3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27

Analysis

max time kernel
66s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
20/08/2026, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27.apk
Size 19.1MB
Sample260820-lkmtxatepd
SHA256 3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27
MD5 a1a4fe5ec1bd523034d08ae26b812a5a
SHA1 157744af9745209f418f732d301965447d8dbe66
SHA512 3e3842e2f44426778a3675422fd70f9bca65ab18e8b1eca610f6294188ac5c367483928fbd24e635df2749c6624f005db696dcb99ad762d7282edefcf1f46ac3
SSDEEP 393216:PMG3RgnY2bbdHBUQm+SPSqhlaVeAZzqrz+umPIlE2pEPnx73wmoMPKlIw:d31ySPSqhsVeAM8IlEQmZ3dPK5
TLSH
T19317229BBF4CE87FC43A5073CE669133327B9E164142A7737508B20869B35898F59BC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.memory.phone.data.storage.removal
/system/xbin/su	com.memory.phone.data.storage.removal

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.memory.phone.data.storage.removal

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.memory.phone.data.storage.removal

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.memory.phone.data.storage.removal

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.memory.phone.data.storage.removal

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.memory.phone.data.storage.removal

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.memory.phone.data.storage.removal

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.memory.phone.data.storage.removal

com.memory.phone.data.storage.removal
1⤵
- Checks if the Android device is rooted.
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4361

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

1681310438574.jar

Path /data/data/com.memory.phone.data.storage.removal/cache/1681310438574.jar
Size 11KB
SHA256 1d2c79f353a9a99d45110c1e8a86a160bf086d58662027912bdc7d1ff4776a06
MD5 9be9b2aaedfbd00175da4ca9aee3292d
SHA1 df4c68fe6432be3dc72f0ba4cf2b9f74c7423904
SHA512 67a5e085a9768aedd875bf133da6cde6ed320dece17437cf36f9d032cd96887fd3d78c5590ddf39a148835bac5d95447678c0fffa15919fedb7920eef447f164
SSDEEP 192:vevqX6aMltJZM/ZYbEe8uZQ9Sw2si2HRpM8D2Zr3hjjc92JxMH:vab9FeZYbE2wSwzzM8D2ZLhjjjJg
TLSH
T1CC32B0EA4B6DB48FD71BC6F939B89983B847E59C81B0125B53D8F05A7C93EA42F10C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-shm

Path /data/data/com.memory.phone.data.storage.removal/databases/com.google.android.datatransport.events-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.crashlytics.settings.json

Path /data/data/com.memory.phone.data.storage.removal/files/.com.google.firebase.crashlytics.files.v2:com.memory.phone.data.storage.removal/com.crashlytics.settings.json
Size 806B
SHA256 366cbc3161b173b27787fd86e0ade89e79c14bc34e0606d98374e0ddd6aa9208
MD5 4a1f285d21d246355d51c8ca7cdb48c9
SHA1 e6dccbd3e05e9ff5a989b107175b544d8774d8f9
SHA512 c7ac67bf5ea845d3b33f7f4a8f0652ae1481a52f66f81e96a48d19302bfc41b0cb51db32712d3a5f9d7c27545933b043a023125a0a883d18c08149206dc4b886
TLSH
T151018E2DA48C99F540EAF529C63467B11A284863561B9C18F17C831C41D79C1D117933
MD5 SHA1 SHA512 TLSH

Submit Download

report

Path /data/data/com.memory.phone.data.storage.removal/files/.com.google.firebase.crashlytics.files.v2:com.memory.phone.data.storage.removal/open-sessions/6A86CA7501D900011109F8870F58D60E/report
Size 764B
SHA256 d88742947cd5eb05a1a33019387de7efde2835843b9ff2db263ceef0dbc70033
MD5 36570192695012788a155cd73b22cbf1
SHA1 1642497293a5422bf61bf58209afd8c665583530
SHA512 48dc62ffb5757d1d9c6bd6fe5d353aa8b60f8d00b92b728ac3c5ab1d168bdba710b5e60ac108ea7762083bf47f379b6b5a463cdb54d2d1c965edacd5ce535306
TLSH
T18801205C06B55A7C030DD3CDA046DF67D2B802646A15594D6CC200212ADFA9C2601976
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation6806629444922485080tmp

Path /data/data/com.memory.phone.data.storage.removal/files/PersistedInstallation6806629444922485080tmp
Size 568B
SHA256 82341b4086154356bf4b47c3380779e587b2a32ee00f1c485dd1f1236010167d
MD5 89789be312b4aa4e2d0b1745eeb847a7
SHA1 cf70be6d0bffbce565e39a38ca6a1ac32c5418c5
SHA512 1df2188171d694156ee01e4f8a5935b242982d06001594f8e3607377c2f8e49aea37749e16094a68183b0750aea4ea77b166af6da4ee56813fc749f826f3710a
TLSH
T16CF041CE33948668C0C8722134899C838E680258E1091B94BFCC41608DF06A9730F055
MD5 SHA1 SHA512 TLSH

Submit Download