Analysis

  • max time kernel
    127s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    28/09/2026, 12:29

General

  • Target
    kalasag.apk
  • Size 21.1MB
  • Sample260928-pn4hlstepa
  • SHA256 d44cfb57edfbd04e3401fb4cc6eb23ee20a0166741d54dc0bf05e2bc2762112b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.kalasag.security
    1⤵
    • Schedules tasks to execute at a specified time
    PID:4883

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        kalasag_security.db-journal

        • Path /data/data/com.kalasag.security/databases/kalasag_security.db-journal
        • Size 512B
        • SHA256 193cf7ecd35049609788674959acc070ec13df861e55a4dcf0fd213f23c3d567
        • MD5 SHA1 SHA512

        kalasag_security.db-wal

        • Path /data/data/com.kalasag.security/databases/kalasag_security.db-wal
        • Size 16KB
        • SHA256 3aa233fcd84f0c330352e8a267bcfb1e96d781fcd52bb58231b91df12c669d49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kalasag_security.db-wal

        • Path /data/data/com.kalasag.security/databases/kalasag_security.db-wal
        • Size 104KB
        • SHA256 014d05f76cb4666734d68f6e1df427ce77d9fe8a6059f3c53b367ff1de0588ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kalasag_security.db-wal

        • Path /data/data/com.kalasag.security/databases/kalasag_security.db-wal
        • Size 189KB
        • SHA256 6fd582b9c429a5d44a970b4d95ceadc94ae5e05b7e9650574157b8c419f8807e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb

        • Path /data/data/com.kalasag.security/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.kalasag.security/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 7cb48177a5f074a6ce446f2e8b00566ab4f35a8e491db6e9e74b4606be19fe17
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.kalasag.security/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.kalasag.security/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 dba9e752849d09d9eeefb0394871a5f878e26d734a8f4e8836aafa17ad32ea90
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.kalasag.security/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 b4ec268087326bd85d3dd63e0725c3543f90f54a22116eb8ec068a3b373433f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.kalasag.security/no_backup/androidx.work.workdb-wal
        • Size 205KB
        • SHA256 60d81d52a7d32a7277af88ab9481724a36860fedd72f47d55b905d2ddcab3fef
        • MD5 SHA1 SHA512 SSDEEP TLSH