Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    17/08/2026, 14:51

General

  • Target
    CHACAL.apk
  • Size 58.3MB
  • Sample260817-r789basepa
  • SHA256 36506b6fffe0cbc965c714b902f3cd4217909e155e1f1d096e701dadc39d2936
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • com.dtunnel.pro
    1⤵
    • Checks if the Android device is rooted.
    • Checks Android system properties for emulator presence.
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Checks memory information
    PID:3333

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        base.3333.tmp

        • Path /data/data/com.dtunnel.pro/cache/oat_primary/x86_64/base.3333.tmp
        • Size 573KB
        • SHA256 b2bce783e7cee0337aff873ae8bf9a641cea7ccb8b88410e0d6675eadf69723a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.dtunnel.pro/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 5230e3ea69fc1e0c0ef0422d8447f2bd756ea3d6e4c805d192d1316f67c34e08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.dtunnel.pro/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 f3a06c86579cdf2d21e0284f7a765bf54e43e58e0b2d42a2d51d954912d9819e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.dtunnel.pro/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 19aec007fecc4a169e035ec45a128f77b097872b444602717b14e076b370eda7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.dtunnel.pro/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 3372fef0e5fc72c65848379189576cb475280cf56e12fa2711811020413de8e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.dtunnel.pro/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 bd713f657a037a2aa9179c851e1272d8889dff6125d229daff055f794de95228
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.dtunnel.pro/databases/com.google.android.datatransport.events-journal
        • Size 12KB
        • SHA256 ffe58c7ff945dc63a22c039d3aa0a0220ef23542e8ff0a14b60881d405dcd7a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.dtunnel.pro/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 7074dbc29598a02ed0fe8c310cf1d921766eb262e673b4afe84f737eebf8f88e
        • MD5 SHA1 SHA512

        google_app_measurement_local.db

        • Path /data/data/com.dtunnel.pro/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 d1ffdca7ba8c0925bec4d10295b7c355bc1cace5e6b44d6efe9f812023f9e772
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dtunnel.pro/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 aa31be5d60205507baab9eb6ae868ad2453b1f4aaedd73cd4685e3f30aa60100
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dtunnel.pro/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 955e53e5d5d41e131bfe8ac16c3d3a0773536dafc5ec0157e175992e88f7e7b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dtunnel.pro/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 0788ed7386785a64d2ebf7c612ea43e6a431c5e8de508dcec1feed97ce84e40b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dtunnel.pro/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 f0050a8ba8972998c6bd75271ad5fd3219fa397ff7c312ffebacab7c4f06d958
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dtunnel.pro/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 a9c379a9b4586c93b39cf18de8a0ced61ca4bf629f0e7f2244a00cc3ee305442
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dtunnel.pro/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 9f1c6fdedf2a3bea0f002139f927a10e41b0db20e3b7bc1027b436258c4440b8
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.dtunnel.pro/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 028bb73d0e7c45a660467baf73ce6f790141c843bacea5c80f1522a66642393f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dtunnel.pro/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 e6f73fa0811c25201a4130f585c69ee6641138c4b939fbae3d99b69d8dc2efd1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dtunnel.pro/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 31c42b78e6e92575b4961c407e058d3378d563f7f2446aae0f59838cfb390ae3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dtunnel.pro/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 4abcf8cf75a2d119c336629487f457005ca392c21c8888104a67a4f0023cafec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dtunnel.pro/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 11d2e1f8e3e2b3b15284a2b64f70352b7ac97e81b1e2ef1b0e6684234de9888e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        internal-keys

        • Path /data/data/com.dtunnel.pro/files/.crashlytics.v3/com.dtunnel.pro/open-sessions/6A83203B016A00010D0514F6F82492BD/internal-keys
        • Size 207B
        • SHA256 9118fcd8cf160da73389831bddee999954f0884a8a1e800b86f22beaf380c7db
        • MD5 SHA1 SHA512 TLSH

        report

        • Path /data/data/com.dtunnel.pro/files/.crashlytics.v3/com.dtunnel.pro/open-sessions/6A83203B016A00010D0514F6F82492BD/report
        • Size 793B
        • SHA256 0818509de6416e7491f7207588ac34e8b462e15214015dd86e552c6a6b7251ca
        • MD5 SHA1 SHA512 TLSH

        userlog

        • Path /data/data/com.dtunnel.pro/files/.crashlytics.v3/com.dtunnel.pro/open-sessions/6A83203B016A00010D0514F6F82492BD/userlog
        • Size 189B
        • SHA256 7d11a3302a71f29dc04e05d4a5b792e40b183eae0f1a7ca889219e1b33d0b8be
        • MD5 SHA1 SHA512 TLSH

        userlog.tmp

        • Path /data/data/com.dtunnel.pro/files/.crashlytics.v3/com.dtunnel.pro/open-sessions/6A83203B016A00010D0514F6F82492BD/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        PersistedInstallation8435835076628756271tmp

        • Path /data/data/com.dtunnel.pro/files/PersistedInstallation8435835076628756271tmp
        • Size 90B
        • SHA256 e3582e481ad244dbd3a51b97070ae117bc7dae3894e269d7a9604311157a1f0c
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MToyMjA5OTM4MDI0Mzk6YW5kcm9pZDozN2NjNGEwZGZkN2VhZjllNGEyZWUy.preferences_pb.tmp

        • Path /data/data/com.dtunnel.pro/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToyMjA5OTM4MDI0Mzk6YW5kcm9pZDozN2NjNGEwZGZkN2VhZjllNGEyZWUy.preferences_pb.tmp
        • Size 423B
        • SHA256 0a759970fc2ff1414fa150a04ef793a08a1f7138131c36c920c6704d1b7eb4fd
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MToyMjA5OTM4MDI0Mzk6YW5kcm9pZDozN2NjNGEwZGZkN2VhZjllNGEyZWUy.preferences_pb.tmp

        • Path /data/data/com.dtunnel.pro/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToyMjA5OTM4MDI0Mzk6YW5kcm9pZDozN2NjNGEwZGZkN2VhZjllNGEyZWUy.preferences_pb.tmp
        • Size 423B
        • SHA256 0678fb10773808857ff12a79a22d594dcb7af03cd133a276d6026582f1a3cda7
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MToyMjA5OTM4MDI0Mzk6YW5kcm9pZDozN2NjNGEwZGZkN2VhZjllNGEyZWUy.preferences_pb.tmp

        • Path /data/data/com.dtunnel.pro/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToyMjA5OTM4MDI0Mzk6YW5kcm9pZDozN2NjNGEwZGZkN2VhZjllNGEyZWUy.preferences_pb.tmp
        • Size 423B
        • SHA256 78517e40d2b74afea2dd09da3ae68bba7ea41d84bb97f784c0a5f900bd0a422d
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MToyMjA5OTM4MDI0Mzk6YW5kcm9pZDozN2NjNGEwZGZkN2VhZjllNGEyZWUy.preferences_pb.tmp

        • Path /data/data/com.dtunnel.pro/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToyMjA5OTM4MDI0Mzk6YW5kcm9pZDozN2NjNGEwZGZkN2VhZjllNGEyZWUy.preferences_pb.tmp
        • Size 423B
        • SHA256 9bf92fc9e260122b7972e51c73e76e1906d5feaa92ac3f1dbe4686b89bf9c70b
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MToyMjA5OTM4MDI0Mzk6YW5kcm9pZDozN2NjNGEwZGZkN2VhZjllNGEyZWUy.preferences_pb.tmp

        • Path /data/data/com.dtunnel.pro/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToyMjA5OTM4MDI0Mzk6YW5kcm9pZDozN2NjNGEwZGZkN2VhZjllNGEyZWUy.preferences_pb.tmp
        • Size 423B
        • SHA256 72cf801002ecea9311e38ecb4d79dc3f608c407ebbbbc6f6bd97e0c5c1f5f4fc
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MToyMjA5OTM4MDI0Mzk6YW5kcm9pZDozN2NjNGEwZGZkN2VhZjllNGEyZWUy.preferences_pb.tmp

        • Path /data/data/com.dtunnel.pro/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToyMjA5OTM4MDI0Mzk6YW5kcm9pZDozN2NjNGEwZGZkN2VhZjllNGEyZWUy.preferences_pb.tmp
        • Size 399B
        • SHA256 8373096b1a3a82d41e0685a05e8d0a7c79701002866e08d15eb7854824012d95
        • MD5 SHA1 SHA512 TLSH

        sessionDataStore.data.tmp

        • Path /data/data/com.dtunnel.pro/files/datastore/firebaseSessions/sessionDataStore.data.tmp
        • Size 275B
        • SHA256 aaa2a070fe9abb6679246cc7f66b496f4fb01b0623b3d8abef1d2445bb34bee0
        • MD5 SHA1 SHA512 TLSH

        profileInstalled

        • Path /data/data/com.dtunnel.pro/files/profileInstalled
        • Size 24B
        • SHA256 1c3084cd9f0bdb171157e65d62e7851918dfdcf93bf1117a125ef19556e2cd71
        • MD5 SHA1 SHA512

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.dtunnel.pro/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 a1297e033f1eee1e8636b7eb19b70e050672d26978583f0de1089a1ed2fd58d0
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.dtunnel.pro/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.dtunnel.pro/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 f0fa7b1a04a5ec8e1b93a24c2d0e89e0f972e695fed7c4395534255228586e57
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.dtunnel.pro/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.dtunnel.pro/no_backup/androidx.work.workdb-wal
        • Size 342KB
        • SHA256 ca8d2eb4f2b906b182c618274269d4ae976de7d83da47d7e7207d6db3ca19d9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.dtunnel.pro/primary.prof
        • Size 3KB
        • SHA256 a236feaa35cfa2018b30f359387496ad5bfc703dd8d3459e4ba293584a4c4902
        • MD5 SHA1 SHA512 TLSH

        primary.prof.Kn2S0M.tmp

        • Path /data/misc/profiles/cur/0/com.dtunnel.pro/primary.prof.Kn2S0M.tmp
        • Size 5KB
        • SHA256 a134dd476c84bbe3b8f02bb996a7f61b9ab750b7c6b0fcfb8fd5604d4537bc40
        • MD5 SHA1 SHA512 SSDEEP TLSH