Analysis

  • max time kernel
    2s
  • max time network
    154s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260708-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
  • submitted
    10/09/2026, 11:29

General

  • Target
    com.spotify.music.apk
  • Size 62.9MB
  • Sample260910-nlssnasdmb
  • SHA256 4738b7817ef2abf180ba69a8d3970ba19907c0d475befe418028504a90a3155f
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks the presence of a debugger

Processes

  • com.spotify.music
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    PID:4175

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.spotify.music/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 a6da6a76b478e0c0f9568748d6420e4dae4bd8f2a73d3ab0fe57c1c8c2efdce1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.spotify.music/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 1117812197ee5610f4626c3430b74afc0997d061c38eb4e588b0929b75a49a36
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.spotify.music/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 283b8b1c12157760866f92738c0eddda6bdbe5c5b83e031d2cebf9f52a8daa80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.spotify.music/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 c59f8dbd60d3ee8f6675d817f1d205e4f84cbc8a202785a0dd1cafdc598b7951
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation3000119037707229889tmp

        • Path /data/data/com.spotify.music/files/PersistedInstallation3000119037707229889tmp
        • Size 90B
        • SHA256 bd92d25310360462614b98ef40c20bfc74cb33e384d2594b69abd0776febb87b
        • MD5 SHA1 SHA512 TLSH

        androidx.window.extensions.jar

        • Path /system_ext/framework/androidx.window.extensions.jar
        • Size 123KB
        • SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.window.sidecar.jar

        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 25KB
        • SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH