Analysis
- max time kernel
127s - max time network
151s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
28/09/2026, 12:29
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
kalasag.apk
Resource
android-x86-arm-20260325-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
kalasag.apk
Resource
android-x64-20260721-en
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
kalasag.apk
Resource
android-x64-arm64-20260325-en
2 signatures
150 seconds
General
- Target kalasag.apk
- Size 21.1MB
- Sample260928-pn4hlstepa
- SHA256 d44cfb57edfbd04e3401fb4cc6eb23ee20a0166741d54dc0bf05e2bc2762112b
- MD5 681096871d454cc0a20df19a51cd05a9
- SHA1 17055697aabb009c70de6dc1f776161369ec9e8f
- SHA512 74c9434b5bbff1afcf97382bd599a18b980a1609d4849614896d815ce87b0de59e8ccc624219c995b10cc6887bb9530609aa8be60aeed4e26e82a7076fd52e9c
- SSDEEP 393216:etBjccgZs0CIh/acS20LEPnP9PNY7SffaD0JzSr9bqpNd/Nhyjkf2sDRJXC:sBjzz0CkS9EPnD8SfiPxqrd/LtlhC
- TLSH T1C5273308B7D8AE6DC877E0364D5A17B6640BED23C303D397E8AA1789644F9F40F452E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.kalasag.security
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.kalasag.security/databases/kalasag_security.db-journal
- Size 512B
- SHA256 193cf7ecd35049609788674959acc070ec13df861e55a4dcf0fd213f23c3d567
- MD5 377b08de003bf117b03da4c061f4db1f
- SHA1 912b9d08cd5931403226fe511641b2f7355e911b
- SHA512 ec25d61559200f883004b1ceb1c1378599247d23306e9fbda273493a6ad1cf40a3976e7ba8eb77a6efb6ef606f55b9c136d5be2c85edc986d30db0c8be22dedb
- MD5 SHA1 SHA512
- Path /data/data/com.kalasag.security/databases/kalasag_security.db-wal
- Size 16KB
- SHA256 3aa233fcd84f0c330352e8a267bcfb1e96d781fcd52bb58231b91df12c669d49
- MD5 93b926da6e11f7ec8a4a84a117350bc0
- SHA1 8083a18304ebd97e5bcec2a4f9ff85e3062d965a
- SHA512 60ade097d9c525953da131513272520f49ce6935089ecc2a6b1739af87ebca75032ba0d558e25502b423616ea8fb2f1cb818ffef4bf9ac78ffd19cc351a46030
- SSDEEP 6:K2x1Afzpv9FZde/kPlOERX4PBX4ogLugMBX4suuK+/SbM7ay7eoljiOw2:KBLzdeWRmBEyPbP/fayPl+Ow2
- TLSH T18C72C244D780BA83C20B43B666DB93000D58562D772ADB4712610879FCC2BEC7160D0C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.kalasag.security/databases/kalasag_security.db-wal
- Size 104KB
- SHA256 014d05f76cb4666734d68f6e1df427ce77d9fe8a6059f3c53b367ff1de0588ff
- MD5 1dc9b003542d83dbacc2cbded285a047
- SHA1 9bf321caa4c8711a7bb8a1153e39e66f15191b0c
- SHA512 617726c0b3d420a91a86e932bff282f5c6371399856729a59c0fc8f4082e4606d17c914dc12b2e929e4547fd707e793e23e897124dc68694964d79f65040f7c9
- SSDEEP 48:Ryw66H/3B+YeIohyEtWNDfVbZGVWLLZhUSG7NbSbw7OkrIulLqpImirIlVmRKzo0:wr6fR4yAkDfGbkux0b8R8YqxgP+1T5
- TLSH T17FA3A6AE0F297352CEE646B1EAC22AD35C2F500D53B632816EA1C0F3FCC16B4B474865
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.kalasag.security/databases/kalasag_security.db-wal
- Size 189KB
- SHA256 6fd582b9c429a5d44a970b4d95ceadc94ae5e05b7e9650574157b8c419f8807e
- MD5 b414346c51780371ca7b3950e02fa6ea
- SHA1 3e5704c5da31826dbd8dfac50c7311324739c51e
- SHA512 b6acdd0aff400b7cdad0549268bd65d578ed2750002de9c95b87236fbaee52674b7589bd77dbc38eee82714c988ebb42ca2ff4efaaaf0f43a9239d27183c3f9a
- SSDEEP 384:KyPlO9eRaIPLIPCpIWlT27ZudVLNhHK4q5XD:KyPlO9eRPPsPCy+T2VudVL7qXRD
- TLSH T1C514088F2FBA3E67CDC49036E95428C64B3E4C5C33A361ADB54051A7F9027609CA3DA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.kalasag.security/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
- MD5 7e858c4054eb00fcddc653a04e5cd1c6
- SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
- SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
- TLSH T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.kalasag.security/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 7cb48177a5f074a6ce446f2e8b00566ab4f35a8e491db6e9e74b4606be19fe17
- MD5 04b7312a143a256e3c6b2b7c092ca5f9
- SHA1 d0d3d0512d5f682df7546da78c36e38d3cd1125d
- SHA512 1135eec98c39dab3273708797ebf9f796834ada45a85469a015216606481df72abddae9b1b03f1a480947027c9a29edb832a1bd00c4d49ba31f2285c0cc05d75
- MD5 SHA1 SHA512
- Path /data/data/com.kalasag.security/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.kalasag.security/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 dba9e752849d09d9eeefb0394871a5f878e26d734a8f4e8836aafa17ad32ea90
- MD5 3421cf1a87d657fdcbeea701414285d9
- SHA1 88da8d1d10f2e84c168372b3d59fc724553783fa
- SHA512 77115e0c4f941a8f95bc562f68d491ec7e2c2901d2e80d8b43979baa31bccc2ec555c638f0760d780cab1d64b65b0c3f6babddff058576fe09acd9a6787c0134
- SSDEEP 6:KW+99gs+R6G2ZRg9FZde/kPlOERX4PBX4ogLugMBX4suuK+/c+0faSWlbtQlViOD:KWU9BZBqzdeWRmBEyPbP/cH0Ql4Ow2
- TLSH T1C172C28CA7402A52C51A5273D8CD83420E616A1E2322CB0F229314606DA2FECA0E0D5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.kalasag.security/no_backup/androidx.work.workdb-wal
- Size 116KB
- SHA256 b4ec268087326bd85d3dd63e0725c3543f90f54a22116eb8ec068a3b373433f9
- MD5 48f86d6810ebfdc480d673f268573d14
- SHA1 c9deb90a7d8aa03186c631c40bed1df3c73237bc
- SHA512 a8943180840ec2468281ebd3eb7dbb5456d270de9dbc222c74953607bc90ea8fcd00ee731f4af420e3958a3576b9cc61c40621d20955b5e966c5a4faa9a7a7e4
- SSDEEP 96:eQtELb6+etidjnZRWzzb8/KeKcK+zSFddKz+ZD86u0ExV:JtELAtidjnfWzzb83zSFde+ZD86u0ED
- TLSH T1E2C3108E0F593600C0AA54B0D9D90FE1793E852F9793E3D525A20075EDE2D32DD69CFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.kalasag.security/no_backup/androidx.work.workdb-wal
- Size 205KB
- SHA256 60d81d52a7d32a7277af88ab9481724a36860fedd72f47d55b905d2ddcab3fef
- MD5 ad471ce77150ae24aa63379861aba042
- SHA1 08cf0b5ed72c8603f066ac5a23a92267c7826802
- SHA512 ff509b8a1e47923da7995cf35d02e3657e6952732bbe79a308e1689e947e720e848f4dc011bc9ed0eb52070186eff848671df8be63ecb3cd381e4307449b2931
- SSDEEP 48:EyB1X1DtYeYIVqwPze27woeZqM6L0Nd05uH+V1X1DtYee42YkfoRuAp1X1DtYe1i:v1DtYgJSg1DtYh4Z1DtYq1DtYRI1DtYX
- TLSH T1272466CFA650E01CF31750BDC99E2AF867919C9B25055D0E679B3A3020F587B84EFAA4
- MD5 SHA1 SHA512 SSDEEP TLSH