Overview

overview

8

Static

static

6

Adani Gas ...de.apk

android-13-x64

8

Analysis

  • max time kernel
    58s
  • max time network
    154s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260708-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
  • submitted
    24/09/2026, 13:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Adani Gas Bill Update Side.apk
  • Size 6.7MB
  • Sample260924-qa283aeb39
  • SHA256 21b97b1b8e1b3489d403a278206e255d8fcb90a9584f58de9c4c79b63d67f305
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
    defense_evasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Declares services with permission to bind to the system 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests dangerous framework permissions 12 IoCs
  • Checks the presence of a debugger
    defense_evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • com.xwusuc.uryjwk
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4063

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events
        • Path /data/data/com.xwusuc.uryjwk/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 99f48f1613f6bf7f1c229ec91faacf3d736da364b13565546ca9304b31074be2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.xwusuc.uryjwk/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 4bb84ca8bc922ae9cadd42cd81af16e03bc9e6324be316c5659aee664dd8b625
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.xwusuc.uryjwk/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 7d73c3485d5e006202961e9afefb35e6434f69f50d36f1fec471a39799d25dfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.xwusuc.uryjwk/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 318fa634b150c108c2ec55fc90f6b2e12dc074524f8c9468130c403f290fff6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.xwusuc.uryjwk/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 d0ff5d42c7a3d7c7dc037f7e86dd514ff1dcb0d0b5269cdf5b2d0cf133c6d750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.xwusuc.uryjwk/databases/com.google.android.datatransport.events-journal
        • Size 20KB
        • SHA256 3d1571201c1c4f26edf23dc45b2af6271289903759ad901d91b3d01b62e96642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.xwusuc.uryjwk/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 476021992b0208c61850ab85af841f3872127d7929eeb66b2e571d9dd13bbd26
        • MD5 SHA1 SHA512
        Submit Download

        com.crashlytics.settings.json
        • Path /data/data/com.xwusuc.uryjwk/files/.crashlytics.v3/com.xwusuc.uryjwk/com.crashlytics.settings.json
        • Size 766B
        • SHA256 3c5aede2fd538569458787a1d5556f15eb37c54a070c13d086a15e27e42d70b9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        internal-keys
        • Path /data/data/com.xwusuc.uryjwk/files/.crashlytics.v3/com.xwusuc.uryjwk/open-sessions/6AB5649B011600010FDF850B913D6809/internal-keys
        • Size 107B
        • SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        report
        • Path /data/data/com.xwusuc.uryjwk/files/.crashlytics.v3/com.xwusuc.uryjwk/open-sessions/6AB5649B011600010FDF850B913D6809/report
        • Size 789B
        • SHA256 16eb04d69ec4b8225adba5beb93b1238a8e9abf561814460c3b5f2a17815b845
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation4083992288717736330tmp
        • Path /data/data/com.xwusuc.uryjwk/files/PersistedInstallation4083992288717736330tmp
        • Size 568B
        • SHA256 656b3c867d821a77050ef9ad7cf94774a462f1a25aa86257d3737eecddb58a03
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation7467230940127496316tmp
        • Path /data/data/com.xwusuc.uryjwk/files/PersistedInstallation7467230940127496316tmp
        • Size 90B
        • SHA256 e0c0cd4d26be78eeb3b38be52b7f8ea2f5c3ee4ced4dbb8cfc2de3602c2fab85
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FirebaseHeartBeatW0RFRkFVTFRd+MTo3NTk4MzA4NTAxOTQ6YW5kcm9pZDoyMjhlMGI5ZDk5NDVlNjM3Nzg5NDRi.preferences_pb.tmp
        • Path /data/data/com.xwusuc.uryjwk/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo3NTk4MzA4NTAxOTQ6YW5kcm9pZDoyMjhlMGI5ZDk5NDVlNjM3Nzg5NDRi.preferences_pb.tmp
        • Size 365B
        • SHA256 aee68cd9ac445053f4c9324cbd9eddf80e42b62aa9d94e111f703401ba823fd1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FirebaseHeartBeatW0RFRkFVTFRd+MTo3NTk4MzA4NTAxOTQ6YW5kcm9pZDoyMjhlMGI5ZDk5NDVlNjM3Nzg5NDRi.preferences_pb.tmp
        • Path /data/data/com.xwusuc.uryjwk/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo3NTk4MzA4NTAxOTQ6YW5kcm9pZDoyMjhlMGI5ZDk5NDVlNjM3Nzg5NDRi.preferences_pb.tmp
        • Size 341B
        • SHA256 854d32c2cf802777a84af81cca409873e8cfbb8ab7f76c74f301eeab12662450
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sessionConfigsDataStore.data.tmp
        • Path /data/data/com.xwusuc.uryjwk/files/datastore/firebaseSessions/sessionConfigsDataStore.data.tmp
        • Size 145B
        • SHA256 396ce18d0afaaa7839f03a6865f3b2c837abd907063b8540e69432a653fd6f8e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sessionDataStore.data.tmp
        • Path /data/data/com.xwusuc.uryjwk/files/datastore/firebaseSessions/sessionDataStore.data.tmp
        • Size 277B
        • SHA256 d95a4b029416222963cc4486652dcd5b7818d76ddbf50203ff1d67fbb609ce6a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        profileInstalled
        • Path /data/data/com.xwusuc.uryjwk/files/profileInstalled
        • Size 24B
        • SHA256 8af70b13f4150fc822acf02adfb9360877c95625df2fb516fbf265b669744527
        • MD5 SHA1 SHA512
        Submit Download

        profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Path /data/data/com.xwusuc.uryjwk/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 4318c55fd0cd897268715d7ca8d64ea4679d66bf51a7e72e7fb3f2de7d7e4420
        • MD5 SHA1 SHA512
        Submit Download

        stage.apk
        • Path /data/data/com.xwusuc.uryjwk/files/stage.apk
        • Size 3.5MB
        • SHA256 eee5ed4524b6f86c76420f983f4c6fa43bd44275e00cd5d36535002697330d95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        temp.bin
        • Path /data/data/com.xwusuc.uryjwk/files/temp.bin
        • Size 2.3MB
        • SHA256 0d83f071fbadea3edab468016b59df54a6014bb6b657af05afbd7194ab8af46e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb
        • Path /data/data/com.xwusuc.uryjwk/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/com.xwusuc.uryjwk/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 794abfba3e02eff7fb39e9d06fe36527e7b9d099556e4b4946490f6a0f457294
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/com.xwusuc.uryjwk/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.xwusuc.uryjwk/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 71e30f90b1d6fb673185a6396aefc287b60220ade93b75cf228623350e74cdd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.xwusuc.uryjwk/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 273e13752e1a1fd2ea57e59c29c4f3b0085315587d034fdf385bfa514a5c2684
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        primary.prof
        • Path /data/misc/profiles/cur/0/com.xwusuc.uryjwk/primary.prof
        • Size 5KB
        • SHA256 1fca31973153a6d80f2ed3185e22a1762afdc52faa4de2636094582d2c066191
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        primary.prof
        • Path /data/misc/profiles/cur/0/com.xwusuc.uryjwk/primary.prof
        • Size 8KB
        • SHA256 398c0e417672b0294d9ec57a2348fb9835fdc8cc96b751a4f4d6bca6fc8f4c16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download