27877f23292d1e3e83f0130a6ef6089f56f9519f8310634b05c782dff016cab5

Analysis

max time kernel
148s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
30/09/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.apk
Size 3.4MB
Sample260930-pp53tsvv3k
SHA256 27877f23292d1e3e83f0130a6ef6089f56f9519f8310634b05c782dff016cab5
MD5 28d87f625a07c724fafe8f437cab525e
SHA1 e4489550d0db32c9c75cc8ff90d547eccad3f0ad
SHA512 d4027d7759014d513a8f681e601b766996567c003f1aef11e06bad3e592b7f7233eec6b10a8b145723d00eb57be2b2107d3a21bdeefff92d0d34948afa3f7f63
SSDEEP 98304:fVafvO4nI9J2zxMsQWPNzi7sdb+NCjFIFFp:GvO6PnQ8LFlhyFp
TLSH
T1B9F51202F790995BC4F6D33215760231612ADC15CB03978B794C77B92BBFAD88F46AE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.cars.arsy
/system/sd/xbin/su	com.cars.arsy
/data/local/bin/su	com.cars.arsy
/system/xbin/su	com.cars.arsy
/system/bin/failsafe/su	com.cars.arsy
/sbin/su	com.cars.arsy
/data/local/xbin/su	com.cars.arsy
/data/local/su	com.cars.arsy

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4838	com.cars.arsy
/system_ext/framework/androidx.window.sidecar.jar	4838	com.cars.arsy

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cars.arsy

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cars.arsy

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cars.arsy

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cars.arsy

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cars.arsy

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cars.arsy

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cars.arsy

com.cars.arsy
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4838

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/com.cars.arsy/databases/google_app_measurement_local.db
Size 16KB
SHA256 fecda2e650a2cbb3652d60ee1843b2e8fa9858bab765aee964b59b80a73d5c97
MD5 db36daef009d2615bbd9dfdb4f4d871b
SHA1 48f15ced1db6f00a2e1082ff632fb87d27b4b8df
SHA512 bb61280afeb208d4ef43224b9f871d09eeb24a4660c2b6691f5893f459871eff4ef4a537a3d0df268fa51e74bc55a76ade599d398f6d58fde4975adb8e8b70d6
SSDEEP 6:l9bNFleLIls13FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOwa:TLDE17LzmzsRmBEyPbBvOwVQ
TLSH
T1E272D8CD8F10A206C5270337608AD3954F78551E936796472BA408615E52198B051EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cars.arsy/databases/google_app_measurement_local.db
Size 16KB
SHA256 a5fb146272508ddecf107e13d3b38e9e317f5d83c120ce27c2ad32ff22c3e421
MD5 d16fb5ae2120dec47842ba2f7ce4aae8
SHA1 0743e3e47d48988d79a4d16d7781e7229392c6b8
SHA512 4e4d7d7c165f49c3fd19c85416017a4632fed356db78115de9b5e63673f5f985f94e21668df5283cf55691164eb6247026ceb9587e61ac926aaafd6277718d8f
SSDEEP 12:TL6Ee7LzmzsRmBEyPbP/DvJ+/0Fl6Ub3xL:TLwHmz3GSP/DvJlFTbJ
TLSH
T19E722BCCAE10EB07E127073A60CB93E61E38611E4377965B3A6509649D532C8F152FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cars.arsy/databases/google_app_measurement_local.db
Size 16KB
SHA256 974c4df290e7185c47f33e832ae2cd19e45b24b626016e442692d1aaa531530f
MD5 253d6b3e4164b943180dc60747a43229
SHA1 0725aefbe2079def2b261914b6c4f458d0f36208
SHA512 b13f801f03a9b7669ac884944a64c2954376e38d1e590617f695792b88bde03b14abe2ee862cab77dd4c6f6812b7a6298098a61ab6f86635d9c05cb23070e922
SSDEEP 12:TL6UEr7LzmzsRmBEyPbP/hd149blqYFlVmpvJ+/0Fl6Ub3xL:TL6fHmz3GSP/h7499FzovJlFTbJ
TLSH
T1DA72F699BA24DA57E227073920C7D3D22E39312A0767D61A7A254B2C5D533C8A061F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cars.arsy/databases/google_app_measurement_local.db
Size 16KB
SHA256 9aa3189be382e80a7c612b0207fc05bed8b7f033d0712962a0b48208e66ca7ea
MD5 a0f065500f4d1371d40be20feea80813
SHA1 7b77c4aec994f521550d4e7ca060a45905d1bb16
SHA512 4ba87abd6632e67f7a3f7106d156f18747ad2f08f708cc4d26861ed8e0a458871fa4419517d86d5ad31d560cec27ac3b9b9de5808ed019fae994aeb1f5199f17
SSDEEP 24:TLQHmz3GSP/F/PKabCCbb499FzovJlFTbJ:T0GKSP/FKabCCbc5E1Tl
TLSH
T107722498B964DA53F2774B3D11C7E2D22A3D306B0723E20B3D569B2C6D933C49161F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cars.arsy/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d6d160b9ecd7d5070ee7c69ca6f457f3217703eb18fd478b8b535b64c4f702e
MD5 ec89df3342fffdc0242e84eeaaa70373
SHA1 b801349dce1857a87793ef2429d30e77de7b8a46
SHA512 fead4e6b01fee21f6b3df445b8abf075d2962a671ebb582a35f44591c2dacf7ff55c3cf478f07921df5013582791bbcaf5269f596257fd157c093bb578750b7d
SSDEEP 24:TL0tHmz3GSP/A7BKabCCbb499FzovJlFTb/:TkGKSP/u8abCCbc5E1TT
TLSH
T162722898B964DB53F27B4A3D61C7E2D2293D30670723D20679129B1C6D533C49161F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cars.arsy/databases/google_app_measurement_local.db
Size 16KB
SHA256 afb0219478a622b16684e464458a1b811b01d12dcbc6771e384416faf44e5ffc
MD5 041d1cd36ec8a6274496834907dd2076
SHA1 bd509a90c7c4768e44e1cad9ca7873a5bd27bec2
SHA512 31b1106dfe8198ccdc866d3ec66019f1bf2bf3854632d8ab51dbd86791de0292ac8a27a216d83b0c84b4772be85f610f68fdb377398f11655edfb708bc22ec54
SSDEEP 6:l9bNFlgls10l/FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/WK//:TLuE0l97LzmzsRmBEyPbP/Wq
TLSH
T11A72268D8F10A207C1270236B4CA63951F28511F4377AA472BA40870AE53198B091F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download