ba72ffab0fa6de51f5af843bb6dce91a2499ec818959db7edf05525fa942c079

Resubmissions

30/09/2026, 14:59

260930-scshrawhre8

30/09/2026, 12:31

260930-pp6dlavv3m8

Analysis

max time kernel
129s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
30/09/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.apk
Size 3.4MB
Sample260930-pp6dlavv3m
SHA256 ba72ffab0fa6de51f5af843bb6dce91a2499ec818959db7edf05525fa942c079
MD5 5f6ca4ac10ecaef15261aab1e2c47918
SHA1 34169c9d422fe096b06a509c6dc65e5233c59bae
SHA512 271e29c88f754cb59b5694f066c6679655ba190ed7f978e0e80d03db9d4435f339d9f49ed97742b327cd515726f6646cbc6eea2f8b2f5ae5bd5e82176a6bebdc
SSDEEP 98304:1UqolwKWUbxTIToU62dnIYYRy7gRFuFfu:2qolwKxMUUPw5fIfu
TLSH
T18AF51202F391996BC8F6D371113602356026DC16CB43938B794DB7B86BBFAD88F466E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.cars.arsn
/data/local/su	com.cars.arsn
/system/bin/failsafe/su	com.cars.arsn
/data/local/xbin/su	com.cars.arsn
/data/local/bin/su	com.cars.arsn
/system/xbin/su	com.cars.arsn
/system/bin/su	com.cars.arsn
/system/sd/xbin/su	com.cars.arsn

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4953	com.cars.arsn
/system_ext/framework/androidx.window.sidecar.jar	4953	com.cars.arsn

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cars.arsn

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cars.arsn

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cars.arsn

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cars.arsn

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cars.arsn

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cars.arsn

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cars.arsn

com.cars.arsn
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4953

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/com.cars.arsn/databases/google_app_measurement_local.db
Size 16KB
SHA256 fecda2e650a2cbb3652d60ee1843b2e8fa9858bab765aee964b59b80a73d5c97
MD5 db36daef009d2615bbd9dfdb4f4d871b
SHA1 48f15ced1db6f00a2e1082ff632fb87d27b4b8df
SHA512 bb61280afeb208d4ef43224b9f871d09eeb24a4660c2b6691f5893f459871eff4ef4a537a3d0df268fa51e74bc55a76ade599d398f6d58fde4975adb8e8b70d6
SSDEEP 6:l9bNFleLIls13FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOwa:TLDE17LzmzsRmBEyPbBvOwVQ
TLSH
T1E272D8CD8F10A206C5270337608AD3954F78551E936796472BA408615E52198B051EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cars.arsn/databases/google_app_measurement_local.db
Size 16KB
SHA256 a5ca96be32101f4e838e5913d116e4376b4329212f9355d7fe7734d4d30d29f8
MD5 708970664b4ac05c28cfda1579c935a8
SHA1 cdf93305861db5999089b0734e612e46e701fa00
SHA512 3657f30fafbbfa9e32315b2507b48f41868ebf78cf46711940d8f1dc9dbe62a16924f4fcd4bba35b744ad2a070fa227433ee55a19a7ef77825b6ab29c271e19e
SSDEEP 12:TL6Ee7LzmzsRmBEyPbP/DvJ+/0Fl6G3WhL:TLwHmz3GSP/DvJlF1+
TLSH
T19272ABCC5E10E603E127033A20CB93D21E38611E4323960B3E6009249E432C8B052FC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cars.arsn/databases/google_app_measurement_local.db
Size 16KB
SHA256 15141899c40a59b8d93fec0e9f8463890c095aaf9a1cfcfd9a2c1849d092b2f5
MD5 89dc9ed88237324e5f25c42bf95820d6
SHA1 ac74082247ec634d30fbe3fa562a2f00934287a2
SHA512 afa269efe8060053025046ecb17ce47f34f861816d495e4f8d8362968f7daab054b07d80fb89dd040b0a784cc5dfdb7033a035d6586f407c26e01751f1df6093
SSDEEP 12:TL6UEr7LzmzsRmBEyPbP/hd149blqYFlG8bvJ+/0Fl6G3WhL:TL6fHmz3GSP/h7499FBvJlF1+
TLSH
T1E7722B99BA24D657E237473E20C7D7D22A3C316A0767961B7E654B2C5D433C8A062F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cars.arsn/databases/google_app_measurement_local.db
Size 16KB
SHA256 7a86bf661183d8d4a50054cd8defd2fbfe8b7257f3e95be7371217021bed7917
MD5 a65669440612d8b8c192dfc108fade4f
SHA1 ba756346dd5531df695580f85e08822254ef64bd
SHA512 0c2088d6252ea24ff1da3fe1d8da25b3c7784676ad5d179107418babc110bcca5c61c5c758197455306e5294345feb86c4f05aa5f69abd65f77bcd6fc69d0fa8
SSDEEP 24:TLQHmz3GSP/F/PKabCCbUC499FBvJlF1+:T0GKSP/FKabCCby5t10
TLSH
T108724198B964DA53F2774A3D11C6D6D22A3830AA0723D2063E565B2C6E823C0A021B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cars.arsn/databases/google_app_measurement_local.db
Size 16KB
SHA256 303c529d7207459efd56b836a80e954b57a5c9d150f2828ee155859438dd11f1
MD5 9ced517b42008ce10241e3b524665038
SHA1 71e43ff8b15b513a53282006bdb26e8f3afeda10
SHA512 c2fdad72333a35510133d4e3a2a2ad5e296865d1f32e8e01fa17904d83bb00f912007b927b39010b297068dc85606aa95efcc128b63a52982f8f31ff43cd7eb6
SSDEEP 24:TL0tHmz3GSP/A7BKabCCbUC499FBvJlF1s:TkGKSP/u8abCCby5t16
TLSH
T1EF726488B978DA53F27B4A3D21C2E6D22A3C30A70723D3063E525B1CAE433C0A121B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cars.arsn/databases/google_app_measurement_local.db
Size 16KB
SHA256 afb0219478a622b16684e464458a1b811b01d12dcbc6771e384416faf44e5ffc
MD5 041d1cd36ec8a6274496834907dd2076
SHA1 bd509a90c7c4768e44e1cad9ca7873a5bd27bec2
SHA512 31b1106dfe8198ccdc866d3ec66019f1bf2bf3854632d8ab51dbd86791de0292ac8a27a216d83b0c84b4772be85f610f68fdb377398f11655edfb708bc22ec54
SSDEEP 6:l9bNFlgls10l/FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/WK//:TLuE0l97LzmzsRmBEyPbP/Wq
TLSH
T11A72268D8F10A207C1270236B4CA63951F28511F4377AA472BA40870AE53198B091F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download