Analysis
- max time kernel
3s - max time network
151s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
17/08/2026, 05:10
Static task
static1
12 signatures
Behavioral task
behavioral1
Sample
91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3.apk
Resource
android-x86-arm-20260325-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3.apk
Resource
android-x64-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target 91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3.apk
- Size 3.3MB
- Sample260817-ft54ystyfv
- SHA256 91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3
- MD5 871d021d89e2c1f08d2ee8da43aef4f7
- SHA1 7941b06247ec6e4faefcf5dbb371c5dc61b5666e
- SHA512 29a8d38d0ecaddcf5cbabd562d7a63edf126453c3f686ac0cb1f881b48ee84e7500dc20e51c3c148d71cc703e4958d24120dcdd05d7f98b3de1d98521769cd3d
- SSDEEP 98304:QEVF6aL7fDW3v0AMYfccAe2pwFT0rIU3B8jtC8ikX:Q46x3vKcAXGTnUqjskX
- TLSH T18AF533137E67C530E893E83D84F0A2B4CCB596B88908BF515996568E0DF3E467E03DB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock ir.shz.shzkisi - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground ir.shz.shzkisi - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo ir.shz.shzkisi - Reads information about phone network operator. 1 TTPs
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/ir.shz.shzkisi/cache/~test.test
- Size 4B
- SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
- MD5 098f6bcd4621d373cade4e832627b4f6
- SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
- SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
- MD5 SHA1 SHA512
- Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db
- Size 16KB
- SHA256 8e22fa7af9ed41dcaf9e1d4f7dfe12333fb943402c472278db0f10d02cb5b5f2
- MD5 4399504c68be5dd36a7d93a0aa7c1f65
- SHA1 7394c8c88b0e77675a0c4ce010dd5ccca6cc4093
- SHA512 d05ed4522bbe6528ae127e41e251c24b1e627f6f8bb66a8dbaa6321aeafc6666bc1d7224bf76b0f7f34eb743fb7343b8581ed89ec562e0358c31eb6c3f8296c7
- SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6A:TLiEq9zmzrfRmBEyPbP/P+/0Fl6FS7
- TLSH T167726FCCBB106B03D2774736B0CF93E21C34A22C8333EA0B7B891428AD426C8A092F44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db
- Size 16KB
- SHA256 1ca82c03a73cbf2277b37775e935f3abe08c7d7729152b85c3770f461708f790
- MD5 f6df42a3d81471b2aa50416baed0c624
- SHA1 405287186c5f2f9c177ea3f89fdf90bdfbc61ef8
- SHA512 e10801466ae3681622450cac17ac78efb44771c9010b8f75e8ec51c51caee866a7e53e6af4739edd6c459124362bc2f958f139ae1dd75468c360b0dd2d1feb5f
- SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFlzM+/0Fl6FS7:TLopmzr0GSP/h1499F2lFJ
- TLSH T19172E999BA109707E2774B3570CBD3E26C3872299723D6177E462A2C6D427C55062F05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db
- Size 16KB
- SHA256 6b02ccda39dd700e424d9d4689ab4f4251b21d5c108f8ba341c26b0b9c88a776
- MD5 738c0ec01c348924589416db922e3ddc
- SHA1 f23c2c0c8e4df475fe7dde8704795b8d2f299344
- SHA512 9a24a94987a0e560446d1312fdacfa864bd325a3bcada15b06a91f75db236e0053f2a8ff8f634069cdf44d53952e430b66a1332182a809f0ece7f80952db64c4
- SSDEEP 12:TLIEU9zmzrfRmBEyPbP/9FAiOLauK/6AUvkWlixzW49blqYFlzM+/0Fl6FS7:TLYpmzr0GSP/9PKary5tYk499F2lFJ
- TLSH T12E724999BA64CA07F2774B3860CBE7E22C34326A4723E617BE063B1C6D427C58121F42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db
- Size 16KB
- SHA256 e8249b135c03145dba7ef6af34ae47bd1c850f017e830d1aff70b558148983a8
- MD5 d1bdd6929c363734eac531375f7f16f4
- SHA1 8aec1c745668188979d4127b64477aac36736d40
- SHA512 8e498c49175f0170b8bc67f5448e19970d6cd135e6622955adc192f8a14bb83124cf33d9caa2d2fc89000a2fbf112f1cd7abd89beb17f99b202cf348770cdb40
- SSDEEP 12:TL6uER9zmzrfRmBEyPbP/sFAiOLauK/6AUvkWlixzW49blqYFlzM+/0Fl6FSv:TL6vpmzr0GSP/sPKary5tYk499F2lFB
- TLSH T1A2722B99BA64CA12F2774B3960C7D3D22D34322A4723D6177E053F1C5D427C54021B01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db
- Size 16KB
- SHA256 29110e626f8f49171d14a819b34492d094120f21ed7a963007fe95439d771d39
- MD5 de82e2c94d2718988804b035a46d17b1
- SHA1 705f5ff19093ad209f2a666085d6ccaed3bf58a4
- SHA512 68f5f88e638e76cb5036dad6b320896f1735f64067ace152e0baea81e9ea0d153559f53bd5c608b397281369dafd14c5f5965f92f567dc89db157414a699023e
- SSDEEP 6:l9bNFlgls1WnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W:TLuEe9zmzrfRmBEyPbP/W
- TLSH T126722B8D9F102603C6730773B4CE93515E14622D83779E472BDD0470AD83449B051F84
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db
- Size 16KB
- SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
- MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
- SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
- SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
- SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
- TLSH T16D72C2CEDF102606C6760737F8CAE3A05DA4A22D833ADA476B950460AE42549A8A1F98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
- Size 8KB
- SHA256 e73b268709c39749f2fc78fd5a768944967e7c2e2ab4141e9aa2d0d083489aef
- MD5 da4ed00064a82eccc0dea80e05ce0d7c
- SHA1 b81d4b117df8d68beaf65688791df7b42a18539b
- SHA512 51400aeed13720d1881e3f46e5d63ae6b9c7639659284a2d244e58e410454bfcc2d3e757d18fe858e9a0b61033cdb82dcd35b2f8938c0767da512a731e397479
- SSDEEP 6:7+/l9VAgWg9bNFluls1EnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuKj:7+toqL8EA9zmzrfRmBEyPbI
- TLSH T1C802728D8F002223C13B1733B4CB83802C68622C83B79D832B940420AD438A99061F94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
- Size 8KB
- SHA256 ba68d99bb9063bdb51250a1baad6ea2d00db19156a362b6735c341ecbb76cd94
- MD5 9afb93c9382d58f020721258337d0ab7
- SHA1 94c4a55873f9f354385f7d5646cf5d2f119c5922
- SHA512 d9bfc7a6fe2ae568f9722c6f42fec84c7a563d263544a2ae383394975a72f6fae3a2d648e40f21d550c3af3bb3961de0572032a60957e8f0075cd6b55d970f9c
- SSDEEP 24:7+tDPKary5tYk499F2lFgfqL6vpmzr0GSC:7MDSaryzY95+gfq2vArSC
- TLSH T12102F799BA64CA13F2774B3960DBD3D13935322A4763E6177A063F1C6D427C58021B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
- Size 512B
- SHA256 fc7df38beadb44a0ea1fa24ad4514b2a7a0d2481810dd68e696199fc57a74f0c
- MD5 d81d977c3a0de521c3baab6751869cb9
- SHA1 4bbb6ce6275ffcc7988033395c05a8b1eb16244a
- SHA512 7149415bf38c7f2b82fd961b0a4eb7b3bab7335e1eddb3d21b6acdcd6d99531d86d7ef83940d704a379446ebfde6ce0aa66b6ac4048ecb2fe21585980959268f
- MD5 SHA1 SHA512
- Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
- Size 8KB
- SHA256 e1cdcd4e35f2e114897048c5075c8940a7acc94252f13b8dbd6581a0eed303ba
- MD5 e1481e3b12d329958f8553fbcf86a57d
- SHA1 bb8ee1d8d3306740d95b8075a5f4b0cd3c6f1cc8
- SHA512 c144420de9e65065cd7809000b1a0b0ab9e239270ff36c76d8e263603ad5acda0e6bab5b22c71b7bc87819b12b0f0c28acd5bdbd5d7d93db209d77a17da9feec
- SSDEEP 6:7+/l9kn1KEg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKk:7+tIqLiuWdYRmBEyPbj
- TLSH T11002228963800813C82D167794E6C3D01D08ABA8A161CB275690089C2C0B8CCE4E0E04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
- Size 4KB
- SHA256 67e7bc9b26573b61ff2e6e771b58413d5d895b5b5b0b82fc05bf0fc405ad3f05
- MD5 a9cbb3e8a3fe1fd4b513aa9e59f68705
- SHA1 f2f2ee2aefd219357274b4febc9f98726f9d734c
- SHA512 402d6119d502d099f368becdd3a49aaacc41a7cbb1d614b1115ac8c90824300429881e08b6cf6e4d1daf1f4f3c5c436e6f942b5ba3fa310d6fd7349c1d22debb
- SSDEEP 6:7+/lv/0FPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKyo:7+tH6qLJdeWRmBEyPbDo
- TLSH T1D091C08963800D03C4291F7BA0C583600D10772D9333CB17179108547C076CCE4D0D40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal
- Size 8KB
- SHA256 fcd3e88acfaa5804cc0a17982767c02bd1edb3415caed15e67b5b3c108d19103
- MD5 e1fd1ca8e0169a270a7b0cb8f2e35ba0
- SHA1 95cc7bc215ec6adb85df0889053b9401088fcdd8
- SHA512 c8b4bffa633f96ba37c3e706e1c38c07daf76371e76ef0f294f9f8214b7740f09e90468d711b1a27761c1b75f22caaed590d984d3d09496973627ea257fed6a7
- SSDEEP 6:7+/l91mFPg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuKuj8t/j:7+tsqLmqKRmBEyPbf41j
- TLSH T14202228863C00C03C02A1AB790C883400E20A3248121CB472BA108B82C068DCA8B0E80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/ir.shz.shzkisi/files/PersistedInstallation4926054233582443939tmp
- Size 90B
- SHA256 e1bb9116f568b04a8f0f72f6fded7a6a9a47734f56e8005eebdb75da2b7384ac
- MD5 2288c8aec7f7521b4955e243c6c22f85
- SHA1 22565307a8179aa3e88eb919fe7893fc65bd0f3b
- SHA512 5c253deaa3b14f55889e633e73a4f2ffb431267d95cf1502f55c71973360ba9fe6c174121477456658a450c87e2da7db8b3ec2fb52f1ba04e98b2402c06a26c9
- TLSH T114B012414E75A15188C5B7031D4CA1401E711840140B8F940E09E58280911D08143A99
- MD5 SHA1 SHA512 TLSH
- Path /data/user/0/ir.shz.shzkisi/files/PersistedInstallation7508287701023567456tmp
- Size 570B
- SHA256 4f06270bde9f9f5687a887f767564a8d73af467f74031e64adc87aa0091c1dab
- MD5 15e03aa489f09db07b1c3b35580c19a8
- SHA1 691def19ffda6ba90002e47340b0417853231caf
- SHA512 9ba9358ddbed7cd6b3c11348d0b5a2698b1aae3c26d0b2e66b66ba4b69b1568144b62b7352f30f7e84c8ff8a57a9dd318a03a4b4dedb35fcd5154c1e44fb92b4
- TLSH T1DBF0200BA77A460CDCD89703169E7C204E1115D595B308E97FEBC630EAF2ABDA18B089
- MD5 SHA1 SHA512 TLSH