287962fc495e60daddbc524403e9ab7aae812c64e5cf38cab46dae09a17e687c

Resubmissions

16/09/2026, 04:37

260916-e8ttsshf687

20/08/2026, 07:01

260820-htjbasvsdt7

20/08/2026, 06:41

260820-hfr2aafp9s7

20/08/2026, 06:37

260820-hdyq2sfp7s7

Analysis

max time kernel
147s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
16/09/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dbliqgnjl.apk
Size 3.4MB
Sample260916-e8ttsshf68
SHA256 287962fc495e60daddbc524403e9ab7aae812c64e5cf38cab46dae09a17e687c
MD5 398074545079641f3db99fdef958d9de
SHA1 4b878d4dfec71e4a37709a46acfe20a73de6648e
SHA512 ec3a26483dffff3b997a4a6c824a78e50094923239268ccd3e561efcc90fe5c15153e831d2efdc577531e1306f6505466566935db0b4b41fcf3fbaccd583e092
SSDEEP 98304:LTm1E1M3tGkrrd+6OD9XXAe6X74gbabu1HTiX1:LLmrS9geE0gbKIiF
TLSH
T181F5EF86F769A72FC87645334DFA82311216AC03CE43A7477548736C78B76A80F99BD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection defense_evasion discovery execution persistence

Malware Config

Signatures

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	businessapp.customer

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	businessapp.customer

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	businessapp.customer

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	businessapp.customer

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	businessapp.customer

businessapp.customer
1⤵
- Reads the content of the SMS messages.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4742

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation4268623062149105629tmp

Path /data/data/businessapp.customer/files/PersistedInstallation4268623062149105629tmp
Size 569B
SHA256 0ee91ca85740c3aa93181e6ecf99056d0439b346c09c5a11fff987af6720a6d7
MD5 d5effdf717a7672e392460ec6461a592
SHA1 37d270fd9de3c64b9958ee1b4ff94779ec8a159c
SHA512 70a2bd58108f2ea7c0fd89d50b8c0481994a2c8372f63e6d574f880d70c68e0ed54fc6b95c1c882efc8186c9d2a378375886a4c39414c5c17505aff173994a6f
TLSH
T177F0E1991E245E0890DC7782344C9E125E5505E4483F06E82BDB4429A9E5E7AA34B645
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation5170730859899469006tmp

Path /data/data/businessapp.customer/files/PersistedInstallation5170730859899469006tmp
Size 90B
SHA256 dddeb9438f122f0b996115f8d2ed164bbf61d6f922c31152352a0653c885fd24
MD5 cd274aecf38ed0373a81588571c62450
SHA1 0e653657a30e8ebd08b50616c2dd97bbf0a78a3f
SHA512 3b54fe29dc675ee789fde15829dda47abf7f27e74e51b0423a3f1fffb1b70a8df2e603b4d0bde53428a1b83fa0511800b7582a7033059b4d4e4405f7aca3d020
TLSH
T1CDB012404B75455184D5B3033C8C92012E9024800509CF680A08945540D33D58303D94
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo5NDA1MDIzNzMwNzI6YW5kcm9pZDpkMzZlNWE4NGYwN2NjMmM5YzZjNGQ1.preferences_pb.tmp

Path /data/data/businessapp.customer/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo5NDA1MDIzNzMwNzI6YW5kcm9pZDpkMzZlNWE4NGYwN2NjMmM5YzZjNGQ1.preferences_pb.tmp
Size 338B
SHA256 b0a1cee00784ffae5567b189483cb43783dec448e35a4af09ee87c23aac18091
MD5 ab93c265b2db33c751542ade556f3a1e
SHA1 57616fcfc5d4ffb5b2249db93399758eb8c939de
SHA512 1fb6cf14bd5c688f23da4e0244d11ef9baed8caca7c0d6a98b4fa90aed3e3693278d0e3d6a02b0e8dc740d43e73173528639beb8943106a596121906b7874b24
TLSH
T1B6E02610E7E299E2242F518D7F98061C0F6FB393223A069A35B40184B94A649D1C6F0A
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo5NDA1MDIzNzMwNzI6YW5kcm9pZDpkMzZlNWE4NGYwN2NjMmM5YzZjNGQ1.preferences_pb.tmp

Path /data/data/businessapp.customer/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo5NDA1MDIzNzMwNzI6YW5kcm9pZDpkMzZlNWE4NGYwN2NjMmM5YzZjNGQ1.preferences_pb.tmp
Size 362B
SHA256 4c95617d4ad0f4a54a4ec28eececed708db5828ab4ede893d868e99b2da094ca
MD5 87d41cf5191c0ec105524efdc20a30ff
SHA1 611c386bce5aa6e8119c67986445f54429f4c24e
SHA512 4a09dc450859aaa581e9a6835f079c302b01c931f8639067766ebd122a40f552f607770ad20e864c70ee01153044e2c00a3c7aad394f7db0ee4c87d820e2d2a3
TLSH
T1A5E0D810E6E299D2242F514D7F94061C0F6F7393227A469A25B80184B94A649D5C6F1A
MD5 SHA1 SHA512 TLSH

Submit Download

app-datastore.preferences_pb.tmp

Path /data/data/businessapp.customer/files/datastore/app-datastore.preferences_pb.tmp
Size 34B
SHA256 d62565d2ac905ae91e99d1053f8d6898e853d56160cc48108999f6ca6a06f4be
MD5 11dd8c1e6b13cf4470b62cefcadc766c
SHA1 f9c8178bb10e1776ce722ed2a87f24ed111c49ae
SHA512 cae743c2157993e1712183480e684de76871bf9d81100b0f545c10f8d7bf10840ee56fe3858cf7198c0f669343de167d896aae38d780f2a0496516232f069d7b
MD5 SHA1 SHA512

Submit Download

app-datastore.preferences_pb.tmp

Path /data/data/businessapp.customer/files/datastore/app-datastore.preferences_pb.tmp
Size 65B
SHA256 85d653c2d780542e4fc461683ba9699552b0705a1b75c728e3fc77599a23305f
MD5 d7fb11cf066664d91a260180109a5585
SHA1 adb02538c97a46dcfe7dd5128a60255a5c526f75
SHA512 b97bdae33122011d36ea12aea9bf56fd1ebf92e5a21ae93ca40527ec189a4f673ed5c36339faa194a88ef146534c4f51fc148c6ee899d99aba11eb1f254216ef
TLSH
T16DA022C0FE0323EB0CC38C80F030008003A23880380CAAC83AB0083832E0A3A0083303
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/businessapp.customer/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 888dd71f02b41fcf46709be7ee95cf0df6289c76f31b8380c8a1c53855879254
MD5 32ca65fd8c44dd7c73d120df9b68acc7
SHA1 5eb0b44963b6b888d48ad96325639995f68108c1
SHA512 8791f20ba20d01a7cbb4ca762838b26ad8dca3dae354770f5aac5cd671b1dff13deedadf6002700c29d8ef07256c365968f245caab5b8f15579d4baf88ce845a
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/businessapp.customer/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/businessapp.customer/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 240129e4adcde8f7ce4ae55b08b8d4916b26e05e9097fd9687e80d50db7d04a9
MD5 dee13f4eb794248f708c7a69f6f28cb9
SHA1 f34ede9c22a72616966e3ec7df13a361d3c0e60e
SHA512 d7f394f63e7d6794f1802a96832471fb1b1f370f3661a8acb2a703541f446d46b037eb010e29e44360f06c9c75b7807a58d082c860f8740b30c48eb034b06c07
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/businessapp.customer/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/businessapp.customer/no_backup/androidx.work.workdb-wal
Size 297KB
SHA256 d4d66a4ca3c04326a441edbab2b6911a10bcd120870810c7f4af616301cecc37
MD5 efe87e8f96e4fa8bbac3531f16375616
SHA1 f91e06406708e95f7bd670e586e4194bf55138a6
SHA512 1f5d3f870e08f3b631ec2ba923b5f3b4f28581a48b1da128847eec39086f64b484a0be5b726bcc4af4f8c25539602c95d6ab551a2a6971983d72cb2f2277a7d2
SSDEEP 768:f2fWz03zSbXD86ykwcIwBDrawcr3wCrlwfrlwSHwx1wBwx:f3SzSbXDHxI0Dravr3prlgrlzHK1QY
TLSH
T12454E88C6F941520D814B374FEEC03A568BF9A7D434E93D23220A12B5EF3864556ABFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/businessapp.customer/primary.prof
Size 2KB
SHA256 a23d500d653d60bc0802ac00dc37d9f256d7d07614e2718516a90ff8dae50f09
MD5 1b20afe43805bd218e21aa3cc6b7b54c
SHA1 f0d673151ca46289459ae87abee3d5e4a551b5e9
SHA512 c6af9f97b534ed73c26f4edf26f43ac23f9574c4c6a3971bd296602b3484d664bc1788f6a0c8f44e98cfbcb567f66a5ec398cf35c19a7bfb9e55a26f4facb9a7
TLSH
T17D414CC0C6A37447D661815478D103339CA7A8A73D7DCAC6268CD191E9FD02B501EEF6
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads