529c8b3b53980d2ffb8de5bc68384e86e6983f543b0e841b6149239b7ddafffd

Analysis

max time kernel
86s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
05/09/2026, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GubukTogel.apk
Size 7.2MB
Sample260905-gyg4csvxcs
SHA256 529c8b3b53980d2ffb8de5bc68384e86e6983f543b0e841b6149239b7ddafffd
MD5 954e4c08030d323f56468a1ca88bb3a8
SHA1 3968ed98aea52f209e0c336d01e4e80e41017e5d
SHA512 b072d962851c4d997332025d3e0e9e5b5d2be1fadc349916a697945740e9ed828a3332575afb27f9647958ffe38f6cd5da61f159b13a4e09cf0e7fdd0d4cd7cf
SSDEEP 196608:ZVH7837chFa3FExCCZVASoSnepBEnMFpNZF:ZVQ37cmFiCCZVA6UBIMFHZF
TLSH
T10C76124EFB6CBD2FC87F40320A9AD23136568D158A9297476A44375CF8776E40F89BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/data/local/xbin/su	com.gubuktogel
/data/local/bin/su	com.gubuktogel
/system/sd/xbin/su	com.gubuktogel
/system/bin/failsafe/su	com.gubuktogel
/data/local/su	com.gubuktogel
/sbin/su	com.gubuktogel
/system/bin/su	com.gubuktogel
/system/xbin/su	com.gubuktogel

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gubuktogel

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gubuktogel

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.gubuktogel

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.gubuktogel

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.gubuktogel

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gubuktogel

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gubuktogel

com.gubuktogel
1⤵
- Checks if the Android device is rooted.
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4335

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db-journal

Path /data/data/com.gubuktogel/databases/OneSignal.db-journal
Size 512B
SHA256 b2661c5e7b3725a1b5b9d10c87d728706e0c15938e51beef05b5e310072307b8
MD5 e1e607fbc056644d1af5e46a7e9818fd
SHA1 f5f507d736ded688059261d78a6b85ecc7c581c6
SHA512 31421d9ba69791fbe70f7021a4a9833c196896cb83c75f89c1e2c847bbba5ca6cc736c53f79c5c7956dae9ec0642be6bf79d4e8f4d6d5e295648f9a0ea0c7c3b
MD5 SHA1 SHA512

Submit Download

OneSignal.db-wal

Path /data/data/com.gubuktogel/databases/OneSignal.db-wal
Size 64KB
SHA256 102987c9e73337c4feac2b66f792be6697ce1d781fbedb53968aa5ae980a9e15
MD5 f3b026e49381d2e7f20f5cf8a5f756e0
SHA1 0437f0ca3d6a86ff4b5183c070dd6c080e3f99fc
SHA512 3fa47c8056a1e86ab11ea2d520115ac8cf6b40f8485806c727d5ef86b1062531c675c8459482b94658a0ecc2816253173ddda08e4cc57bd4444b8e59877caf80
SSDEEP 48:cYCtzNSP/Rx/iUCrQcrA0oJtqracrObMoOSP/RD1kyRZRfeir:cTp0PJx/uoDrbxrPJ5kyRZRfeir
TLSH
T10653BCCF4B8322A1EFD751B3129392E44E37613E995327672BBA60245E42F19C323D6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.gubuktogel/databases/com.google.android.datatransport.events
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.gubuktogel/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 cc7bb16df5f5310b87f2fa16326ef595c1882046a588eb147d49a37f2aea31d5
MD5 30fec0ae01a6a0eb1094fffb51ffae64
SHA1 c6c2cd44b52b521ee2aa0eaab6b84439ae9b4895
SHA512 a301e514fcf7ffbd15d7c88dedcf99e8aaa5af359d3fcb9d50a77f8c29762b772bb371ea183a1ffca2ce5d6fc604629d07c220c3c22879d738bc3ac793b24752
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-shm

Path /data/data/com.gubuktogel/databases/com.google.android.datatransport.events-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-wal

Path /data/data/com.gubuktogel/databases/com.google.android.datatransport.events-wal
Size 68KB
SHA256 324282f760faf530ac08ded9cb1adbd619eac85473defe714f768d0b7c7ded6d
MD5 a06bb26ebcd5655a0082022bb7d9e039
SHA1 d7601404d11741ad472dfe2a5f7e9ed69f30a9b4
SHA512 5c519a2706b81d572fb6b3d94d0d41fdc294a9a1de0932d2a979e6425beddf7179cc2dd8354b5202cddb085f0e13eedc41f1a4f323ae0c16db7ba5b42fab1a2e
SSDEEP 48:JGzNSP/5D8XqX1g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSP/PIVG/:U0PEMEX0wIyNjaPUW
TLSH
T10D63635C5A681223C16D153FEBE553531A3C63DF6717C2A279B84CE98CC2098F0A8958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.gubuktogel/databases/google_app_measurement_local.db
Size 16KB
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
SSDEEP 6:l9FCls1ulO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TgEu9zmzrfRmBEyPbBvOwk3
TLSH
T16772C2CE9F102647C6660377B4CAE3916DA4A12D872BEB472BA50464AE42609A861F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.gubuktogel/databases/google_app_measurement_local.db
Size 16KB
SHA256 a8fbe799dd4ed0dcca41b56f9e9128749a4acf26d094d623325edfbc62ea9fc1
MD5 d35ba79bd55f4f1d1aa25f52756e03cf
SHA1 2eeae211f03e46727c386f0326ca0cd259155b7d
SHA512 5541bb125f2d544d75ec50552e2830a4c892f870f31c7924756fcdc3050d8739521fd56c881043eb135fa9726c444654307789cec86ef0d0c9e7d8b60800a6e1
SSDEEP 3:qqb/NjghzY+/lzyliMlTXmmjs/ztJzMlklKllgIn:LCM+/lulvl6m0JQlrf
TLSH
T1667292917181C706E2278234628B97F22430A2802E12821AB80196081C822C16B16626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.gubuktogel/databases/google_app_measurement_local.db
Size 16KB
SHA256 499fa1d0ac18cd6c268749b01944af50f72c4e18a12d4483a369e49bfe303d3f
MD5 b86a6d66c208910ac93b6e7655137b33
SHA1 715cb7b88d749bde59da93b0dfc4c85cd1dfe71b
SHA512 73813a0ed48c5cf3a82bf7576be017b021e0b482bd05c9bd3d1ddbeefda0b819c1d2e098b73848f0f7ad7e928b2e83cb6599e084da217a524181d8da192c4b93
SSDEEP 6:rLP/gEhV71m/9blDqlrElvlmNQlr21CM+/lulvl6m0JQlrf:rr/gW49blqYFlbQ+/0Fl6ta7
TLSH
T1E3725EE1B164C706F7274B3861CBE2E2303931521F13C219B802AF0D1DC67D25626B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.gubuktogel/databases/google_app_measurement_local.db
Size 16KB
SHA256 aa341507f177390a2a58980290a1dfc9fc70f85cbeb2496999c2f7af5cd991d0
MD5 f08ed431332a5af0736805c3c6008f48
SHA1 550d9abc7335bda95bc9cd1a3c27d593f1f5dde2
SHA512 b55bf2e952970b5951a61176d71abdac886031987eb633e0e58b7138f793e559fde2a6fbce392c84f0db8e9023a4960a0c0dbadc247c627d6c55c8d9ffd589ac
SSDEEP 12:qolhOLauAUZw2qc7UyWlg8va49blqYFlbQ+/0Fl6ta7:qovKaufEe499FqlFN
TLSH
T122726CD1B1A9C616F3734A3851E7DAD1353A35A21F13D3167C069B0D19827928661717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.gubuktogel/databases/google_app_measurement_local.db
Size 16KB
SHA256 acd277fe28ca870a6f9c00c24295ae3787fbd3cc48448f003d4ab57ed3529b10
MD5 80479b1be22c027a9a918f1fddae0f69
SHA1 9be97f1983ef6d94ed172630a369d08cbbb28a8f
SHA512 8ef08c9500bf2646c22433a7bcd187ffd66625e284c1e31d848cc39f6e4fb581cd61b2534e9f7f5dda248df3a113abbc61ca122820248daefab4b741058ef709
SSDEEP 12:a6olhOLauAUZw2qc7UyWlg8va49blqYFlbQ+/0Fl6tav:a6ovKaufEe499FqlFN
TLSH
T13872ECD0B1A8C616F3734A3C51E7DAD1353A31B30F13D3157802AF0D19823928231712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.gubuktogel/databases/google_app_measurement_local.db
Size 16KB
SHA256 f66894ddf922e0c7488228e52fafad4f1d1fc79f13a43e9239b909764fd5de37
MD5 2a3ed542d084bac60de4bf87494f61a6
SHA1 cb57d963063f80299126e096873a15b67ce1b61c
SHA512 b85c966ee450db26330f0cf68a32adcb8133c6bc0558d32171ce7aa5bc258b84fd54be905b9e5ec7eda7982c42b6048c63db692b30b5b1f7ae7a620a2952f39a
SSDEEP 3:o1MbX6lXXl1:oMWj
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.gubuktogel/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 a8e25b6021b129aa4b39974e9eba483397e787d50a48ab767c72033450dc4c81
MD5 ccc1bebe8dcb064856373d8de47b7194
SHA1 b08beb04016e2a83ef61dba9a4a97f547022a8d0
SHA512 6cbdf1cd9dbbb65a7bb46e65061674d5712907f46722d9eb0b8d4b58123ee2df038f73daf1164a3934400e3407ff19c8982f5ca18f9e50c307391ec4ebb8e62b
MD5 SHA1 SHA512

Submit Download