Analysis
- user interaction
yes - max time kernel
291s - max time network
304s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
- submitted
07/09/2026, 22:53
General
- Target phonecontrol-1.3.0_3fjY4H.apk
- Size 58.3MB
- Sample260907-2tx91avyd1
- SHA256 63e0c591bc35f9603bf51c9632d59dbbfbdc9556cf61fa1ed429fbe9a0cf8a78
Malware Config
Signatures
- Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Acquires the wake lock 1 IoCs
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
- Queries information about active data network 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
com.phonecontrol.app1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
phone-control.db
phone-control.db-journal
phone-control.db-shm
phone-control.db-wal
phone-control.db-wal
PersistedInstallation4976368546874902388tmp
PersistedInstallation6874712629509469527tmp
FirebaseHeartBeatW0RFRkFVTFRd+MTo0MDE1MDA3ODcwMzg6YW5kcm9pZDo1NmRlMDViNTkwM2Y1NjYxNmFiZmNm.preferences_pb.tmp
FirebaseHeartBeatW0RFRkFVTFRd+MTo0MDE1MDA3ODcwMzg6YW5kcm9pZDo1NmRlMDViNTkwM2Y1NjYxNmFiZmNm.preferences_pb.tmp
profileinstaller_profileWrittenFor_lastUpdateTime.dat
androidx.work.workdb-journal
androidx.work.workdb-wal
androidx.work.workdb-wal
androidx.work.workdb-wal
primary.prof
primary.prof