Analysis

  • max time kernel
    121s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    17/08/2026, 04:38

General

  • Target
    8e5fa795072ebba12d16b2abf5e13a953fb1607d9fc04b1bfee26d5bd23dc77b.apk
  • Size 14.1MB
  • Sample260817-e9ljtatblf
  • SHA256 8e5fa795072ebba12d16b2abf5e13a953fb1607d9fc04b1bfee26d5bd23dc77b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 4 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.color.cool.wst
    1⤵
    • Checks if the Android device is rooted.
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4879
    • getprop ro.miui.ui.version.name
      2⤵
        PID:5043
      • getprop ro.build.version.emui
        2⤵
          PID:5145
        • getprop ro.build.version.opporom
          2⤵
            PID:5185
          • getprop ro.vivo.os.version
            2⤵
              PID:5204
            • getprop ro.smartisan.version
              2⤵
                PID:5223

            Network

                  MITRE ATT&CK Mobile v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  ApTridentEvent.db

                  • Path /data/data/com.color.cool.wst/databases/ApTridentEvent.db
                  • Size 28KB
                  • SHA256 bc6b59d7a04828f0436f92639da56a14c71b5184f974584019f242315f394cde
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  ApTridentEvent.db-journal

                  • Path /data/data/com.color.cool.wst/databases/ApTridentEvent.db-journal
                  • Size 512B
                  • SHA256 41999dbdaf651deb45dffcd811c6e2fb4144921455891d9465cf5934d7ff2cfe
                  • MD5 SHA1 SHA512

                  ApTridentEvent.db-journal

                  • Path /data/data/com.color.cool.wst/databases/ApTridentEvent.db-journal
                  • Size 8KB
                  • SHA256 f4f00b9dc64426303839025e09c8441e14048df04fb266662c1cfa03df93dc4e
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  ApTridentEvent.db-journal

                  • Path /data/data/com.color.cool.wst/databases/ApTridentEvent.db-journal
                  • Size 8KB
                  • SHA256 10e5a249c1eba06bb35c908705953f9a2468684d7a370d34a5696bf18d3db971
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  ApTridentEvent.db-journal

                  • Path /data/data/com.color.cool.wst/databases/ApTridentEvent.db-journal
                  • Size 20KB
                  • SHA256 887f7351f793d44f13fd989d4633dd2855009e6e4fb748f73ae0070a1f572eb1
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  ApTridentEvent.db-journal

                  • Path /data/data/com.color.cool.wst/databases/ApTridentEvent.db-journal
                  • Size 20KB
                  • SHA256 088955914bc3c80d331a550bc856e9b535bdf03b42bd648c393b761604e8e021
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  androidx.work.workdb

                  • Path /data/data/com.color.cool.wst/databases/androidx.work.workdb
                  • Size 4KB
                  • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
                  • MD5 SHA1 SHA512 TLSH

                  androidx.work.workdb-journal

                  • Path /data/data/com.color.cool.wst/databases/androidx.work.workdb-journal
                  • Size 512B
                  • SHA256 6418a45cf1529b92c31ae7c3efc4114e2402468d9dbbd438ae5e2f4a375610ab
                  • MD5 SHA1 SHA512

                  androidx.work.workdb-shm

                  • Path /data/data/com.color.cool.wst/databases/androidx.work.workdb-shm
                  • Size 32KB
                  • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
                  • MD5 SHA1 SHA512 SSDEEP

                  androidx.work.workdb-wal

                  • Path /data/data/com.color.cool.wst/databases/androidx.work.workdb-wal
                  • Size 16KB
                  • SHA256 f855e4e55d52243b0bd65b3acef5ab58f562a6667493ad9c0ed3dccbbbc1977b
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  androidx.work.workdb-wal

                  • Path /data/data/com.color.cool.wst/databases/androidx.work.workdb-wal
                  • Size 88KB
                  • SHA256 51f23902b172788498fc1c777216d3f70014dd8689aff0f500b316fd13b734b2
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  bugle_db

                  • Path /data/data/com.color.cool.wst/databases/bugle_db
                  • Size 104KB
                  • SHA256 78298f2bd326ee539fd7cbfeb2fa1f94b84afdb3acdff223a6cb30663e791231
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  bugle_db-journal

                  • Path /data/data/com.color.cool.wst/databases/bugle_db-journal
                  • Size 512B
                  • SHA256 29df3b439f99d3d3e0d3028ce23bea64f730d1b41dd1a342ec92968eab7c2246
                  • MD5 SHA1 SHA512

                  bugle_db-journal

                  • Path /data/data/com.color.cool.wst/databases/bugle_db-journal
                  • Size 8KB
                  • SHA256 c328da201e0700a0f9bf93bfde95378644262bcfb52925ac234126a789673fa7
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  bugle_db-journal

                  • Path /data/data/com.color.cool.wst/databases/bugle_db-journal
                  • Size 8KB
                  • SHA256 12be0917895a5d1802e25dfde1240ad32e5557200bd1e4ab636f960e1c679c05
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  com.google.android.datatransport.events

                  • Path /data/data/com.color.cool.wst/databases/com.google.android.datatransport.events
                  • Size 40KB
                  • SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  com.google.android.datatransport.events-journal

                  • Path /data/data/com.color.cool.wst/databases/com.google.android.datatransport.events-journal
                  • Size 8KB
                  • SHA256 da79905a769555c6b1d5a7f20329804334124d10f661527ab8ac15d8e295b826
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  com.google.android.datatransport.events-journal

                  • Path /data/data/com.color.cool.wst/databases/com.google.android.datatransport.events-journal
                  • Size 8KB
                  • SHA256 0efa30510f800780814cd3ca12dedea8b920db1d7d332b5fe009214f9ae0663f
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  com.google.android.datatransport.events-journal

                  • Path /data/data/com.color.cool.wst/databases/com.google.android.datatransport.events-journal
                  • Size 512B
                  • SHA256 288162451b214d15f43e1ca9b61f1cf6e14267d63205f7f405864e8ee958e0ea
                  • MD5 SHA1 SHA512

                  google_app_measurement_local.db

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db
                  • Size 16KB
                  • SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db
                  • Size 16KB
                  • SHA256 3466ba0673f1fe860fa63f6c54a30aa4c83f88d7cc39b0fb09c75e449bca69af
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db
                  • Size 16KB
                  • SHA256 a6571b8f4a0cfaf944bbddf0c7de4f51bf1f354fa4a4ac46fc940c2759fc0453
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db
                  • Size 16KB
                  • SHA256 a3247a0737ccaf979c8a7123d8199db093b942b90c4f6a535618876c7d2866ab
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db
                  • Size 16KB
                  • SHA256 4702404199841a4e2caa3003efc7f2fd86491b30cab12e59530d75e1ae08c135
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db
                  • Size 16KB
                  • SHA256 bd68f1459788c267e41e8d92898df507db0413e0025ffe686a43344d600d61df
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db-journal

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db-journal
                  • Size 512B
                  • SHA256 58799e07a1dc5162f656aafe6277189b6ef243e440dabbb58130705afa2f6b48
                  • MD5 SHA1 SHA512

                  google_app_measurement_local.db-journal

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db-journal
                  • Size 8KB
                  • SHA256 2eafdb159f51ada606551c43fc7eb67214ee6effffd5b8334ccb9e5eca68b150
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db-journal

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db-journal
                  • Size 4KB
                  • SHA256 298aed812938d3cb8dab0c62096aad6f43d09f737516513723024ba317f65e94
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db-journal

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db-journal
                  • Size 8KB
                  • SHA256 342c07128a0b0f546c970d238949d4dafa23e933ac8d6026b9c29f5ec7383e55
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db-journal

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db-journal
                  • Size 8KB
                  • SHA256 e199ba9d9f086018090156d32ff0489f4619008152b7ed5f3181881722672999
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  google_app_measurement_local.db-journal

                  • Path /data/data/com.color.cool.wst/databases/google_app_measurement_local.db-journal
                  • Size 8KB
                  • SHA256 32829bd44fb61fba4d88e3de04eaaf21cefb03e8ad99d349cca0c7f5a4d74d16
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  .Library_message-emoji-config_RemoteConifg.sa.temp

                  • Path /data/data/com.color.cool.wst/files/.Library_message-emoji-config_RemoteConifg.sa.temp
                  • Size 1KB
                  • SHA256 2d4a6c0b5fe23312986af075ddb2200116a0cee1502239f937347ecd1260e1c5
                  • MD5 SHA1 SHA512 TLSH

                  crashlytics-userlog-6A82904B02B10001130FDD256D481910.temp

                  • Path /data/data/com.color.cool.wst/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-6A82904B02B10001130FDD256D481910.temp
                  • Size 488B
                  • SHA256 90fb04eb5528f710b3f11ec64233200e3fea999151718d7c9f1bd96996de5715
                  • MD5 SHA1 SHA512 TLSH

                  crashlytics-userlog-6A82904B02B10001130FDD256D481910.temp.tmp

                  • Path /data/data/com.color.cool.wst/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-6A82904B02B10001130FDD256D481910.temp.tmp
                  • Size 16B
                  • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
                  • MD5 SHA1 SHA512

                  report

                  • Path /data/data/com.color.cool.wst/files/.com.google.firebase.crashlytics/report-persistence/sessions/6A82904B02B10001130FDD256D481910/report
                  • Size 750B
                  • SHA256 2b217f3e480dcdd1c8a8e1c9d099bef52c73972d48d233b97ba9d932fb2034f7
                  • MD5 SHA1 SHA512 TLSH

                  PersistedInstallation1021673275199770980tmp

                  • Path /data/data/com.color.cool.wst/files/PersistedInstallation1021673275199770980tmp
                  • Size 114B
                  • SHA256 d56b99e7f9a6eeb4ad85a0587aa792374e2bc15fa17ce69d98d9847dbfe63ebc
                  • MD5 SHA1 SHA512 TLSH

                  PersistedInstallation281176620534125424tmp

                  • Path /data/data/com.color.cool.wst/files/PersistedInstallation281176620534125424tmp
                  • Size 90B
                  • SHA256 a24f9642d0260110e5e352158992d7ad6b166d6cb5ef6f8e0d40824c62b13356
                  • MD5 SHA1 SHA512 TLSH

                  alerts.sa.temp

                  • Path /data/data/com.color.cool.wst/files/alerts.sa.temp
                  • Size 111B
                  • SHA256 a824bc7739e226e1b40ea0f8c4e4f4c6f796fc3b4abfa6e9abe3bd119a30d938
                  • MD5 SHA1 SHA512 TLSH