c2901193c0dd0f44ef76c36540810f05a9870d43bf3de9077e33d25d572ac550

Analysis

max time kernel
46s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260721-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260721-enlocale:en-usos:android-11-x64system
submitted
26/09/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UnTime.apk
Size 4.2MB
Sample260926-wygvxsys7q
SHA256 c2901193c0dd0f44ef76c36540810f05a9870d43bf3de9077e33d25d572ac550
MD5 71d23548eb01769c0b6d77f19b2be6ec
SHA1 dffb9a72eeeb175e833c14299095651125b13808
SHA512 37dd45137f4aeb372e18fc5b48f363c1b413a992928d396ac821ee8aa9f5359fa469f0c23871c808dbf6c2efecd7e38ea7e1825bfbe897a31a91d8af53b76250
SSDEEP 98304:LBP5/hEblgxXKk+ON759MuwrPhwzaDUa4buJn+l7L4E4C3sss:LBPBuuR3PN7vMuiWzagBS+Z4ENs
TLSH
T19E16E086F758AB2FC477403348EA8335225A8D17CE829B47A554376C78B76F84F49BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gravitek.untime

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gravitek.untime

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.gravitek.untime

com.gravitek.untime
1⤵
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4513

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tempora.db

Path /data/data/com.gravitek.untime/databases/tempora.db
Size 12KB
SHA256 d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e
MD5 171aedf968e17a2744d2585715606cb9
SHA1 bbeddeb3b89fcf809619c35b4a318a80e7d5b029
SHA512 78a0f517ee3d21c153dda6dbfec4187ebaee9d520d7b1b63f358bcb125d08aea53f26943907a56fdeba40161d9fc7e4fd63f9ae3154dd2ad887ba0162738285b
SSDEEP 6:l9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKTqiOw2:TLJdeWRmBEyPbsOw2
TLSH
T1104280D5E3401503C5255777A0C5C3940D60673D5733C74B669108547C437CCF890D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempora.db

Path /data/data/com.gravitek.untime/databases/tempora.db
Size 4KB
SHA256 fb2d2d7f4ccb2251604003206df006b69f41705f0b265ddec061ac6beb30dd95
MD5 b9e10ce4641ac1eb042b25c43bc3d8f3
SHA1 85c15efa83a28a083b900375dd8d8f90b307f22c
SHA512 ae8944f77dc535d10cde4970cd9966500686c4aecd3411d9eaa5d8d5d548e36a9e6be7225f30fadcf0d2d893fe976966ead7ea391bd89e2bcbbc55feeffa7ccc
TLSH
T120818C84A3C00D42C12A4273A0C983440D0162299221CB4B2AA20864BC439CCE4D0E04
MD5 SHA1 SHA512 TLSH

Submit Download

tempora.db-journal

Path /data/data/com.gravitek.untime/databases/tempora.db-journal
Size 512B
SHA256 fae1804abed8d811cd3b849be2be3f9dfba02fc71c66f84d8afb9e0fe40a844c
MD5 2e6fe172d561e6dcf036fbcd3ec72b22
SHA1 837014dbd8b9c2a76709db5bd8c7eecaa05b2cda
SHA512 e0d475cd0ba6f8502a29b0ebc237b6df1e44d065c9245f11a154ae94d9361ca4d1c2b7c77d9120ff8630cdd994d4f45d02b19fca8f680413bb1a530179729ea9
MD5 SHA1 SHA512

Submit Download

tempora.db-journal

Path /data/data/com.gravitek.untime/databases/tempora.db-journal
Size 8KB
SHA256 3c273128d6f27520e2d47ad355934bbb3600787545de015aed2f5ef37ef20316
MD5 0fec89e2ba167df10c4e36722894e659
SHA1 f96081f5cee05553ced0ce59668f7b1589bf6bb7
SHA512 9315964593898fea12fb19bb1e8823fc7f7ce19899ec708fbbe7bc9f8b71b34395045f3653eace31e03592d5ac46cfafb37a70f13fe2a00f542c04ecd32e4fb9
SSDEEP 6:7+/l9jsGn1wpg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK4M:7+tBGqLiuWdYRmBEyPbW
TLSH
T1590222C863840822C83E167B90E883440D25B7298161CB271A900CA4AC074CCE4A0DC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempora.db-journal

Path /data/data/com.gravitek.untime/databases/tempora.db-journal
Size 4KB
SHA256 8ab0c9093249a0ce3104d4b60540bfb385d3674b84a93d431ca28f822a6102d1
MD5 cb5a32cc85c178245efe5728013278ed
SHA1 fc6807d8b4ae104e27507a23dbd3cca11465f1f4
SHA512 51742e821f21af1092e1fdd4c443ae55e0b01cc362c2af18e487b55a85f7e9b58b64feddc6ecb4a87624c037ba4a84980f4941c50693b02aeaa63db5d5c3cc10
SSDEEP 6:7+/lNQgPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKOn:7+tu4qLJdeWRmBEyPbh
TLSH
T1ED91808967810D13C52D5B77A0D583541D14B7299373CB57169209747C8BBCCE490D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempora.db-wal

Path /data/data/com.gravitek.untime/databases/tempora.db-wal
Size 338KB
SHA256 a3accedcda19224eda03d21017ca3602d2029a4ca6bfabd0a523643c7adb0939
MD5 0ce194f11557f9a8ce0227145f0defd8
SHA1 4178f63c43af81bf5dd2a6c2be4b63644d5e4461
SHA512 cfa5257f51edf3b189b0d053e06315b915c311974f86803c85b0f5585e5e18040591a8626dc125d5560067d428c5074e1b5094a43509f0880e29e641ed7d611f
SSDEEP 384:Cd5qZ7zDWva2ERPPbTwEjyaY+1Pkl198l1YWl1WfIl1O3l1l1l1BMl1r2l1j1l1H:i5qEerjkTWyR+a
TLSH
T1DB7450248E4D68EDC1D136B9EC2428F2974C81BF1D976349861C336A31B5A5BC77CF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation6041838954110249550tmp

Path /data/data/com.gravitek.untime/files/PersistedInstallation6041838954110249550tmp
Size 90B
SHA256 3203367a7d4b75d0135ccfd7b1bdfe54ac53ab5ce2e6a6f31f7009fbf3f26cca
MD5 69519dad2b3f1da866ea3667c13d6ac0
SHA1 47dc7e908ca7fefac0bb788d14b54d44eaec25fa
SHA512 f62217e10516d9ac79890b68615567c22217fc0ef0a95aff954a1592767a2c4985a6ff8113d6973e3245e9b72388ac93c05c543b57c70233be53b49a8595ce42
TLSH
T1ADB01204AB714141C48DF3061CCDD2005D711488185ADA184B09D04442923E48153DE9
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation6973994145801140180tmp

Path /data/data/com.gravitek.untime/files/PersistedInstallation6973994145801140180tmp
Size 569B
SHA256 7cd8613ef955000f862861f523b1b62c78c90d01712d022d905fc4ae5ece52e4
MD5 ce65dfe081fa824adcd4393a7600b2c0
SHA1 1e08584c54cb0c1c3cfbe6ea322f72a90f695a83
SHA512 e9ebce5b1587d9869cafffd3996e39a9fc88a73a59a7f98348b2d9352513a4e2a1a894ce541e65ae73d1288516cdb5f9e350825dbd6ff6bfba254b5ecad8d52e
TLSH
T14FF09658A3F0071DC08DA603244F7E103C1485790C170B359D9F44E051B02FF630F91A
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo0MjI2NTQxNjM3MDc6YW5kcm9pZDpkY2VjMjViMjdlMTk1NzI4ZTZjZTVl.preferences_pb.tmp

Path /data/data/com.gravitek.untime/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo0MjI2NTQxNjM3MDc6YW5kcm9pZDpkY2VjMjViMjdlMTk1NzI4ZTZjZTVl.preferences_pb.tmp
Size 345B
SHA256 dcdccc865027819773b31d69b4ef2e3062c82fe7c4d9fb48b9049e75e4f93468
MD5 6f9a678eb52a7929c23064439381e418
SHA1 2e9f8cb62208f6e91662fc490fff866b472c2241
SHA512 6414aa72b2268c07afc5fe932a0c10be124767c3af6929ae64124d10957afd4aaafa37076dd9bbd9b1d07d565f75c6e27511edb6f116cd0a710dc7e085e36654
TLSH
T185E0D810E6E19BD1196F518D7A98022C0F6F73D161B6455A39E40080BD4E64595D1F1B
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo0MjI2NTQxNjM3MDc6YW5kcm9pZDpkY2VjMjViMjdlMTk1NzI4ZTZjZTVl.preferences_pb.tmp

Path /data/data/com.gravitek.untime/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo0MjI2NTQxNjM3MDc6YW5kcm9pZDpkY2VjMjViMjdlMTk1NzI4ZTZjZTVl.preferences_pb.tmp
Size 321B
SHA256 53c4975e4477c773a355cf9def5fe60124d3d876d806ae8135645792c4cb0bf7
MD5 c4e65364ab24735b9758efbf94abccdb
SHA1 1c607ab21b54e29bd79e7c7fbafb9609a5399cb0
SHA512 970963bac8008d6e4df897aef0246e27437a78b844d97bd96db9ce085b73cc4acd25f2101cd3f77157105a0215bf780c9c30870667dadfdda4cb0a40f7610982
TLSH
T1EBE02610E7F1AFE1192F118D7B98022C0F6FB3C161B2455935E40080FD0E68591C1F1B
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.gravitek.untime/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 f4b92fcda2c6bf26e6e3b90f210a1ec2197af0721b49d34af08d149e90ae229d
MD5 0b97b26aafc90fe4b6e8981c59c1dda0
SHA1 a114f36796506a06289d79107119008b39dee9fe
SHA512 de5ce591647671404f0b4118c8b176e510ec62006a80f1dee4c9927768716f47096e9d10729a91ec7cc8ade81eac3353ee360af0a1c559205dc5a082b367db78
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.gravitek.untime/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.gravitek.untime/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 7490a8aa56751b210538f8b11c8b706e60cf0bcd1781bab87eb5b6395a14ee51
MD5 05c07eaeeb33b344abec3150d805d37d
SHA1 d4011c73d8813cf0d2d3adb94b809c7fe4709573
SHA512 9a5df58e54627ee9d38275e87b7c82e1f768b76fb32da6d658780c6443b23b06cedbc34c94b06bf2b13b40f27eb4a276e0da78a5632330af29cfa9e96d7c18a6
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.gravitek.untime/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.gravitek.untime/no_backup/androidx.work.workdb-wal
Size 261KB
SHA256 6bb5636c4c9b4caddf632ea601abf84d06885e63f93494645644f6e5a163059b
MD5 13f451d0b812f285bba13a6226ff2de7
SHA1 1667c5da2ac97b0984ee0649bf363eca64aa2daa
SHA512 e652385aaa683dfacf7ba7d7bd67a20ef48ddf2655dacc2491d8b1b78fb891abfe285ffef1ad93c4bb26bcc452ca1e157d74b1da3b8d5af05da9c46e0214a8fa
SSDEEP 384:bctidjnfWzzb83zS9XD86u0Ea1f1c1f1QHiOK1i11C1i1v1i1Z:btfWz03zS9XD86yk9q9AUcKcNcZ
TLSH
T1E74486EE3F604340C919BEB8E8D00AE37A7DCC3D8657974659175251DF61820E672DF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.gravitek.untime/primary.prof
Size 5KB
SHA256 c5b7af02682fc9700bf96869be5134b1e8688e9438ef61ee203d32c9ed221975
MD5 a78074b7313aa73d3d8b3bded9d06e82
SHA1 3b64d6a9e169b1a48a7e1ba99e9dc763504343e1
SHA512 b95905278106fdc4a2acc9bd068586a5379092a99a5afd3938cc319971527383b426252aa839718aaa87afff0927ae9dd28d18e1825f4815afbf37dee938b0fa
SSDEEP 96:ofQ3Nne0lEGbeckgjccGOMq4pXdCtZt4BZ/QgDAC3gxkImTOH+13Fmurwey+xe1E:NBe0lTKLac2ENCtZt4BZYKd3gqImTphJ
TLSH
T1E3C1AF509F8F357BCBCE64550074A871651C46BC30006B318BC89B8948D36E7EE2965E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.gravitek.untime/primary.prof
Size 8KB
SHA256 0b36fb6ca56c09bba4c2882d964550951be97ec726f95495d021ace28859b9ba
MD5 7b83379c992db8dbaa4795e3037cd030
SHA1 da5645ef8d53c1ac61453b5a3bb0d03cc80dfba3
SHA512 f0460508282d3f3ba565db11a94677b90c5aae6273f6f7df6a233f9530793119adc2ad602cc858eaf8ec12391ea07f73ac9b10f7fbf63d6aa05e4a49cb03af49
SSDEEP 192:hKQ4KfSYUFndxoqDkiS5ZPPVpdOsbesLP4+Qu/ufLCwnB:J4KaYG63besjX/ufec
TLSH
T1E802AF450810124DA3A67FBEF4E5ED8B727595A074F036CBBAB92139DD917F0260C48C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads