047f0394036e0532c5db3466a82c
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db-journal

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db-journal
                  • Size 8KB
                  • SHA256 bc51bfb60a97d912830cd2a9999d1f08a9d10f3a6279a2934a375c4dfacb43c4
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  .Library_message-emoji-config_RemoteConifg.sa.temp

                  • Path /data/data/com.color.cool.wst/files/.Library_message-emoji-config_RemoteConifg.sa.temp
                  • Size 1KB
                  • SHA256 2d4a6c0b5fe23312986af075ddb2200116a0cee1502239f937347ecd1260e1c5
                  • MD5 SHA1 SHA512 TLSH

                  crashlytics-userlog-6A82904C01C6000113BA9CD265E0EACB.temp

                  • Path /data/data/com.color.cool.wst/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-6A82904C01C6000113BA9CD265E0EACB.temp
                  • Size 490B
                  • SHA256 3b5e2499ce49f6a042245151bdb0a0de52f04e7ec54fc221286e2eecf362c505
                  • MD5 SHA1 SHA512 TLSH

                  crashlytics-userlog-6A82904C01C6000113BA9CD265E0EACB.temp.tmp

                  • Path /data/data/com.color.cool.wst/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-6A82904C01C6000113BA9CD265E0EACB.temp.tmp
                  • Size 16B
                  • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
                  • MD5 SHA1 SHA512

                  report

                  • Path /data/data/com.color.cool.wst/files/.com.google.firebase.crashlytics/report-persistence/sessions/6A82904C01C6000113BA9CD265E0EACB/report
                  • Size 750B
                  • SHA256 47097f9eb1b46ab9b561ea3255c3c8cde7afbec2d3ea23a1a01b398d0d74128b
                  • MD5 SHA1 SHA512 TLSH

                  PersistedInstallation1422026385189160851tmp

                  • Path /data/data/com.color.cool.wst/files/PersistedInstallation1422026385189160851tmp
                  • Size 114B
                  • SHA256 ea0d0c9c26ea397442595e6342874d60867b2b1e85423b0bbe4c54d5f9cc2da7
                  • MD5 SHA1 SHA512 TLSH

                  PersistedInstallation6489558797215594728tmp

                  • Path /data/data/com.color.cool.wst/files/PersistedInstallation6489558797215594728tmp
                  • Size 90B
                  • SHA256 3d8e217252e15c498a49408cd547cf8b930e9474bea390d298cb1e8a3f38c87c
                  • MD5 SHA1 SHA512 TLSH

                  alerts.sa.temp

                  • Path /data/data/com.color.cool.wst/files/alerts.sa.temp
                  • Size 111B
                  • SHA256 a824bc7739e226e1b40ea0f8c4e4f4c6f796fc3b4abfa6e9abe3bd119a30d938
                  • MD5 SHA1 SHA512 TLSH