Resubmissions

20/08/2026, 13:19

260820-qkyzdsxhkf10

20/08/2026, 12:54

260820-p5p2jsxelf10

Analysis

  • max time kernel
    126s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    20/08/2026, 12:54

General

  • Target
    f310d6679f17eda84e5c59e6feecd5d7204d560890372cfe1eec69877896b8cc.apk
  • Size 18.0MB
  • Sample260820-p5p2jsxelf
  • SHA256 f310d6679f17eda84e5c59e6feecd5d7204d560890372cfe1eec69877896b8cc
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Detected google phishing page

    Potential google account phishing

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.dayara.lovesticker
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Checks memory information
    PID:4918

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OneSignal.db

        • Path /data/data/com.dayara.lovesticker/databases/OneSignal.db
        • Size 52KB
        • SHA256 c776d1acf90c60f95a89ee4db8222acedc8e0b097d5606297aa641a3403821ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 7010cb0f6917e2597de258791a4353293ba0f388d309fbb9cfa6c7ce0000799f
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 b4db96fdaab4793ba932a2469bacd81c86311091cb012c75ea24cc073c6cedde
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 1d7723325e3ca3d76db07680fc3fb3774c9f1309d2cf8288a3ae3e1295f2ffb8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.dayara.lovesticker/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 881ffbbe8d52efb41f3929ab907b7f6748e4570c01aff3c7cefd2a13c6e49e3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.dayara.lovesticker/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 ac1a226547f13efe7d270bd6b43238541ddbde5ebd1a5f8dcfbba521f12e288a
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.dayara.lovesticker/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 38469a9bed9f4871657f86fb3af160a76e2a811d54fb8d1f3e9233e2f9a832a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.dayara.lovesticker/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 d43758f9a986d34196c4c0af0c88d40b6b3af563559aa131d68bfe120971a538
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db
        • Size 124KB
        • SHA256 a247bda4016ffa6a773240d8691f954da3e23203eab3d22dffdff5a506d5e08b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-journal
        • Size 512B
        • SHA256 f967a171e431cb34e48b0c914d903d91355ffb5320665508b948b71862d9f429
        • MD5 SHA1 SHA512

        google_app_measurement.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-journal
        • Size 8KB
        • SHA256 949128f34ee11f1c3a0863000aa18e92604c91e54d8c4c427df8f3ee7ea7135f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-journal
        • Size 4KB
        • SHA256 cc258d0ef71119344f693fba91d439e3e1ea47e2ecf391749a9e2a279eb3b01d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-journal
        • Size 8KB
        • SHA256 934902dc4ffff8fc160c62ba7ecbe869666a0f500aee905c8608534eb4bf3a3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-journal
        • Size 4KB
        • SHA256 bf1d84a2172d3062bc584ac16873d21e47d56cd4b80fec35799974cf0448472a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement.db-journal
        • Size 56KB
        • SHA256 5c18e20de13acce40a881d91085a95b723ea50ef6297419690b4574538f1aabb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 697df7e0cda99c00d0e71ff7b5a3765129857afde169ade6f2acb52e39a82503
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 0cd25ad570f44bccd4b48353a41ae2991ca176188cf49b296f0ad133ec21e957
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 b868f6fddd9af7874776a8d420485ebf338f3826ebd2aac365dd4dfb19c624ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 8fc9997ce32b9ebd84f1b1ae0d54607c51cc0315cfae91dbdb259e70c811528e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 b4765a86f69c122307448d0c6e81cebd52ffbc59b0d19da42971e2857f773e6d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 8eed1aec902f177cd54ca44cf3dde9082b6f67d2832df76ab55aeeb050549fa6
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 d13d5c9af52c1fa68d5ac2908d73c94be1afe15c2beb41b670741595d53f1a88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 195692d03ebf054334d2da95e76b48636f12d5680ef789823102f5d88f1ff0fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 a4bdb8bc3b7a3a25499fe9edbd130d4bbcd7bb4844114b0f57391c0af6436ba7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 545b8a1a81d48528d17c77fcf968fe71c4fb273a0b62b1221884f9caca971f0c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.dayara.lovesticker/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 79e7a7543886cd161596e10b747d0d5c8339f7cd6433ef855b8f25785e3bdd32
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation1157112453900882063tmp

        • Path /data/data/com.dayara.lovesticker/files/PersistedInstallation1157112453900882063tmp
        • Size 566B
        • SHA256 d2dd63d81ac3e3514b0076c5add4c1decd9380c79d0cbf1570dbeae68a69d997
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation1405927798387825225tmp

        • Path /data/data/com.dayara.lovesticker/files/PersistedInstallation1405927798387825225tmp
        • Size 570B
        • SHA256 8eca0441724dcdb520c686d92ed7948ab3f5e79fa97bbd5792421abe111f0b6c
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation2684641396836983776tmp

        • Path /data/data/com.dayara.lovesticker/files/PersistedInstallation2684641396836983776tmp
        • Size 90B
        • SHA256 1e7296ecef6e4d3289d241489a28e8b77a3740e912ebf87dfda60f3a61a4db8d
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation3202518839768366496tmp

        • Path /data/data/com.dayara.lovesticker/files/PersistedInstallation3202518839768366496tmp
        • Size 90B
        • SHA256 6bf33ba02a8cdc91b67c6df5ebe593b302c098f3b8ec3b90652c28e0cbb3d1d4
        • MD5 SHA1 SHA512 TLSH

        google_app_measurement.db

        • Path /data/data/com.dayara.lovesticker/files/google_app_measurement.db
        • Size 4B
        • SHA256 88185d128d9922e0e6bcd32b07b6c7f20f27968eab447a1d8d1cdf250f79f7d3
        • MD5 SHA1 SHA512

        dso_deps

        • Path /data/data/com.dayara.lovesticker/lib-main/dso_deps
        • Size 212B
        • SHA256 685270ebabf1be7be7bca22e5410ff481b9b927beedf81bec5184688273945e7
        • MD5 SHA1 SHA512 TLSH

        dso_manifest

        • Path /data/data/com.dayara.lovesticker/lib-main/dso_manifest
        • Size 5B
        • SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
        • MD5 SHA1 SHA512

        dso_state

        • Path /data/data/com.dayara.lovesticker/lib-main/dso_state
        • Size 1B
        • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
        • MD5 SHA1 SHA512

        dso_state

        • Path /data/data/com.dayara.lovesticker/lib-main/dso_state
        • Size 1B
        • SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.dayara.lovesticker/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.dayara.lovesticker/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 781b48813d9f6221761eec4e0d63baed0b9a2ac5ca1652c4ce583d39d6756e0d
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.dayara.lovesticker/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.dayara.lovesticker/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 b6e58af114daf1013268adfcff9fbe28000790e0b55f0ef14f48398e519fc109
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.dayara.lovesticker/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 a2220c292e93a2fd4734d3d0dfe484b7b27b73dfcc8c2081454d0abdf42a4920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/data/com.dayara.lovesticker/oat/x86_64/[email protected]
        • Size 881B
        • SHA256 fbc3b555ad67d5d5b102bda28c15eb7ace8dcf8d441ec105e412b22af9ca9dc1
        • MD5 SHA1 SHA512 TLSH
        • Path /data/user/0/com.dayara.lovesticker/[email protected]
        • Size 3.2MB
        • SHA256 920e465a87a2409fc8d7186ea4e319c613c04d156bec75e8b91cb4d07b1deb75
        • MD5 SHA1 SHA512 SSDEEP TLSH