Resubmissions

20/08/2026, 13:19

260820-qkyzdsxhkf10

20/08/2026, 12:54

260820-p5p2jsxelf10

Analysis

  • max time kernel
    32s
  • max time network
    152s
  • platform
    android-10_x64
  • resource
    android-x64-20260325-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
  • submitted
    20/08/2026, 12:54

General

  • Target
    f310d6679f17eda84e5c59e6feecd5d7204d560890372cfe1eec69877896b8cc.apk
  • Size 18.0MB
  • Sample260820-p5p2jsxelf
  • SHA256 f310d6679f17eda84e5c59e6feecd5d7204d560890372cfe1eec69877896b8cc
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Detected google phishing page

    Potential google account phishing

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.dayara.lovesticker
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks memory information
    PID:5052

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OneSignal.db

        • Path /data/data/com.dayara.lovesticker/databases/OneSignal.db
        • Size 52KB
        • SHA256 f8ebc23104952761ccaf8dcf7ea9e5341bb0f3da744550a518f8dbc8b3404904
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 76b8d69854cda55356a32b3ff201599fd20ee74ff858eb35c2654c812a796576
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 c4a2dfbd4a12fc100b46d8448f27ce9852fb6ce78fae48e29b1118f43be808c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 34ed57f20ac3dd2a67c5963782e018d99428c2be291c700ddda22115763707f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.dayara.lovesticker/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 b7007e77f01eec4055f75d729e5f703422b71d9dad7dac03cc71e13f4292bc67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.dayara.lovesticker/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 46f95be316001d8e65dff2b8a564fe3af975a79bdfb3ad269a5d1fdac75f3c32
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.dayara.lovesticker/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 731b753f04a007c0a94593fa0188c9134bdc68470ed4435c0f2c7f2abf1b853c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.dayara.lovesticker/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 7c4a7fc6e279353e8410fc3ab944bc2f4f42b920668b2b622b79b70924f9d2c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db
        • Size 124KB
        • SHA256 eed59a6a0e6a07daf67cc900a2fb05ebfda8acede23b5ecd9396f7aedeba18bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-journal
        • Size 512B
        • SHA256 8cd4739ebb80b27305c67724e058fe1f4b0cff3df20ce05da88717e31952861e
        • MD5 SHA1 SHA512

        google_app_measurement.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-journal
        • Size 8KB
        • SHA256 c0927e91d07a9fe1c3998a55eabbdc516291739d7aff424109bdc9ec154d68fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-journal
        • Size 4KB
        • SHA256 55794b10ec1d9bd868fab8d305f02e418d9876297c4447027e96983528543078
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-journal
        • Size 8KB
        • SHA256 777843ab965d2965f5bd55fbaf1ffedf9316f4e42db60c4d504f23990d1f55fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-journal
        • Size 4KB
        • SHA256 5d03126b080761ebc35ace7e73f7aebace1f60056d4897ad3be3c8ee6b65165c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-journal
        • Size 56KB
        • SHA256 fcd9e325ed63169859d8134c42da78c5a088b8690b17ef1909d96f5ffe06de35
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 6ec1219e4f89a2f5d60fc88e72a2ceaa374db1a1b68a22039ebfe10c1f6a09c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 7a8e9f7306b3270f4082ab4bd3324b58d354af31eaa25f74c953e93190e1715a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 0d0ff3d84b3af14ebc2c9eb26c3a488baad0ca8aeb562239f4de52e2e216a1ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 9b7e4867ac930b4826f1c07559c10875d95ad33d61f182e007064996a2c795fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 458aa953a9e0adbf5b8765ebcf6b51bc5b5a48b7664e85d25c7a8ce9781a2d5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 6c1b39d3e39d7cbbc00029a4b9aaf392800555d205b21172dc89073100907dd8
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 4bcedc0faa5e6ea4fc256efce893273acf0557e91295f2ce91aa008b8da28bdb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 4972058f5de076cda8199f370d9a868d392a7229d464c8b8d2c1e9a2c690c839
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 1bcdb2130dc4c6daa529fbbbeb46aedd12a35e0581400a34778fef639f49afe0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 1fef8cfeaa8e39619c25ecfaa227b002a9308c50ce691fa96991359df0923120
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 237e67cb1c3131a258bc8d22148beabf8e26c0be85b22d0370e84825cab887c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation3721933105179181077tmp

        • Path /data/data/com.dayara.lovesticker/files/PersistedInstallation3721933105179181077tmp
        • Size 567B
        • SHA256 7b8018c7f3bc7a0234626adc74f327270fc7ea588edf871ed5db238caf262e8e
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation5430244811264420202tmp

        • Path /data/data/com.dayara.lovesticker/files/PersistedInstallation5430244811264420202tmp
        • Size 568B
        • SHA256 fd054e5e3ea3903b01c39551cfd31a6b9bde60b6527bbd57320347a90fa475b2
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation5934666775949506800tmp

        • Path /data/data/com.dayara.lovesticker/files/PersistedInstallation5934666775949506800tmp
        • Size 90B
        • SHA256 49f5bd88d92605b922a7331bd54783e4b53a2f637082ca58408b2d448e5d8997
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8964001650405798711tmp

        • Path /data/data/com.dayara.lovesticker/files/PersistedInstallation8964001650405798711tmp
        • Size 90B
        • SHA256 bbbfcd49ba0fda986d36b16ac23f4943ef277c53b3653b2daf77016a49d3f160
        • MD5 SHA1 SHA512 TLSH

        audience_network.dex

        • Path /data/data/com.dayara.lovesticker/files/audience_network.dex
        • Size 3.2MB
        • SHA256 920e465a87a2409fc8d7186ea4e319c613c04d156bec75e8b91cb4d07b1deb75
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db

        • Path /data/data/com.dayara.lovesticker/files/google_app_measurement.db
        • Size 4B
        • SHA256 88185d128d9922e0e6bcd32b07b6c7f20f27968eab447a1d8d1cdf250f79f7d3
        • MD5 SHA1 SHA512

        dso_deps

        • Path /data/data/com.dayara.lovesticker/lib-main/dso_deps
        • Size 160B
        • SHA256 fdfe058b64f5bf1a0aacc9a3f65c4118ced58ee611c567db1a0bc45e386be199
        • MD5 SHA1 SHA512 TLSH

        dso_manifest

        • Path /data/data/com.dayara.lovesticker/lib-main/dso_manifest
        • Size 5B
        • SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
        • MD5 SHA1 SHA512

        dso_state

        • Path /data/data/com.dayara.lovesticker/lib-main/dso_state
        • Size 1B
        • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
        • MD5 SHA1 SHA512

        dso_state

        • Path /data/data/com.dayara.lovesticker/lib-main/dso_state
        • Size 1B
        • SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.dayara.lovesticker/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.dayara.lovesticker/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 9b04c46f71c8d44d8f3f9ce0f1792d7d45890424ef6aae53f917b6e45d66ad04
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.dayara.lovesticker/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.dayara.lovesticker/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 0730cf011b68a495ad992fa237dcae48e7d4ad8418f52e9cc65e7aea437e1030
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.dayara.lovesticker/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 e8b483db07e905683f5316c3ea83b0d6147a703825eb04a7ca221f6931436723
        • MD5 SHA1 SHA512 SSDEEP TLSH

        contents.json

        • Path /storage/emulated/0/stickPacks/contents.json
        • Size 70B
        • SHA256 8c46b6e63ca38ff1e79b0bf571c59d148b8a2655f6601e92bdf060a28e6fd193
        • MD5 SHA1 SHA512 TLSH