Analysis

  • max time kernel
    13s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    18/08/2026, 23:53

General

  • Target
    f26185fb9e0beb0eb4f05ea11044c51ae93e5d09cfac9935c92db3a4fcdca667.apk
  • Size 19.3MB
  • Sample260818-3xtawsshke
  • SHA256 f26185fb9e0beb0eb4f05ea11044c51ae93e5d09cfac9935c92db3a4fcdca667
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • com.plantzy.identification
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4733

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.plantzy.identification/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 ec6bd0fe721f59295775953659d841ad34008d6e87df5c5b71912fb889e52b29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.plantzy.identification/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 19762fad21ab467da818071994315fda857c08a13937b17782025a8c04550a2a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.plantzy.identification/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 70d4c853940d49c9dc27e54ee7a4737328c9e4025aa039d4426ee36be6737012
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.plantzy.identification/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 51bb0a8f9cee3ade5d0e3839bb371f880fe1aa44f2823fd16ead17fc961a1980
        • MD5 SHA1 SHA512

        google_app_measurement_local.db

        • Path /data/data/com.plantzy.identification/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.plantzy.identification/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 fc0c2ad60747df807ddb13f06f36958f51345c1b6c3f8af185607e0ae0314d73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.plantzy.identification/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 fec591cb8f4eb0c0fc62f3cc5a8fa4cf3a0cd695c6eab10c1ea7754bdc0337e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.plantzy.identification/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 572dd973fc08a636b2d6af06d960f13cd0e2d89ede898099ed1b1784a9a53ab3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.plantzy.identification/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 565d5751e477819f83fdd1735498021aed090623d4cfc634d78caa112a1f39f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.plantzy.identification/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 599d63ed390f7e8e81d82b379c9a733ffbf454bfa5843bd0c909737c8d40dfef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.plantzy.identification/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 37935a14c49bb2571d563e238069376e8615d775f2285c60ba7535b649086ca0
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.plantzy.identification/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 04d49723bb2b5740bebd5c851367170d179854ed1d7a534351a133bdc3c076c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.plantzy.identification/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 bcdca432db5dfa721afdfd289708053f822116bfb10740ec630fa9163b45826e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.plantzy.identification/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 7e29f15218075750d0daf696627032a5441819a00a3bbbb60e7ee4bec3ccb126
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.plantzy.identification/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 1d338482a883bca74b16ef3f490490224ebc538cb9914b6cc2adb9f7e7fc1861
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.plantzy.identification/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 cbe08faaed50a5c9af17d8a458e0b7ff16652d5dddb3b4d4eb2ae4684881441e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        report

        • Path /data/data/com.plantzy.identification/files/.com.google.firebase.crashlytics.files.v1/open-sessions/6A84F0A202280001127D0CE6FF8D178D/report
        • Size 750B
        • SHA256 a82ce20da177cad792566ffba24763dd432feee49dc850b3aaff0e7b8a79e860
        • MD5 SHA1 SHA512 TLSH

        userlog

        • Path /data/data/com.plantzy.identification/files/.com.google.firebase.crashlytics.files.v1/open-sessions/6A84F0A202280001127D0CE6FF8D178D/userlog
        • Size 195B
        • SHA256 c38dc15f5261a6602c7ab867195a1912e7293dc8f8e7794dc6e8b1908d35dba7
        • MD5 SHA1 SHA512 TLSH

        userlog.tmp

        • Path /data/data/com.plantzy.identification/files/.com.google.firebase.crashlytics.files.v1/open-sessions/6A84F0A202280001127D0CE6FF8D178D/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        PersistedInstallation1738483894201707733tmp

        • Path /data/data/com.plantzy.identification/files/PersistedInstallation1738483894201707733tmp
        • Size 90B
        • SHA256 ceebc2b575a2b21332391cc9fae86bb284dbfa4d384921ceec12fd7f51a72a94
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8461110899481080526tmp

        • Path /data/data/com.plantzy.identification/files/PersistedInstallation8461110899481080526tmp
        • Size 114B
        • SHA256 4c0107114a20ec93c7bdcbb36ad259eb0b4e3e2baf965e6a255d9fb1fdb5c9da
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/com.plantzy.identification/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.plantzy.identification/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 21fbfea81aaa774b0ddba418ff350aa1fd0292fef70c7e2eb61d1677c2d78d03
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.plantzy.identification/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.plantzy.identification/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 6d993a7d3ca4423454c5c8ec0303a492a8eeaef0509a2bd4f20787828fdb977a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.plantzy.identification/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 657d7e3b92c89c92df74e50331cbb84f26c1b954ad16033d48dd21c400222c62
        • MD5 SHA1 SHA512 SSDEEP TLSH