e5bb7e2b9f1a0d42af8f9285c403dac717997d4122a1eeccaafc3d166bfa2da7

Analysis

max time kernel
66s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
09/09/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
seyirTURK.apk
Size 19.9MB
Sample260909-wxedeahp7x
SHA256 e5bb7e2b9f1a0d42af8f9285c403dac717997d4122a1eeccaafc3d166bfa2da7
MD5 d1d09ac369b6f47b9b48c21456005a3c
SHA1 0ba95933f53d4b3b303be0228a686faa6203a06c
SHA512 e4373ff3269320899b6416e32f2644cc22859736280795af5f6929e1a040873f5e34fc89768343558d80489a38efaeb7875d52fe8b8aab17de328051a319c205
SSDEEP 393216:AqfLky6vSHWFXuKoAlQ6KM2XtrS+fBGe97DEOMlOXRFhikvCVkJizU:AgPU51ocKMEJpGUQlOhIyczU
TLSH
T15827229AF368A92EC5379032CDAA5273259B4D01E682D773A534730C79B39E08F45FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery evasion execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.swenauk.seyirturk
/system/xbin/su	com.swenauk.seyirturk

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4803	com.swenauk.seyirturk
/system_ext/framework/androidx.window.sidecar.jar	4803	com.swenauk.seyirturk

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.swenauk.seyirturk

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.swenauk.seyirturk

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.swenauk.seyirturk

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.swenauk.seyirturk

com.swenauk.seyirturk
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks memory information
PID:4803

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/user/0/com.swenauk.seyirturk/databases/com.google.android.datatransport.events
Size 56KB
SHA256 2628a0fe97c5bb47ba0f8b8ff87dc4ec114a5f3eb024ba54f6f34a1a92903209
MD5 3694c6efd99b513977b47b2c45ae91ec
SHA1 7840743f4a2a9b5eb7ed375ea5cb6fbe241f782a
SHA512 bda90ac3cc9305824f27f8f51c6718126fb64ca93e5c8ca30abc8797e4929181d47a9d827309c5d334dd21e20176bff6f5e96829e83ca17e08e17d49103c540e
SSDEEP 48:TP3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSeqFXfb9tFXfb0:7AMEX0wIyNjaeob9jb0
TLSH
T15143649E5B3C22B1C6ED283DD7E143A32B7C83DF57A2823139944DE58DC23657C254A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/com.swenauk.seyirturk/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 8fc0202fde2e0392355ebac7638a1e3227892ddec6150ca6ffb8cd0fdbc218c6
MD5 bfcac60576ffab6ab85c33d7e6de12d2
SHA1 953a4e5f4af1ff472a457f56372936654da8d26b
SHA512 0d722e7fd0f4e14328578657f0fc484d8e9cb7b3d40634fcef803a747a508ab49377459f9ba9783821fcfbb22fa3fefcebe0f3d30eaf9fa7054672c116b21cc4
SSDEEP 48:7MKwKq/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSmn:7KK0AMEX0wIyNjamn
TLSH
T199B2615D193C2222C5BE287FD7E20253593C53DF572392703EA48DFACEC2469B0355AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/com.swenauk.seyirturk/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 9fe93315c229cbe801791ca798eceb565df4716e4f465cc383ad7ccb608624a3
MD5 519a53d51a4086b30b1104b54995fd55
SHA1 351d530b11fac42368fadae0d423ef84d028f5b4
SHA512 d2f63ad32cb265855db27778a8922bd53782d055fde269f648d1bc0ef13b0835c5d04f0aae357a2bb25ff28c02df89527fd7a96d97042770e1d170c3cbc047ec
SSDEEP 48:7MgW4aZfdWPw6v+W6QWTWJqP3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPS0:7hW4aZVWPnGpTQkAMEX0wIyNja0
TLSH
T10972B66EAD2C2622C57E687ED3E20363993C53DF5B13A0303AD48DE94DC546AB0354AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/com.swenauk.seyirturk/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 3b93b8b946036a4ad536383db1ebb83daeb17a6d9cb977290722329f384cb3fe
MD5 ab0bd0ccdb908d62714b2d7d706fc56c
SHA1 3d5be18815a4539ff2139584e33478e5f11e85a0
SHA512 c594f2d12e776a866c3aae65ac8692cbb6b3b9b4002b679f9ab36771491725ee0f98e3d6246c118363f5b604c6845d40d5f94499977b7ade9e2cfe77d1da7ce9
SSDEEP 48:7MUVFXfb+Lq/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSZVcqv3g59MENZBdc:71bO0AMEX0wIyNjaEEAMEX0wIyNjap
TLSH
T11292629D5A3C2211C6BE283ED3E243A35D7C53DF572391703EA48CFACDC246AB0255A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/com.swenauk.seyirturk/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 7555b35b11d9528e8cf656693f2c98f7c32301e6779f78d31c8c8673eecab1c8
MD5 4b3eb1cfbf3a539eda4c72c0e5efb1c2
SHA1 c1654917b8f923a3fa15dc1c7f7cb64b178da2dc
SHA512 8dc6ac7b52f6c96c7f99b80dc8742f3d4909e6c3c01f1aac768d8d9439fdb709eeaf10d9efa0f576a1eb738e43c47de0c58d40f0ce5b8dd44be592c650af7479
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/com.swenauk.seyirturk/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 9c4ed461090af1d738c209a501e856c0b396ca3eb7212ebb0783b63ee5f561cc
MD5 31a4309b64a890b19dc7c93d32fe8cb8
SHA1 c6fd6d47297d50cda4347c39c2fc62752ad5c68a
SHA512 330306f2a58b484f8fe7703d4bfc54704d448a2885d2624dd72bcc2a21a81bcc94a723d28057b3eef2a196cfbf1016cd5cf4deb349c28b1488e9b535c4ec3421
SSDEEP 6:7+/l9pYn1dg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKK:7+tr0qLiuWdYRmBEyPbx
TLSH
T13A02C0CC67800833C82D3A77A8D483402E00E72CC271CB171AA108D4FC078CCE8B0D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/com.swenauk.seyirturk/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 e7074942ae85292cb6e88879764e1163fd965cd7ceac0610c17d9b4bbd5efad4
MD5 0b8249b15680d20654d5da8f38c058cf
SHA1 c4e9ab83c19e14a4df6e490155ed159e23a20eb6
SHA512 d0518a80e8bd42b91667cb7059ec4e8dd2957d9b606130b8aa0942988e06a0c3abf1d8c88a34c102fb59787f4208832f6b3fe186c0b13a5ffaa6cb08587dd172
SSDEEP 6:7+/l9JFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKeeSt/Y:7+tlqLJdeWRmBEyPbdeS1Y
TLSH
T1CF02128967810913C5395777A0D993541E24E739A273CB57269108796C466CCA891D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.swenauk.seyirturk/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
TLSH
T16D72C2CEDF102606C6760737F8CAE3A05DA4A22D833ADA476B950460AE42549A8A1F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.swenauk.seyirturk/databases/google_app_measurement_local.db
Size 16KB
SHA256 343377a354f660c897ca452b9e529dcb5853dbb75e3a74a39e65be83f0cb87f5
MD5 1f7eb307f014f99749a90679f4cc4a38
SHA1 316110e762ce6006665749c5aa9a993a69d1e5fc
SHA512 f5344247f401c752a70461d96aa11b0c018fd8479fb3e2f66637dc26681efd969a5529a5f2903961c020e748e46c93db340b2c09791867b2629def4c3a63f280
SSDEEP 12:TLiEq9zmzrfRmBEyPbP/P+/0Fl6xTa1o7:TL4pmzr0GSP/PlFl1M
TLSH
T1017268CC7B105703E1734736B0CF93E15C34A2184733DA0B7B450424AC42188A142F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.swenauk.seyirturk/databases/google_app_measurement_local.db
Size 16KB
SHA256 93126226ee8bd81342189eb1558d1d7e5caca2a75a003c59ea1b7fd99d18ddd8
MD5 93b8b98eed9b15cd7a505115ed32349c
SHA1 01e9545135bbe08b91e0c138b3f687f550e09d13
SHA512 907f89cdf4d26f7273951446a673746442bc1e3ab6a3ac30676ebf89d5ed7f015e371696d8db988de3715002155e0b88c89da68faf8f712fe3e97725b7264d26
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFlm0+/0Fl6xTa1o7:TLopmzr0GSP/h1499FhlFl1M
TLSH
T1597259897B109743F2734B35A0CBD3D16C3872265B23D6077E061A2C6D433855112F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.swenauk.seyirturk/databases/google_app_measurement_local.db
Size 16KB
SHA256 abd372ec672bbe6c6cb551779f4bb8405faee1c1d6a72f25879f3c2786721464
MD5 29b25e3d652b61a891d53d010483c22f
SHA1 d4083e91c9832f838fe5ecc3a03424abb53b5f42
SHA512 3ec38e2cb65cdfd279a1b39fb863548ada2cd7483db4529988231c0229eb49f312ce73eb029cda14c8ad34bd298b170995daedb3c75a71820abb8aa351b1f7bf
SSDEEP 24:TLYpmzr0GSP/Zxz32lZjgeLpf499FhlFl1M:TcArSP/Z532l3C593M
TLSH
T152729CC977A0D642F2734734A0DBE3D2683C31521F63960B7946272C2C833594122F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.swenauk.seyirturk/databases/google_app_measurement_local.db
Size 16KB
SHA256 260855a684c2f69b5f0ca92a1bfbf9d8651fec1a7aee09ac1f3b1cb1a1713b0a
MD5 1d68cd7fd19ef40a5d334aa3a6ced9f0
SHA1 192c2bda53d168b63bf580389e976f721f4dfa93
SHA512 a1dc61e771d78eb733444ada97199af5d8a392902e4e57f14f082c3bea14449467c58b252100ebf9334b07b9c607350d92ffc5f9e5967e8fba1a1ffa8a3cbe14
SSDEEP 24:TL6vpmzr0GSP/og36KabCCbjxz32lZjgeLpf499FhlFl1M:T2vArSP/oKvabCCbj532l3C593M
TLSH
T197728C88B2B4CA53F2B34B3991D7E7D2683C35921B27E7077D46271C6C833964122F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.swenauk.seyirturk/databases/google_app_measurement_local.db
Size 16KB
SHA256 5c59052a9931be8639cbad29da6ddf2e7d5875de9ae8d34004e99f4a45bf5e43
MD5 79d9e319b6fb4258eb4de624442f68d8
SHA1 b9f997ae8dc50495605ade48da9fbc7010d64727
SHA512 1cbe1db293bac426e50f48a7ef5923cc05f1daaac709e65c059e24773747533cffb0a5825622d3fa702d318f0beee35f007010d6d7b0a4e4e916e99d5f0dfad3
SSDEEP 6:l9bNFlS/Sls18GnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W/j:TL0WE79zmzrfRmBEyPbP/W
TLSH
T10A72C28D9F107603CAB6073278C993615C18622D83379A472B950870BE43489B091F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download