5da0f3299b2c3b703c84e4c2c80e3619d10c3da8c05c962de0d966ce3f578df0

Analysis

max time kernel
148s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
22/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app.apk
Size 19.6MB
Sample260922-phfvcsvfnc
SHA256 5da0f3299b2c3b703c84e4c2c80e3619d10c3da8c05c962de0d966ce3f578df0
MD5 17862d7dbe0e9e92b775e1536b4d19fe
SHA1 0eec319835814c697599dbd777895b07949f28bb
SHA512 1bf4dd465079e0f553e5c0bb13efc3edc11c0784d3f6ea9eb391cadeac798ebc8127cda668929969b027637494f2a101cf7a0de0d8f3e31cc6db68e3c0b09bd6
SSDEEP 393216:rr0Gm5b1CcMLRbMEr8G4+ujF1mhMFytwHgU:Lm1dGGjF1maF5T
TLSH
T16C272346FBD86E1EDC3740324B9A53359A09BE26C742CB47D964371C793BAE00E853E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sa.fiscalcenter
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sa.fiscalcenter

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.sa.fiscalcenter

Queries account information for other applications stored on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.sa.fiscalcenter
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.sa.fiscalcenter:guardian

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.sa.fiscalcenter

Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.sa.fiscalcenter
Framework service call	android.app.IActivityManager.setServiceForeground	com.sa.fiscalcenter:guardian

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sa.fiscalcenter

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.sa.fiscalcenter

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.sa.fiscalcenter

Starts a process using built-in Unix shell 1 TTPs
Android's native Unix shell environment acts as an interpreter to execute scripting commands outside the standard runtime environment.
execution

Unix Shell
T1623.001

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.sa.fiscalcenter

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.sa.fiscalcenter

com.sa.fiscalcenter
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4695
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:5128
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:5146
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:5175
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5199
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:5216
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:5233
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5257
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:5274
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:5290
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:5336
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:5353
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:5369
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5393
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:5409
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:5426
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5451
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:5468
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:5484
- logcat -d -t 120 CoreService:* ContentSyncService:* WebSocketClient:* HonorProtect:* HuaweiProtect:* OppoProtect:* XiaomiProtect:* VivoProtect:*
  2⤵
  PID:5511
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:5532
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:5549
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:5565
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5589
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:5605
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:5621
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5645
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:5661
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:5677
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:5705
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:5722
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:5738
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5762
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:5779
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:5795
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5819
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:5835
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:5852
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:5892
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:5908
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:5924
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5949
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:5965
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:5981
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:6005
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:6022
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:6038
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:6066
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:6083
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:6099
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:6123
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:6140
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:6156
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:6180
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:6196
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:6212
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:6248
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:6264
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:6280
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:6304
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:6320
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:6336
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:6360
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:6376
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:6392

com.sa.fiscalcenter:guardian
1⤵
- Queries account information for other applications stored on the device
- Makes use of the framework's foreground persistence service
PID:4949
- sh -c settings put secure enabled_accessibility_services com.sa.fiscalcenter/com.mygov.services.service.ContentSyncService && settings put secure accessibility_enabled 1
  2⤵
  PID:5057
- - /system/bin/sh /system/bin/settings put secure enabled_accessibility_services com.sa.fiscalcenter/com.mygov.services.service.ContentSyncService
    3⤵
    PID:5075
  - - cmd settings put secure enabled_accessibility_services com.sa.fiscalcenter/com.mygov.services.service.ContentSyncService
      4⤵
      PID:5091

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Command and Scripting Interpreter

T1623

Unix Shell

T1623.001

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

keepalive.log

Path /data/data/com.sa.fiscalcenter/files/keepalive/keepalive.log
Size 296B
SHA256 8c35cbef57aa95499403461720fd72cc4d881b0d9d6ac64bafbe6a7e9688e457
MD5 7399d447de1672a3fcb87529deee6c96
SHA1 a8ef1e7e913581d81ad839d255cc2d7dcda8a6f4
SHA512 e8ae282311fbcc7154f6130d935667ca24320b953ea3b950fb764d79c2711f7bdd1dfb84382de18c367281d562b6a9f013256ca66d13ac3cdbd280f862c7da51
TLSH
T117E012544078A50AD2FA05B11F56C10CA104B534228882D8DE20D71D4CA32E8F8DD3C2
MD5 SHA1 SHA512 TLSH

Submit Download

keepalive.log

Path /data/data/com.sa.fiscalcenter/files/keepalive/keepalive.log
Size 399B
SHA256 8cae4e8c4ab0c627981e845448fb911d9849973df0f8390b5d4ca8b7fc84e103
MD5 2d3da9ce61cb9ea6a1f0c58d8aabf5c7
SHA1 077bc3a693a805cf08b0e92cc9c7d59fc92d0d6f
SHA512 fbb76d5f264ca9aa04ff77c0256c87e6e74005fc59caf872061464f2b7ff9deb6e6d0dcae84e8667ef95dce4d75a1926fa7dd9bd0fd0fdbfe398816e805d1f2f
TLSH
T1E8E0921514A1A256C27AC1716E96821C8900A53492C461853BBCE32C88FA3ACE8AA3D2
MD5 SHA1 SHA512 TLSH

Submit Download

keepalive.log

Path /data/data/com.sa.fiscalcenter/files/keepalive/keepalive.log
Size 497B
SHA256 7cc679a378476e51e82995c96c34f3debca6f8b71e3683a1d82fcfba95d67d14
MD5 68d2368ec24053b0ff5f96996b98858a
SHA1 8278c2d28c3c1035519b17be5678581a26d3efb9
SHA512 38f5ef1f46640d7be2d705dd39e8d790ce1c6ed53e97b20256cb691d4d61d23b919f491c5a837e390e6deff983156c629a2e8d61ba227975b9a3fccf4198d94e
TLSH
T169F0122FC060D107D4BA343B3E45511D0143B270B4404AB0F724E6C82D57059DC8D3DC
MD5 SHA1 SHA512 TLSH

Submit Download

keepalive.log

Path /data/data/com.sa.fiscalcenter/files/keepalive/keepalive.log
Size 1KB
SHA256 9a00120201e8338f03c73eb7633e52b427c21d25c5f3c7f803aadbfe38028835
MD5 630c3e820ae56ee4b3febadb80300b88
SHA1 6ef2b3600e074116c5be894dada47bdfdc9caccf
SHA512 7c3a8e951a3c3f5c3914026a41fec20d9af2b8d413efadd4ddcdd5efaad73c3a60dbe7023d12bd34a40e587dabd3ca9db42eb2dce88387a296450e66eb933d5f
TLSH
T1751192101CA8F21BD1A9807426E90228B338A531848083182AF4A2BD8CD73B91C6A2D6
MD5 SHA1 SHA512 TLSH

Submit Download

keepalive.log

Path /data/data/com.sa.fiscalcenter/files/keepalive/keepalive.log
Size 104B
SHA256 7660f386bce82f68be739e46d929e16e885b2e7d5c9a20ae537ee77883520c16
MD5 eb76cd93e0b4090fa217a5b4d66c6d95
SHA1 e4f3d0d15805afee6a990dfc3f2801ca0d205505
SHA512 f4f204b4f20ddcf67fd81cdace9212bbd1e0fdef105b5734684c4737cf7dad01bd2d5ea31cc45b80c01a1dea1523c16df6aff96c1d0fd96f7d17d31448109186
TLSH
T13CB01238017FF55F007E02113724579E5545E36C43BC4ED45D30F14E0CC227500993B6
MD5 SHA1 SHA512 TLSH

Submit Download

keepalive.log

Path /data/data/com.sa.fiscalcenter/files/keepalive/keepalive.log
Size 204B
SHA256 4a776ee616a70f6f3863e61ad9e51557dac78d33b1a51cad025c355149cfc3ea
MD5 9690a576b08801d69978d3e45c4505c3
SHA1 a33c7b4eea7edad109bbbf4482d4d352cba9531b
SHA512 d8e875f2feff0608a61f01ad66868f546485b3be997e05a0438c917aaf8d5c26ed2efe3278989391d1893d232ae5e10a0855bdfc5b20df5598cb4fc8900b2863
TLSH
T121D0121C2CE9E767C17A07737F7B612D8344B1284098A2345EB1F10D0CE187C404E381
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path /data/data/com.sa.fiscalcenter/files/lockpwd_logs/debug.log
Size 63B
SHA256 f6c7cfe6fadb416cdfd61efe2c89b54b1444733196f8044a43d78d7d42377b0c
MD5 1678b2f9e3314ad596417e715b28b26f
SHA1 9734a527b245f4ef56c70a13d244445cad13be43
SHA512 06cd28f7883b5c819d48e5d852c26afc0a1f7a2df787360a39340e84b4d9c45c85110cc4d08ec639df91f0448a3cb682684658eb9883ff15d48f159c8c965379
TLSH
T184A002D996181491894989C5955580E008B6452CF374945D215C99F05189A892B916A2
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path /data/data/com.sa.fiscalcenter/files/lockpwd_logs/debug.log
Size 66B
SHA256 a8d4d38a563d89d68d71a2653c9e884e3dc910a067329e01188fff6d74c120ca
MD5 2dcc6b0ded197db3debc9334125d09a5
SHA1 55f09e8b16b0c1dc0405fb44e5e38162604f045b
SHA512 2b1223b2f7a0e39e80c8bd19a49cfe660665276f267364cc3fa5b73069b47ad0b8f1744ef1623c17a1d7b3d95250f4a352bdc7c93834c56353ff9544556725b9
TLSH
T1DDA022CA08000080B2C8F3A03003E20008302F080023C00CE0ACF03033B8800A008800
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path /data/data/com.sa.fiscalcenter/files/lockpwd_logs/debug.log
Size 111B
SHA256 df9ccdd370f06567b26baf4a83d2ce06d7b24679be7e90db130ece49aaf1035b
MD5 cc940d075bb79ee404f9af38ba4fd069
SHA1 8fbb0045a651947d951075ff6fac204454df577f
SHA512 0ca610599950c65a6406d079e16dcd10ecd46d89338ccb9340b965d0c155b3c5aab26130b819db8a329e940f6fbf5b0fc3a2720c3d55656b99869281055334b9
TLSH
T1A2B0144513743C5D344D33C0155304011CF713CD553554C1FFF10C475555C44115D4D3
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path /data/data/com.sa.fiscalcenter/files/lockpwd_logs/debug.log
Size 71B
SHA256 630707f76058c833bd10aa038096af99d1d747fd554e2dedf7a9c7574a50015c
MD5 33f25e3e8ce60bd598834e22bc8116d8
SHA1 46ce92dfdcdc934345b767b7420272e5fb65992c
SHA512 aab922e34f60af42c979171a476ae8b0e7b335149d6cb22e7cd07d920aeae513de11eebd2cd192f94a4fa1305503018ac52d72d7587ea3fe6b92e69cc33e0f09
TLSH
T148A0228C0A23203A200C0B3300330C0028320000AB30E023A82008B0EA0EA0303F8EE3
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path /data/data/com.sa.fiscalcenter/files/lockpwd_logs/debug.log
Size 117B
SHA256 9657cfaec56237151db19c90dba8212603050b49655fbac6567ac3801543312e
MD5 85d06eb58aadab2b0fe404189a41ad4b
SHA1 19b05292e65885aab43fd484c6db08d8c49823c2
SHA512 aa6a659237d78e0167aa451cd69ae869ab3a3881ebef7230352c8ccbce09e08d0d23664a9bcaeca29dc6fcc90a3115f45ad0a843ce5d4cd8d5a957041848d7a3
TLSH
T19CB09239233044A5214FA240381A3C18C4207282C7304C820B8176BBEB0F902C3B6BDD
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path /data/data/com.sa.fiscalcenter/files/lockpwd_logs/debug.log
Size 117B
SHA256 1ba51f092cc9ee79d24abf285e7bde3e1942f97094e172fb2bf7a8cdba9d0180
MD5 4089f9c652c10447fcd572a9c66b952f
SHA1 56f8a3f0483fd6957e28de6a8dd5b58d6232071e
SHA512 57cc62c5a701f366a7191eeab766bf4ccf30216a50bcb09a3b40c1d19141c6caabf9bb99ec7daebbaee4eed48e7c004002a4b8137a10ff9dfc2e572abce20bb7
TLSH
T107B09B8C22141C7A361D5794116545115897528E17255445AD650886954084501F5897
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.sa.fiscalcenter/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 fa1c5f4806f45660d33489ebb1fc8b42baf1e3bb27b0360fb044b944d9c9fd23
MD5 3ec9b6ff65228d0388390b05b4df8fe7
SHA1 f37f7a7777398c9a8d13c0f13f9b3b084a7aad7f
SHA512 8f60b7fb3bd2a71a96290aedcf29e93557f754018a1c191d83e0145ba4aaaf453b423507e94def83f4661f388305b7e6182b5310d1c5fe83b5bbe1b7b3d73619
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.sa.fiscalcenter/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.sa.fiscalcenter/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 0eb51c742db677defa1013539127fbccc6f17644466d27ded507e5caec7f2bbe
MD5 0fe06b004a7d276472bf87749cd2a6de
SHA1 e40bdec3d6e6e9e08c9da321177667c1a4c7f85f
SHA512 b88272bf20003a5a516f51db1c53248552246a7957125c107ea6b9e7439dff8b2f571fe705cb7ce635c988c3e538d81386ba87006393bfafe90f2fd39f092779
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.sa.fiscalcenter/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.sa.fiscalcenter/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 f93596bd202bf2a38c6253704c77806d1fd03bb3e773beffbe3f25afb397a486
MD5 de36b944a4847f316b935438d5974e4c
SHA1 fc1cb15067fb84ecdb6e2c13f7ed34ff19b815dd
SHA512 33090a0193a3e2a8a7071f4e746a25c58fed2ba18780483aa4289205da04295adfbf0ed8d7d7cba30dbcc320ee0f2bae2da339afcb7a2df276bd1dd71fe1b541
SSDEEP 6:KqTtPOgktPy9+lMy9FZde/kPlOERX4PBX4ogLugMBX4suuK+/OtP3sYtPFQvRtP+:Kq2btfW8zdeWRmBEyPbP/UPs60vOw2
TLSH
T1DE72C2C4A3A00A73D10A0F72EA94C3402E50571EBAF2C7275AA244506D42BC8A6A0D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.sa.fiscalcenter/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 7cf98bf0709630cc54577b71ba70134b334ed2cc3deaf86cdf4eae57b81029fc
MD5 f3f9a8b4fdb8d5143ec80b25f9d098c8
SHA1 cb3cacd31d85c5fa55e8f88f53c56c6a000cdac6
SHA512 2dcc07e2c9fca43819557bc734c05a09abaff06b9be587403ed36f2c09450fa61c0c2598d2d6ea1c5af3ae975ce18338abbb60aad84d0ef87c452445c204c573
SSDEEP 192:h5wR4md+12hTPJ8xCOWOxv6crH+fxUtidjnfWzzb83zSNde+ZD86u0ED:I5kXtidjnfWzzb83zSNdhZD86u0ED
TLSH
T176C325CD0F292610C09A58B1DAD00FB17D3E412EEBF3E3E165924075ADD2961DE29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.sa.fiscalcenter/no_backup/androidx.work.workdb-wal
Size 205KB
SHA256 c1a889e30a11dc731293c620a5d67dfd619107fab9f5a0c49d22af47c92a34b2
MD5 0aeb9cdcd0344463701c66d3d19358e8
SHA1 e1afaf93b95203ca8e13c94e2f9a4688f0b31c82
SHA512 f2b9a3c2c356f4f5affa41d563a47da610218197428fd5fdcb2a7aa4ada2ad73525dcae210e45cf682e7489f3b06bb488ced310a56b1a30b3639f01c1fb02f3e
SSDEEP 384:F21DtYHfpDTc+W21DtYmIaG21DtY421DtYCc21DtYfF:SDtYbDtY4DtYRDtYC9DtYfF
TLSH
T1CB249CC4FA55857EC00F0D3EEDA643B426B45DE98DBC29A01362D373B5E388D19D48A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.sa.fiscalcenter/primary.prof
Size 6KB
SHA256 5a87c3dd4d64315189a92c328a9c2a3e5355775e61137011951719e9f18f7827
MD5 d36266a16ec44af98c283609ecc6e610
SHA1 5189f7b1c3e44bf83a0fcfab9c73751fd50eefa6
SHA512 e6a0e2033bc0026166cfe12efb382c8e3e1f31c9246eb44ffc3c75805eaae46d7d6d1aeef2822ccb74df376ddb358942109189f5cbcb245a683d8577e12cc0ec
SSDEEP 192:rjK2UbwMHkJqr/sjnuxOamKPwnukBnIeY:rj+bdqoDPwuKVY
TLSH
T119E16D1A4F71784FECBC2F2354DA0BA6EEB71361D40241798569884291563A47FF7E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.sa.fiscalcenter/primary.prof
Size 10KB
SHA256 38ff1150c41948309aac71382cdebb311dcccff1e7f0f24bd79815294fc21207
MD5 2d3d0f5c65d61c14972a512b7bb63740
SHA1 8aaff0f12f7fd479859b42891371f9e371826caa
SHA512 fca5c0183d328ed84e742531c06b25ba4f05445f4a88c5e82e29fc83a975dfda01bd838ebe69fd862d30c6699a8aaad7679319fbc71c9592b634ca1fdcac5597
SSDEEP 192:c1PPOY1Y0TODZ/mHjz/5lEyfow3s7HT2GnnEYH5Kv2lRgY7UoZR6:cpPOY1ilmf/YprT2GnED2bgYgoO
TLSH
T149229E1F14129A64542BD1E0F5AA6909133F352611449C478D392E21F6B42B8BDFFA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads