91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3 | Triage™

Analysis

max time kernel
3s
max time network
153s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
17/08/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3.apk
Size 3.3MB
Sample260817-ft54ystyfv
SHA256 91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3
MD5 871d021d89e2c1f08d2ee8da43aef4f7
SHA1 7941b06247ec6e4faefcf5dbb371c5dc61b5666e
SHA512 29a8d38d0ecaddcf5cbabd562d7a63edf126453c3f686ac0cb1f881b48ee84e7500dc20e51c3c148d71cc703e4958d24120dcdd05d7f98b3de1d98521769cd3d
SSDEEP 98304:QEVF6aL7fDW3v0AMYfccAe2pwFT0rIU3B8jtC8ikX:Q46x3vKcAXGTnUqjskX
TLSH
T18AF533137E67C530E893E83D84F0A2B4CCB596B88908BF515996568E0DF3E467E03DB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ir.shz.shzkisi

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	ir.shz.shzkisi

Queries information about active data network 1 TTPs 1 IoCs

System Network Connections Discovery

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ir.shz.shzkisi

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Broadcast Receivers

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ir.shz.shzkisi

ir.shz.shzkisi
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5055
- ping -c 2 -W 10 -v google.com
  2⤵
  PID:5108

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Credential Access

Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~test.test

Path /data/data/ir.shz.shzkisi/cache/~test.test
Size 4B
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db
Size 16KB
SHA256 1ba14ac3efbdae4a4ba1c9c02a441cfa802e30b45253890e118088248a7367c0
MD5 8c113e5ab965f0a8a4b060be942c3dd5
SHA1 a18c64a92b867a06941da26bf96a49993cdb4aa9
SHA512 772fd7120c2b9d2bc56b0d06a0a8597163ddecb767774e82a5d3e2e00b81755fe467e8d315f65f2c58490634b6c7cb604e8adb48f922099e2422e74f16702717
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6Ug6:TLiEy9zmzrfRmBEyPbP/P+/0Fl6UgS7
TLSH
T183726FCDBA106B03D2774776B0CF93E22C30A2188333DA1BBB581468AC42688A082F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db
Size 16KB
SHA256 e654f0085f3e03ee7d718cdfa977aff7a9bb755526632e5852c02fae2944cb85
MD5 ba54805ed4c8a294b12d44b00b440eb9
SHA1 029051e14e9c4636b87c9e95ef19ba7c50669403
SHA512 a5c80f47c41c31cf2af932236458a440c23028af543d9d074745a43ba89d1185bc7d1972aa101770f7b7e1d1e932413a8ab6a228f240f91895eaeed4f436c57d
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFlzy+/0Fl6UgS7:TLQpmzr0GSP/h1499FAlFTT
TLSH
T1EF72E999BA109B47E2774B3570CBD3E26C3472299723D6177E152A2C6D427C55052F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db
Size 16KB
SHA256 785644c0062f40c4d34e3812da3a9b31cf5174fd013145499691e5412b1fb5d6
MD5 35be0ed369f820a393bffeb264780a2a
SHA1 d84e3c6d08d032af87843f4481d414b3e32dadd7
SHA512 9bbddb91ef6d41366fbe6399a05326f299d03ccb1c4129cfacad9c675c2156f89d104a3d4b7da66eb8f77857748b665cad47602acb520dbfb2cd5f06d31222e1
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/9FAiOLauK/6AUvkWlFG+W49blqYFlzy+/0Fl6UgS7:TLEvpmzr0GSP/9PKary5tSf499FAlFTT
TLSH
T1B7724999BA64DA07F2774B3960CBD7E22C38326A5733D6177E063B2C6C427C18121F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db
Size 16KB
SHA256 84e0b9fe4256564263c4f3c29e55eea55e7e12b4d9e4f54c9724441a6917fb90
MD5 9d2752d1e558355a6e937fbacd3eb655
SHA1 ec82fb86fb268f8817505f0b9ebd0abb273fdcda
SHA512 621d75b66d6250f33ddf9b9a097de6b87b921cd8ae1d9950f2b9b0ba70a6196b08e6b9140504557f0c208c58c8e1fddbc64d10daeeb7d951fc854e2d977ffca2
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/sFAiOLauK/6AUvkWlFG+W49blqYFlzy+/0Fl6UgSv:TL6Xpmzr0GSP/sPKary5tSf499FAlFT3
TLSH
T1357226D9BA64DA03F2774B3960CBD3E22D38326A4723D6177E0A3B2C6C427C18021F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db
Size 16KB
SHA256 252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9
MD5 adf6082723784327d7d1b34adf974e7d
SHA1 b1502f70eb881a1dfe41139cb719fefb877ee37c
SHA512 762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b
SSDEEP 6:l9bNFlgls1qlvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W:TLuEev9zmzrfRmBEyPbP/W
TLSH
T1AB722B8E9F102603C67307B3B4CE93516E14A22DC3779E472BAC0474AD83449B051F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
TLSH
T11F727DCEDF002202C1360733F4C9D3901D60921D8336DA0767940460AD02108A451F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 fc2116bd07cf5a684aa4f0dfc3beeef6f4f0961c51b4a5d3d306b4bdca47e7a4
MD5 fe1719e6c57f01ffc5ce154636957f5e
SHA1 d45ce05bd04a50ce45d34ec1c2810266551e7d1f
SHA512 85d5ec075cd513123721f80f2d0c67dd688f86c7ef1149edc6fac896a2639ee8fd8de26d122f8eace02f9c1688aa1bba90968d8237be36809a56f0d1658b691b
SSDEEP 6:7+/l9b673pg9bNFluls1EhlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuKH:7+t5673pqL8EEh9zmzrfRmBEyPbA
TLSH
T1A202728D8F102203C13B0773B8CB83402C28A219837B9E732AA40474EF031489091FA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 f582e61f5d6f90197ff44a83b49c177916f455e54a1238183fd5957c827f0e73
MD5 d571478016c322b8c8cac80b61ac8838
SHA1 96904fd64ab1e99475f9bdde354fe12bf90e69bf
SHA512 d7d87ae1c1b4a84bc9419767105218809e92e9a3bb9cc6c0b75b42e499adf6f69922fea1d40f77123e236b6a63837d16355a3af839507edd1c7b3e5d46e255e0
SSDEEP 24:7+tshoPKary5tSf499FAlFTkRqL6Xpmzr0GS8:7MFSaryz15kTEq2XArS8
TLSH
T1750247D9BA24DA13F23B4B3960DBD3D13D3832664723E6177A052B2C2C427C18061F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 b36f5ecdd65e530d16de6ba2d742df90830f253d44cb89dbc14a41c6e2e6b64b
MD5 97f594731e7fb48e0f665c878a3b0663
SHA1 bf4f6bb3367a4cd656fc31f149ff62fe46b9976f
SHA512 74713264a3cfd026add9da62c09965bb3ed0b5831c045bf67e2de8578df726bca3a66120ed17c087a9557deb879d0cacc6c917436132155db736c0e35520e702
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db-journal

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 95949bef9f7f41cf8d8b06818b0e2d67bccac61a4bb869a4e723db5683a5bd46
MD5 c3baa3b19612d9f9820463d43304e2d4
SHA1 01ea9c7b96ccc399c48c054ba314cdc01ab042b2
SHA512 3a20cbcca3b2d980efeb88817abbe7c2908a6c8cb917cf054b179213f01c171a539d0f6ca8c551da54a84fede0d45375246d48dc7b5b64eb2de3be0a89a32c77
SSDEEP 6:7+/l9HLOn1qIvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKen:7+tlL2qLiuWdwRmBEyPbZn
TLSH
T10F022289A3C008A2CC1926BB90E583540D00EB198161CB0B57A008A83C038CCE4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
Size 4KB
SHA256 f4d85c3863c0aac6d3004f8e289a610598e5da87c16b8178dadbd80ce84b9f70
MD5 794b664cf57edbe983cc65e82f0b4c51
SHA1 b21f7700f51f01038ad5f63db99f02f603ba081e
SHA512 fc029a15e07bada95a4c131f1783b816e7c0ec07735dcefbdb1226c005cf4bc8f44186e979c493dada0d23c67759396102e5e49e1998d711699c163c331abfa6
SSDEEP 6:7+/liKUHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKog:7+tipvqLJdTRmBEyPbe
TLSH
T10791809967410D13C51D5BB794D983551E51E715C373CB575F7009987C47ACCF8A0D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 8cfe92a5d48847560939241a1f4cfe4e1033675659b652740c44c464cbf63540
MD5 744c621a1c90e6565e580242e0532c73
SHA1 acfce0dd9457a3a654d99524e7a4151a5ed40d8b
SHA512 7b5fd2b743baa47ec15aeffb76765f09c250706d04a016dc158f20c3ff9bd276db99e193bec42ee14be482d29abaac8d69632b42358a0c37c5502e73242b3e15
SSDEEP 6:7+/l97StgPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKvtM/+:7+tHqLmqCRmBEyPbJ+
TLSH
T16202229963800C13C01D96B790C993401E80E314C229CB0B157008A83C424CCEC90D50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation193457513785905521tmp

Path /data/data/ir.shz.shzkisi/files/PersistedInstallation193457513785905521tmp
Size 569B
SHA256 2009499fb9bd758530a583391bc21c3930afd8f0b737a6a36d7bdcc96d4e0a51
MD5 506d711964fd8392e81cdbeb9074a5e3
SHA1 2d7c99b87be5c31764b0aa7bea8f16f746d113a4
SHA512 d3e625c2d46612c8770ebf45b86caf03841a9fa20dc0e6de929bf2ebbb36d1ca171ecd2ac6f66034b8c8b97229f3fe391d093c5bd82f214313b35eff38070af1
TLSH
T177F0265A2361D15AF97A65020E8EFC234E4441F0B19718C32F78D5D0C4D896BA243588
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation5261508476893177291tmp

Path /data/data/ir.shz.shzkisi/files/PersistedInstallation5261508476893177291tmp
Size 90B
SHA256 9420434a13e97f63198ce9ccd17019f3614147ea44270e135c1397daf89c1723
MD5 6cf0afdac57be4d07e64f388134758ec
SHA1 f3e10987a29e545ff99ee72755a3536ac257dff8
SHA512 9396d9cd9a7d7ceadf54cca1c6625a30b3e38beac605783791584a159b7934fe25274b5ca596e1683a96fb9be241369500a228605f1df719dbfa94477ca280fb
TLSH
T162B012804A714151D5D5B2021CCC91111E455440150D9E564B0CB04080891D2E10399C
MD5 SHA1 SHA512 TLSH

Submit Download