61af149986db26f8e4d084e994cf43bc2595ed7668393401cef7a15afa999b57

Analysis

max time kernel
136s
max time network
155s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
06/09/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload.apk
Size 11.7MB
Sample260906-xpcehs1bkh
SHA256 61af149986db26f8e4d084e994cf43bc2595ed7668393401cef7a15afa999b57
MD5 5211d927bcb68146635773b50653fad5
SHA1 b99f803a41321d0453c54890306d0962fd3bf856
SHA512 6912ea9196e2cb8d6b72beca80bf59397764335418b35a3619a8ad3eaa201360becdf70c201d5f2ee233a9c3a017ae03f1a29084978a0e480eea12ba855fd902
SSDEEP 196608:pumbGH3c7oAXcdxm5TH9FfJr7ix7B8o+Kge0k91PRwnZ03LYmcwJYK4:pZ+zAaxmdH9FfJr7i1Oo1PRwZ03bcmY9
TLSH
T13AC61296F7C5986BC4F75332417A5272528B4D228B93C6D3AE04723C68B79D40F8EBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion persistence

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.Sam.RtoEchallan

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.Sam.RtoEchallan

com.Sam.RtoEchallan
1⤵
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5088

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.Sam.RtoEchallan/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.Sam.RtoEchallan/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 67ed2be43b59b9c152d2c9faafbb61fcb7b6957856f952f566cf76254ba292b7
MD5 fdcb286a368b7363647b2746a2d6cc90
SHA1 dfaab318434930dbb156e804aafc758d3f97eaa3
SHA512 b94680c2e94b39ce146df750cee19a4d2a20132c31e144b5d8f7ce7f7bfa564eb6f313c381b1976ba92143cdfecb2c59d29ebd4ae7575909b282dca5a532f2d5
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.Sam.RtoEchallan/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.Sam.RtoEchallan/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 aa4393e355c23ebef6d73289ba3a54c02c00fbda49e1e573cdcbfd7a61abef11
MD5 f672e58a8d430837043f229071c97504
SHA1 ab780d615e31d8d9febb85168c60fd5b32704bd7
SHA512 51ad63b48e00007066486a0133d33956c1ede75a0250f779eadae5e95c50d52964677d8234e8acef7e0759786efd9dbfd4a6143c9b0b836836ab14640b081b78
SSDEEP 12:KM2O+kcO+fzdTRmBEyPbP/3O+nHXb3x3Ow2:K4+A+fzyGSP/++nHXb312
TLSH
T17572C2947388369EC519473A40E8C3826D68A64EC322CBAB2A512CA57C03ECCE670D1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.Sam.RtoEchallan/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 4ed6f621e0713d5efd13a91a27a3417a5e6073c92f77fed9688fe15305ea4447
MD5 81d73c63a8919418ad068f805a9fc8c1
SHA1 fff68dc69cf785ad8030239abf4be68925a7c98a
SHA512 5fcdcd60ff2c0ed3cbeb2fb665ca1c351331bcfb2d9ddf7f250105f177e94dfd5a0f515382b99e384615874fc0767192607493c36ae4cbcdf184153ac19fdff8
SSDEEP 96:2EJahyTW4MDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:2EAhYNEndjnHt9S/f8JzSV+6D86T0ED
TLSH
T1EFB3108D2F5D3504C4A9A4B095E00FA1793E452ED393E3E1699104B5ADC7D21EF39CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.Sam.RtoEchallan/no_backup/androidx.work.workdb-wal
Size 120KB
SHA256 821d5d689565f586c2c58cfb8e891bdf3acf714882464a5edfc54f4e60299b74
MD5 d8e58f3532cde202fdfb2e860ae697d9
SHA1 088f7da89534b48b4fbcfc7952b9f776f6bfd96b
SHA512 23c1be13ac5d4f8c0a019a963b4a0c70fcc2621edce5c21e7339495e1589afad843b499f2b7e7245837ec2cc2c29a5e738cf0ccb9345f41df43a1566a0b46541
SSDEEP 3:Re2uX+CxTkHwzXtRKVjWMyO/euh0RADAvl/kqd0XllgoqKXtRKVjWn:42O+4oQ72Vt/n0mDAFkc0p2Vq
TLSH
T152C392F3361E251BD05007BCEA3F56D8060EDE5495C8AEF98C1E0FE52C21B889738885
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads