afc0be54d90c0e3ffa73ac9078e8d37b086fc9088827b19fbb9f588a189d2fcf

Analysis

max time kernel
23s
max time network
150s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
20/08/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afc0be54d90c0e3ffa73ac9078e8d37b086fc9088827b19fbb9f588a189d2fcf.apk
Size 32.1MB
Sample260820-nrsd3swcle
SHA256 afc0be54d90c0e3ffa73ac9078e8d37b086fc9088827b19fbb9f588a189d2fcf
MD5 1fcf19789a0eacfbea44dfe155492ec9
SHA1 bea47d604b92dd6e882020ce98ba1e74243152ba
SHA512 43746b33351f5e58286666ee3c9c454b02d7e40f122bd17daa2fb11413478e4a0170b433a51378ace4dc01ca312eaf235d99d75154692877bdc716554c594373
SSDEEP 786432:6LFNQMd1tteHlerA0fusRsPVBIyGmpltbOiM4hF/Yu+GbIIw/HIFKrHvv1Ea83:6FNRLEkrAdAOVGyGET3YlGbYIKrn1EaQ
TLSH
T12C77236BF32C543EC43740B74E7661BA21591D96DA42AB63B814B34C28F7AD48F4AFD0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.bilcicore.cleaner
/system/xbin/su	com.bilcicore.cleaner

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.bilcicore.cleaner/files/audience_network.dex	5166	com.bilcicore.cleaner
/data/user/0/com.bilcicore.cleaner/files/audience_network.dex	5166	com.bilcicore.cleaner

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.bilcicore.cleaner

Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.bilcicore.cleaner

com.bilcicore.cleaner
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5166

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/com.bilcicore.cleaner/databases/google_app_measurement_local.db
Size 16KB
SHA256 197646b714cc1164f7edd762f7ccf707e34834c4a11180934f91d44f37a68f47
MD5 8a740474d52218096ba85a4bf6ce85fa
SHA1 22ed4a6d1d7d3215957d705e6eee8659c6ff3d08
SHA512 3a1505ce40d44f8e8292ab399efe9cbf283941d4e32e2d077f23dbe2ada6c6b6d8eeb6774ebb71646be7026242392417759032c653200d67c9e9e3b8639977ca
SSDEEP 6:l9bNFlkls1Q9P0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/DL8:TL6EQ97LzmzsRmBEyPbP/DL8
TLSH
T1B872268E8E107207C127033B70CE53A65E28921E8377AA472A740870AE53188F051FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bilcicore.cleaner/databases/google_app_measurement_local.db
Size 16KB
SHA256 fb9c99edb4b8d2c10f42b663a583b04d75fbcf377a1a1373bfd938a99ce45a6b
MD5 6ddb913cefd801505277ed3bc9f04bb7
SHA1 689fb6257e314dab0de93037addc390b15a3a7ef
SHA512 f1df8a3ebb9ffa030fa84cb50e105513e6f97c09cc88d20af819956470b9ce2db537b7e11b455fa9196b2327afeaca4950299475042613f921c032991bf11ada
SSDEEP 12:TL6UET7LzmzsRmBEyPbP/hqhtJ+/0Fl6F4AgBL8:TL63Hmz3GSP/hyJlFM4n8
TLSH
T167722BCD5E11B753C12B473A70CB93D21F38721E8337AA5B3A6509689D532C8B051F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.bilcicore.cleaner/databases/google_app_measurement_local.db
Size 16KB
SHA256 9955363ebe81471f2fcde4ba53f8c368160c61f658c94bfe7602bc8debb2d05e
MD5 02112c78aadbb109158fee8150a99933
SHA1 452b79cf93ae058ae83367abc3e9a28824f6a897
SHA512 4cfdde3ba939822ad1773c638bab457c77a9439cac1307763bd88ad5943f934730a7ace4f85af598d3c78747e0f038a9dac92f0f604c075070f7b5ff4f96337a
SSDEEP 12:TLUEe97LzmzsRmBEyPbP/7k49blqYFlF/HtJ+/0Fl6F4AgBL8:TLYHmz3GSP/7k499FXNJlFM4n8
TLSH
T1EE7281C97E24D743D22B4B3D20C7D3D22E383117432395163A160B2C5D433886021F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.bilcicore.cleaner/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 f70bb0497cd27eddd0d4c783f226a01f79732f4d0dccbf4b04ce4140b29150a8
MD5 8f7b1b76dd656862073c0f03c6470b71
SHA1 20d7f4c7a972ff8a952920b4c01d8a21ed375b85
SHA512 2126dd5a1473c93b01ebada87c94cda2b99c9511947d65d2a43a3d65e351161ef0a20727aa829f05e437898ce13bceabb7c752f8e236e25b67d5729a5a8229a3
SSDEEP 6:7+/l92/hCbvXng9bNFleLIls19P0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBw:7+tQ/0LnqLDE97LzmzsRmBEyPbE
TLSH
T10B02688D8E006213C117033B60DA83911F38551E826B9A4316F008646E13188B051EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.bilcicore.cleaner/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 132e8cb86058be7797c552fb91471cba83beacd441f70b34d20e9b529398ae71
MD5 f88785dbc15bdcd4378d3867227caffc
SHA1 271585311ec6acbf26e564bb08a993da49deea15
SHA512 03f731c9cb9ee754b2258990ec55803b1d8f75ad590c44268b91fd1ef5b355a965e889bf8d9d4db29ee5878dcf82afb8b5828e09a8c821f3ca4f76bd8a7974e3
SSDEEP 6:7+/l9YLL9g9bNFlkls1Q9P0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuk:7+t0L9qL6EQ97LzmzsRmBEyPby
TLSH
T1A202D88D8E106217C167037B74CB53955F28951F837799572AB40874AE53198B051EE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.bilcicore.cleaner/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 6b09f31be2ace2c6c98a7174beb8a2c2dcf56cac4587d35e6670bf4c325b3f89
MD5 6e46f3ed81c76108761007b8d447c164
SHA1 8c7ba5879783b8bd5bb584e007b526de181d17dd
SHA512 ed5e4f931ea5a3ea93e0fc77024cf465a664f3f76a8a403fa9557386959d0ee72b629c5d41a18362675355e9718ba157be6e2272bc5ec07ed8c0c00937ef8c6d
SSDEEP 12:7+tutJ+/0Fl6F4AgBLAqL6UET7LzmzsRmBEyPbPF:7+taJlFM4nAqL63Hmz3GSPF
TLSH
T127025C8C5E01B313C12B873A60C793D21F38610E83779A1736650A68AD436D8B011F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.crashlytics.settings.json

Path /data/data/com.bilcicore.cleaner/files/.crashlytics.v3/com.bilcicore.cleaner/com.crashlytics.settings.json
Size 776B
SHA256 fc9e5c43593473dcc32739bab872d7964985f1397215238c40f8a8cb25e334a8
MD5 9d9e0209e80010d1f0ea0b34d120129d
SHA1 e631c4d9d13ce90e1013691d9168c7cbece8a5c8
SHA512 74a2999e4a1b152e56a8f96d9c8e159218166b33fcb5c9371ef202884e31a5cc735396c0d177bb4feae11ed5ac9694488a6481d7a9ac2430bce0f8c672748a80
TLSH
T1DB01B16CA4889CF840EBF525C63477F11638087323165C58F57C431841D79C08117A33
MD5 SHA1 SHA512 TLSH

Submit Download

internal-keys

Path /data/data/com.bilcicore.cleaner/files/.crashlytics.v3/com.bilcicore.cleaner/open-sessions/6A86E74101740001142E8AFCEA43F40A/internal-keys
Size 207B
SHA256 77465e55f9406b8ca3b7fad84d3c3a70e86be302455ca1bceddf447010fbe7aa
MD5 aa96806134ddbc7d9630293ac9d86dae
SHA1 9afb3d7a6b5c769e7de6bdd07858070f1f44ac29
SHA512 07b14190c46210ebcb40550a3c3da1244e2060d98a8e600d190ee973f214b0eb8b89fd5fd00ee5a08301419b8d69c4b960d175ed19bbcf5bbfd467ba5e97ae94
TLSH
T155D0231CB0B568516AF1411C42425740220643491CF5D4C8143E8DC5F5131FD4D57E77
MD5 SHA1 SHA512 TLSH

Submit Download

report

Path /data/data/com.bilcicore.cleaner/files/.crashlytics.v3/com.bilcicore.cleaner/open-sessions/6A86E74101740001142E8AFCEA43F40A/report
Size 799B
SHA256 3e672e17f41a5148deaae9625c8dc9c5de91aba580bf3083fc036a23c98d222c
MD5 16ec62f81c62faf6fcf601ac64dc2d1b
SHA1 0e304e86d8bebd126055a588656fe08ce571e05e
SHA512 9bc81afe6c2279a246444186299068698b86e877a0c98080dc0e7a32d742ba8cc68909bb084cfb7b55273bd985f3680b015ceb5f29e3bc0eb555e817513d1e76
TLSH
T12501F124C7B9A6782B4D938AC081E9ABDABA0365A612955D29C2003326CF49C610BCB6
MD5 SHA1 SHA512 TLSH

Submit Download

userlog

Path /data/data/com.bilcicore.cleaner/files/.crashlytics.v3/com.bilcicore.cleaner/open-sessions/6A86E74101740001142E8AFCEA43F40A/userlog
Size 88B
SHA256 fc2b708c65240ba8519b37b62de65695d446d329aabdca20295e1a16fe3d8d8b
MD5 72723ffe3dee095ca353e847d2abd314
SHA1 46732ed6e807ebc924eb6a28860ed66d99ada69a
SHA512 78b6ff8c536ed206cc7521b590427d8a4b730956f85c899fedde108c6ac42193b87428cae757b2bd464058425215a8409a67577c7cc58b4ca7b4d1851042fc79
TLSH
T1E2B0244413C40730C104D73D050107440341C0C130DDCC0705404C34CF1141CFD7C414
MD5 SHA1 SHA512 TLSH

Submit Download

userlog.tmp

Path /data/data/com.bilcicore.cleaner/files/.crashlytics.v3/com.bilcicore.cleaner/open-sessions/6A86E74101740001142E8AFCEA43F40A/userlog.tmp
Size 16B
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
MD5 SHA1 SHA512

Submit Download

PersistedInstallation3176719075018913100tmp

Path /data/data/com.bilcicore.cleaner/files/PersistedInstallation3176719075018913100tmp
Size 569B
SHA256 515c68324191b46b5e3872accd0a8b2fb53f92e3933e30243a1e1acf7970fee2
MD5 744c2121f80f8ed1f703817b922675b1
SHA1 8527ee68b531a090f73628eb854950294ae2d979
SHA512 52848c6204c53fd6464dd6939d9c618482f66fe56f72c303b00fe2d0e591d16b44c9840dbfb299827f8f30229c35a9834c18ef2fc8381ab289b76d5c6fb2b124
TLSH
T1A9F0202433B04C64CAEAB603164CED450D6A0DD8564303E5BE9E6DA74640EFD975BF84
MD5 SHA1 SHA512 TLSH

Submit Download

audience_network.dex

Path /data/data/com.bilcicore.cleaner/files/audience_network.dex
Size 4.8MB
SHA256 07fef7ea41d84ccf44ef2e2a6de8d23e3d3dd5920c87979a1d501a9cb6272496
MD5 b7744a43c71503ccd3ac5a95a884f434
SHA1 9fbba7c0ff5daeb78e0022477942cf3aed0b97e1
SHA512 a7ae440aba08cfa68306846cae284d7a57e03fcc0a11c36959ff15b2d7eb29136e7930cca16d2f14d6ea325107c44b2f989a3b9d17753b2d1472921a9a1f490f
SSDEEP 49152:odcB+/KiheDdqzdDGTCglMdgnDR/18R0lBv+GZExSz6Tfwz81:f5K6f8WlNTZEqz81
TLSH
T10B367C1BF961AD22EAEC927FADAF47013B386945964357072190E775EC830EE4EC67C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download