Analysis
- max time kernel
2s - max time network
154s - platform
android-13_x64 - resource
android-33-x64-arm64-20260708-en - resource tags
arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system - submitted
10/09/2026, 11:29
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
com.spotify.music.apk
Resource
android-33-x64-arm64-20260708-en
6 signatures
150 seconds
General
- Target com.spotify.music.apk
- Size 62.9MB
- Sample260910-nlssnasdmb
- SHA256 4738b7817ef2abf180ba69a8d3970ba19907c0d475befe418028504a90a3155f
- MD5 3391746677b6295161a3394805ad84d7
- SHA1 ed6a0065b8c75fab4dc6a082c5f527737ea18a30
- SHA512 8244454c9955ee5c5e0e83cd4da80e6c51beaf61389f095392ecee37c95ddec95e435fb7fa299f92b4194512548f9b913b49b14f10da64d4b64aa78ee7d0b00e
- SSDEEP 1572864:CgXxCl/1Z39dUu2lEaxq9/5QWYWnIhY2Hym:CgXMl/1Ll2xxq9/5OYjm
- TLSH T17EE72356B75CA80BC5B7E872DD6A623570244CEC5E91E7276D24352D22F32C0CB6BBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /system/app/Superuser.apk com.spotify.music /system/xbin/su com.spotify.music - Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /system_ext/framework/androidx.window.extensions.jar 4175 com.spotify.music /system_ext/framework/androidx.window.extensions.jar 4175 com.spotify.music /system_ext/framework/androidx.window.sidecar.jar 4175 com.spotify.music /system_ext/framework/androidx.window.sidecar.jar 4175 com.spotify.music - Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.spotify.music - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.spotify.music - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.spotify.music - Checks the presence of a debugger
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.spotify.music/databases/com.google.android.datatransport.events
- Size 56KB
- SHA256 a6da6a76b478e0c0f9568748d6420e4dae4bd8f2a73d3ab0fe57c1c8c2efdce1
- MD5 95e3dccae2faa6b61a7d0abcff580399
- SHA1 12ad0432abb4b21b1126062792cf891865d0c3bd
- SHA512 d84c08df018d9f30cf6376bede6a971a9f2dee73e9a97a2c5aa7eff59cfa8baf709ef19cce5b6f6d8763741592a3581d848532b92803749c72dad8755437031a
- SSDEEP 48:TF59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPS4:9MEqzAiwIyNja4
- TLSH T1E843749D5E3C2220C57E283ED7E243635F3C93DF5B23922239948CFA8DC202975354A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.spotify.music/databases/com.google.android.datatransport.events-journal
- Size 512B
- SHA256 1117812197ee5610f4626c3430b74afc0997d061c38eb4e588b0929b75a49a36
- MD5 9874db4bec369d43cfcc31e5b3be5c65
- SHA1 d79c3bfd766d730873e868e0cfd169e8d0977dec
- SHA512 120f9692d64791d88f878e33e49460b1c53f3c4e557df1556673396c03a6d0c913c23fc5d72acd879c9a62ba1747fae69f53a440165ea0fd7c563b1281f66ad1
- MD5 SHA1 SHA512
- Path /data/data/com.spotify.music/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 283b8b1c12157760866f92738c0eddda6bdbe5c5b83e031d2cebf9f52a8daa80
- MD5 c81d029f6ca4041c608ca2341db402c0
- SHA1 ab85ae228d4ba9468cbddf1a7778d3b5af5a0071
- SHA512 ec38c0c7b4110d59bc34fc8e405f52cba0843be7d8e7167828cc3348276dc24b89728f2ec34111d6fb8202f905181d188680ef8ec3626fd90e7b6d603e099eda
- SSDEEP 6:7+/l9rEtmHn1YkWg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKwd7a:7+tJEt5kWqLiuWd7RmBEyPbre
- TLSH T1BE02229D67800813C81A9E77A0F483481D04A75CC2A2CB27159008962C034CCA4B0D68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.spotify.music/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 c59f8dbd60d3ee8f6675d817f1d205e4f84cbc8a202785a0dd1cafdc598b7951
- MD5 be4164efb4402f37f9c9bc9c1a526478
- SHA1 1f7ea158b83d8b741b5b3ec3779f35ffabaf35af
- SHA512 d9b26f3a9575487f01d9946e0ddc65ebbf2fe9821f26731624132ed1931ffab329d46fc7ba7bd0409f68e9af73946bde282dc4f376fc33e813098c60826bdfa5
- SSDEEP 6:7+/l9GPPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuK0U/OYR:7+t43qLJdKBRmBEyPbp0h
- TLSH T16B02809D67410913C52E5777A0D9C3551E11A725C3F3CB57595008547D476CCFC98E54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.spotify.music/files/PersistedInstallation3000119037707229889tmp
- Size 90B
- SHA256 bd92d25310360462614b98ef40c20bfc74cb33e384d2594b69abd0776febb87b
- MD5 a01fea812c9f3f4c497125399c608adb
- SHA1 5b8d39375570bebade62e7b02ba7769b9c1ee906
- SHA512 51ae0a193c875e43c75e79ff6e221069f77b003deca8359462f1115c1672b42b67d37115067752a14ff429d766eaa6a8fb6923126927fce06bcc3e68c7802149
- TLSH T151B012C05730435189A6F3462D8CE30C2D461C80061D8F560F09904040915E2D113DB4
- MD5 SHA1 SHA512 TLSH
- Path /system_ext/framework/androidx.window.extensions.jar
- Size 123KB
- SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
- MD5 3056e1bdb7d4e19789d0319eff484bd0
- SHA1 6791ae47aa9466fe0bca27ad6643f846853bbee4
- SHA512 c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658
- SSDEEP 3072:8Pmsa8v0v8FYNMhpjLXZ/pziNQdysk4p26PQ:Qmsa8vXhRLXXOQGJ
- TLSH T19DC31951FA4159A1DEAE933B959B1301AB30A648AB2383137654D0BCFCD73C39F87AD4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /system_ext/framework/androidx.window.sidecar.jar
- Size 25KB
- SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
- MD5 29469324e59dfcc052f24b5af4e7b2c4
- SHA1 10c1e17ac6f598037bb51baa07945663645de4eb
- SHA512 5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2
- SSDEEP 768:bjydnTmp8WNAupUuvkg5NrtsESOMXIpc3dRwQA0:bjydCpF0uhtsxOQIqdSj0
- TLSH T1A5C2F716E7400C63E9FF9A3B6A5B13009F35E3A4AA43471B640585A4BDC63D3D9EE7C8
- MD5 SHA1 SHA512 SSDEEP TLSH