f310d6679f17eda84e5c59e6feecd5d7204d560890372cfe1eec69877896b8cc

Resubmissions

20/08/2026, 13:19

260820-qkyzdsxhkf10

20/08/2026, 12:54

260820-p5p2jsxelf10

Analysis

max time kernel
131s
max time network
157s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
20/08/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f310d6679f17eda84e5c59e6feecd5d7204d560890372cfe1eec69877896b8cc.apk
Size 18.0MB
Sample260820-p5p2jsxelf
SHA256 f310d6679f17eda84e5c59e6feecd5d7204d560890372cfe1eec69877896b8cc
MD5 95fc5c372f5f83d8777a6d5a54fac6b4
SHA1 dba9a6e5a2fc8c770314a979fdbe200ce8df5c5c
SHA512 321c2e4173209d38070639a5734a06423ac187be51252151a250dcb87c693557cf60da434202b5f47bad538f145c80fb5c5cf6c4e69040109f22a54471ce7116
SSDEEP 393216:24r/LKoODEWDf4Cq2rFf8q5U8Td7D6P5V9ueaz/smnMT9LRmyPY5XeaD:24ruI8vq2rFfv/x7DQ5Mz4mWY15D
TLSH
T1FA173357E329A4AFCCF760768AB9422601574E558183BB936D14F22C28F7AC0EF59FC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

google defense_evasion discovery evasion execution persistence phishing

Malware Config

Signatures

Detected google phishing page
Potential google account phishing
phishing google

Checks if the Android device is rooted. 1 TTPs 9 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.dayara.lovesticker
/sbin/su	com.dayara.lovesticker
/system/xbin/su	com.dayara.lovesticker
/data/local/xbin/su	com.dayara.lovesticker
/data/local/su	com.dayara.lovesticker
/system/bin/su	com.dayara.lovesticker
/data/local/bin/su	com.dayara.lovesticker
/system/sd/xbin/su	com.dayara.lovesticker
/system/bin/failsafe/su	com.dayara.lovesticker

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dayara.lovesticker/files/audience_network.dex	4327	com.dayara.lovesticker

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.dayara.lovesticker

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	sites.google.com
11	sites.google.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dayara.lovesticker

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dayara.lovesticker

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.dayara.lovesticker

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.dayara.lovesticker

com.dayara.lovesticker
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks memory information
PID:4327

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db-journal

Path /data/data/com.dayara.lovesticker/databases/OneSignal.db-journal
Size 512B
SHA256 c43f6d0519c3e84c5f907e5be0128cf3d55ff10e84a5859245fcf7c5659d02c9
MD5 7e12834e398b088a66d627d0f47e11ae
SHA1 a06900f6f615e5d9841f1c8d0f6bf5ec4c372fa5
SHA512 ca8e0e3be73f53af484d052d3d91afe3e3cdc209ece6f7d349c69f2651c8dc61b25895c8dc2dc4c9e37356fac07c62535128959ddc649ae5da73f32439dafad3
MD5 SHA1 SHA512

Submit Download

OneSignal.db-wal

Path /data/data/com.dayara.lovesticker/databases/OneSignal.db-wal
Size 64KB
SHA256 01255e3ca2b3f5beeda64b3e05824dca1af6e4ab43259226e23da62b00a306e1
MD5 967bed0ea2fbfa5ac067c499ceb7c4a7
SHA1 4aa6465793788e88706fb2aaf57f4858cc6f6be6
SHA512 03d0e5b65f7c4ed1cbba86f53a9d146e36c1a91d9c2047dcd9b4c2d0c665482ff94f9701d04b353a14d64633afd3c98689204d876b06c6ed679aa3384bb3cc36
SSDEEP 48:1zNSP/4jxUCrQcrA0oJtqracrObMoOSP/UQkM:x0PwHoDrbxrP8pM
TLSH
T1FB53CDCFC64221D1DAC712B7224382E48D3B610F895B17BB2FE264205E82B09C713C68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.dayara.lovesticker/databases/com.google.android.datatransport.events
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.dayara.lovesticker/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 f0f91aaadbbd1f340a97e8f4ef784d5df7b53ff1f7e5f90046c6914c3c8203c9
MD5 d6a235cd6d81032bd924d2ab95285536
SHA1 1e01563a7c98cfd7263879ab39b0b162ae0db1ae
SHA512 b04e4ba503041513d234bd019c9a09fc5255ce7fe2c0cf48933e84af375740f5dfc22cba534d33e942c9598794246ecba9220d1d98621068c063f927631bbb43
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-shm

Path /data/data/com.dayara.lovesticker/databases/com.google.android.datatransport.events-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-wal

Path /data/data/com.dayara.lovesticker/databases/com.google.android.datatransport.events-wal
Size 68KB
SHA256 75588b13c2e0095073aa6ca3cb1eb6f529626624dd0fe1e52566ddd82ec9f3a2
MD5 ae548b45138a29ca2e47121902ccc169
SHA1 deda02e020d21aab3e01048839cb6967e32ed732
SHA512 809e6e0ccec1d228ff5ab0d10fe5a29666ca8c2c5286b5bdc4ee6c99a68a0a2a5da3c126fff95fab7666b9e6f23c58ccf6bb7e9fa31114f152e79e6405b576a3
SSDEEP 48:JXzNSP/kzdsIy1g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSP/Is2B3BT+A:Jj0Pe7LMEX0wIyNjaPgsMRT+A
TLSH
T1E96350BD5A282232C96D143EE3F643532A3C93DF471382623AD4CCF98DC22A97025998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement.db

Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db
Size 116KB
SHA256 04cd9f13f19581e14d164aa68a1b3802b0a0b1981ca44348c05a76f59989b948
MD5 f2e8edcc46597bc323c271a1ae8ef342
SHA1 7673d745666bf8cfcc2ed6351fd29684d7319844
SHA512 a60f3568208d8f582afa493384952574fa24988ece8a4ddfbc01382d3b97d32dc655ddfcdc876d83658b3d3f2dd11654bd3de127658087da76d2cdb0e645f496
SSDEEP 384:HRrlD3d9CQAzgpQHWYnblAtkCarwa1/dMTXSxZk:HV5LCrrbqeCaXUZ
TLSH
T161C3FE9E0F14AB51D4DA047CF6C206D39E3C436D676B32622AE84DF29D87462F42DCE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement.db-journal

Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-journal
Size 512B
SHA256 7ff7aca083741c8388a0b7e368120479bfb3f2c3336c11c91af3516d98e2ae1c
MD5 40983f235fa167a4477a5c7ca87bb623
SHA1 97d6dc84115fedd1cd96f4c1dbfb67ed89513c1a
SHA512 3c87b7aa98a5448d3a21e7a295d80ae3a1375191f50822588388baf5e80404fd4b5ebd97a68373353e301c31d103f428a76d34cf23ad3a3a8747ebe5ebba44e9
MD5 SHA1 SHA512

Submit Download

google_app_measurement.db-wal

Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-wal
Size 422KB
SHA256 b93c853e1a50e8c251d3fd89450f86db7ea6c9b4686aab98c94129198dff2551
MD5 5ac12a70c51e0c06f491411669b995fb
SHA1 e94a088e5c33c5c38647925ec84fc7f4d633b794
SHA512 9a3a8b38409440e5e64ebe183539871089427d1d35adcc27ea76de5764384c7bf2e276bc0a7d3e8c723b8be8859439fc5d524221d968527ceaa27090e928eeeb
SSDEEP 3072:OGQWDkisX8Vg0r1hrizSzS9S0sSLsSVsSX9sSY9sSJQW2b4QW+rsQWmfQWkK7QW8:OG4ZyLO4WsWfx7s
TLSH
T1E7940E9E4F24AB52D0EA017EF6C206935E3C076D573F32616DA80DF69D43162F01A9FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
Size 16KB
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
SSDEEP 6:l9FCls1ulO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TgEu9zmzrfRmBEyPbBvOwk3
TLSH
T16772C2CE9F102647C6660377B4CAE3916DA4A12D872BEB472BA50464AE42609A861F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
Size 16KB
SHA256 97645320dbe8ebf73eec08520a2f9c5f8f816feeb79a2eb051887d063c94b1fb
MD5 101cc50878317e367008bd336d4462c1
SHA1 40fbb4c2ef12f8e3c5f1e21286cf6b5146fb220a
SHA512 79a33c1eb057c9f37fa678a21ccc967532c30fb6f7a8cc0a4f36b68377eacb714c94a520e21e49c9b6a11eb028f7826eb8c0fa16f52d41cb3bfa4c1612c46388
SSDEEP 3:qqb/NjghzY+/lzyliMlTXmOkXFA1PlllKzMlklKllgIn:LCM+/lulvl6OkX21PlllKQlrf
TLSH
T1737292823282CB02E2378375528787F21536A2806A02811AF90193086C823D12A56697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
Size 16KB
SHA256 8ba76b57f537a19520ae4c6131839000aa6c951ef782eb58b0b89a7a326110d8
MD5 2df285881eb1656f9ddc5e1c41b4f649
SHA1 09a79e07c1aeaaa3b4768118c7b66a359c9d3d84
SHA512 d91a9d7dbeb3c065657027eae456cbb605801acf9059facfd0ab24ac4d4a9706167ae3b3e53c4b069875fce7d79bba50e02ab27ba2f5ecd5d92704c0930f7d10
SSDEEP 6:rLP/gEhV71m/9blDqlrElvldl7Qlr2BmCM+/lulvl6OkX21PlllKQlrf:rr/gW49blqYFldl8j+/0Fl661dllh7
TLSH
T1D9725E9232A6CB02F7378B7851C7D3D1213B31521B03C116F902AB0C2D863D20565743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
Size 16KB
SHA256 c480e6fa00524289360959c446b669da36ffc99445ae94aeea379438928f4d99
MD5 79d844fa6dede7c291a2a28b41b4b914
SHA1 7ff8fe0f6d09b96f1f9e2d53f65a8ba006a233aa
SHA512 4e99146527c0b4429b077db3652b6a55a8fc3fdaf68fc01e0f80763e998391879049ddc22f362fd33da26d46fb045083b3006dd5c25998f74bf4e0b86eebfa48
SSDEEP 12:fOLabCAUEWlCuUyWlCd49blqYFldl8j+/0Fl661dllh7:fKabCCbG499F4lF3D
TLSH
T1D772659571E9CB12F6778B3852D7D6D2323A32A31B13D216BD06AB0C79823924565703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
Size 16KB
SHA256 9941f6a1a3655521fbae0e3c198c23ff52c2e0187176c9a1f22e82f03588dff9
MD5 6054ef4946919ab3fb215411555808e7
SHA1 1d3cd445bb601d5ef69c8ce4ebfa51fc350aa7a9
SHA512 77f2c9e96478677f41c3353c36aa5e38372800434f963365b4cadbcab270d73db82568d00598b64920ff8ee4bbd6a2bdcd3b3522fcd5891af3f3518cb916b7ec
SSDEEP 12:oOLabCAUEWlCuUyWlCd49blqYFldl8j+/0Fl661dllhv:oKabCCbG499F4lF3n
TLSH
T13072659571E9DF12F6778B3C92D7D6C2323B32A31713D216B902AB0C79423924571703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
Size 16KB
SHA256 8fe0ac9db76d4a2dcd3b3d54c0efedcd223e25aabf716506493d50e243a7a2d4
MD5 44693692da738db6eb133cf0e4cde91b
SHA1 e6bda56494c325d8d37ad89552263ae85d9b0550
SHA512 b34ddfe1ae343b1b12f7029ae476a0ba8e1b4043ccb520afb412b3f71335ef679bf29723c9a5c00af7e922e9982d5b3af54b2ed779da8cb601f378e5b9d26be5
SSDEEP 3:o17TVElll:oK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 4bd3c59d6f97623e26ec5ff879ab4374243ba1b36a0107bdf62b115707d22341
MD5 bfe005ac88b4892c13ecb762d7106a7a
SHA1 100d504257992ac2026d1d0ee1db80906ac8b6b2
SHA512 b1ce87af022ed313b98657971822c3c838084d60109cd686f723439f151910de459828bbfee7f085785b880ae5c4f7ae8b2613bbb48bb2822cd59e3f147e6d80
MD5 SHA1 SHA512

Submit Download