Analysis

  • max time kernel
    3s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    17/08/2026, 05:10

General

  • Target
    91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3.apk
  • Size 3.3MB
  • Sample260817-ft54ystyfv
  • SHA256 91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • ir.shz.shzkisi
    1⤵
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    PID:4715
    • ping -c 2 -W 10 -v google.com
      2⤵
        PID:4770

    Network

          MITRE ATT&CK Mobile v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ~test.test

          • Path /data/user/0/ir.shz.shzkisi/cache/~test.test
          • Size 4B
          • SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
          • MD5 SHA1 SHA512

          google_app_measurement_local.db

          • Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 8e22fa7af9ed41dcaf9e1d4f7dfe12333fb943402c472278db0f10d02cb5b5f2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          google_app_measurement_local.db

          • Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 1ca82c03a73cbf2277b37775e935f3abe08c7d7729152b85c3770f461708f790
          • MD5 SHA1 SHA512 SSDEEP TLSH

          google_app_measurement_local.db

          • Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 6b02ccda39dd700e424d9d4689ab4f4251b21d5c108f8ba341c26b0b9c88a776
          • MD5 SHA1 SHA512 SSDEEP TLSH

          google_app_measurement_local.db

          • Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 e8249b135c03145dba7ef6af34ae47bd1c850f017e830d1aff70b558148983a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          google_app_measurement_local.db

          • Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 29110e626f8f49171d14a819b34492d094120f21ed7a963007fe95439d771d39
          • MD5 SHA1 SHA512 SSDEEP TLSH

          google_app_measurement_local.db

          • Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          google_app_measurement_local.db-journal

          • Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
          • Size 8KB
          • SHA256 e73b268709c39749f2fc78fd5a768944967e7c2e2ab4141e9aa2d0d083489aef
          • MD5 SHA1 SHA512 SSDEEP TLSH

          google_app_measurement_local.db-journal

          • Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
          • Size 8KB
          • SHA256 ba68d99bb9063bdb51250a1baad6ea2d00db19156a362b6735c341ecbb76cd94
          • MD5 SHA1 SHA512 SSDEEP TLSH

          google_app_measurement_local.db-journal

          • Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
          • Size 512B
          • SHA256 fc7df38beadb44a0ea1fa24ad4514b2a7a0d2481810dd68e696199fc57a74f0c
          • MD5 SHA1 SHA512

          google_app_measurement_local.db-journal

          • Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
          • Size 8KB
          • SHA256 e1cdcd4e35f2e114897048c5075c8940a7acc94252f13b8dbd6581a0eed303ba
          • MD5 SHA1 SHA512 SSDEEP TLSH

          google_app_measurement_local.db-journal

          • Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
          • Size 4KB
          • SHA256 67e7bc9b26573b61ff2e6e771b58413d5d895b5b5b0b82fc05bf0fc405ad3f05
          • MD5 SHA1 SHA512 SSDEEP TLSH

          google_app_measurement_local.db-journal

          • Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
          • Size 8KB
          • SHA256 fcd3e88acfaa5804cc0a17982767c02bd1edb3415caed15e67b5b3c108d19103
          • MD5 SHA1 SHA512 SSDEEP TLSH

          PersistedInstallation4926054233582443939tmp

          • Path /data/user/0/ir.shz.shzkisi/files/PersistedInstallation4926054233582443939tmp
          • Size 90B
          • SHA256 e1bb9116f568b04a8f0f72f6fded7a6a9a47734f56e8005eebdb75da2b7384ac
          • MD5 SHA1 SHA512 TLSH

          PersistedInstallation7508287701023567456tmp

          • Path /data/user/0/ir.shz.shzkisi/files/PersistedInstallation7508287701023567456tmp
          • Size 570B
          • SHA256 4f06270bde9f9f5687a887f767564a8d73af467f74031e64adc87aa0091c1dab
          • MD5 SHA1 SHA512 TLSH