294b1766a376ffffd00666f1d539a70fdedf4fa256a01c3bd1b9cd795bd05f0e

Resubmissions

30/09/2026, 16:49

260930-vbvmtsysgs10

26/09/2026, 10:12

260926-l8tbla1dja10

25/09/2026, 15:17

260925-sn27bs1w6m10

Analysis

max time kernel
23s
max time network
25s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
30/09/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
294b1766a376ffffd00666f1d539a70fdedf4fa256a01c3bd1b9cd795bd05f0e.apk
Size 2.4MB
Sample260930-vbvmtsysgs
SHA256 294b1766a376ffffd00666f1d539a70fdedf4fa256a01c3bd1b9cd795bd05f0e
MD5 b603017bbcee17a76f5b0ee478d2d935
SHA1 3b4b8f807986d1edcadcf42ef2090fe32136e5a5
SHA512 9227899df30b772bad8fa37ab398ab045af0d6a405a2faef7dd24aa49f4f185f6f8826b22f8097ab3ea46f6b5c38e38951fc849a845a6d731d024b90259161dc
SSDEEP 49152:vfg3kY9geJ05HzJov8KUVEnZ2ahHa6DCDfTsPL/OTdf310+/Cf/pHKRm2z:vfgngF5TaEKUVEoahHDwgSpZCf/pHKRl
TLSH
T12AC51281E719952BCDBBDD3647A74B3A0346CD194A87A7432880732C1DBF6D49F98BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4831	com.gbooking.googleupdater

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.gbooking.googleupdater

Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://media/external/images/media	com.gbooking.googleupdater

Reads the content of the call log. 1 TTPs 1 IoCs

collection

Call Log

T1636.002

description	ioc	Process
URI accessed for read	content://call_log/calls	com.gbooking.googleupdater

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gbooking.googleupdater

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gbooking.googleupdater

com.gbooking.googleupdater
1⤵
- Removes its main activity from the application launcher
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Reads the content of the call log.
- Acquires the wake lock
- Queries information about active data network
PID:4831

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Protected User Data

T1636

Call Log

T1636.002

Contact List

T1636.003

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chatssdb.db

Path /data/user/0/com.gbooking.googleupdater/databases/chatssdb.db
Size 68KB
SHA256 5b6317572968fde267606aaa347850dea08a9332615249e5b6a1edfa820e69b8
MD5 0c719f37d0171ffdf6ce7c4b9a48fafe
SHA1 60be4f3a01a9dca9bc94eb9869675ade34c0f1bb
SHA512 f04520c77ae59d0320a839f5e3e8b1bada06f398fc3173e1e62a20f8419d40fd1838b1380ee8f407f4197d53b3e60264ad3ddb6ee4eb8b79d6eca222506ec7b9
SSDEEP 48:TS94hZvoYGXKKelH+9ZUEf8QoxgyjnppYi5dw1pouZX5ouSXsskYnLcA+Sdb:298IecGhnIi5dw1zPA7d
TLSH
T13C63ACA73A1101D1DEDCD33E647001DE46B6927E9C465BC276E34C0D0C7EA8CA97F999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chatssdb.db-journal

Path /data/user/0/com.gbooking.googleupdater/databases/chatssdb.db-journal
Size 8KB
SHA256 1f1417023ad3533194669a9939afe050c56567186e1caa0cefe82a60f68b09e8
MD5 f25dccb3b320279c618760fa39834bfc
SHA1 972752ac2715ac19c1479a686885983894a316b3
SHA512 77dc395a182f0dd8f33bd537b1eab37fd2a718cdaba23e1dfd561a971155a00102a89d4ced2e8ad2a0cadd7ad746186764b72209c3bad4147832b244073582ca
SSDEEP 6:7+/l9yuGn1KuJvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKry:7+t0dvqLiuWdYRmBEyPbyy
TLSH
T1EF0222CA63C00A22CA293A7790DDC3580D00A7288172CB1716A40894AC074CCA4ACD08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chatssdb.db-journal

Path /data/user/0/com.gbooking.googleupdater/databases/chatssdb.db-journal
Size 8KB
SHA256 58cd443b7fdee71648404022624170290d4411d405fee645fa43a84811500b21
MD5 f70cbad1935a45d5e49aa4fda0598f04
SHA1 6a1e5f391b3b8e83ccdbc415240aaca2642c3ff0
SHA512 672c5144fa27a234262bf80a6a43a9729fe57bca177c1fc5c5e19c0902ee2f4185f7f234b469e5210664907d16e86da4ea7bac5354a796b66a00b2f5d4a31cfb
SSDEEP 6:7+/l9nlGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK6o//V:7+t+qLJdeWRmBEyPb2V
TLSH
T14502228AA3460913C22A1B7BB0D883401F20A7289263CB07169308642C0AACCE890D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chatssdb.db-journal

Path /data/user/0/com.gbooking.googleupdater/databases/chatssdb.db-journal
Size 12KB
SHA256 822319576a5d27cf4d9a2b18f43aaf582404e88cb6232e0201b2f596621fdf0e
MD5 aad8b0c13dd09984f610a39fc4709b53
SHA1 e5e08e0dcfcdf6ba895b53639c1a109de8b17b16
SHA512 53d4ded151453a229feb16f15f19fd9c41a1be701daa0a2d3f6eaeb8128005b98b5344b42a9ea0e307e8eab8d31538f3efe11db16c77ea695ed8a3196e224fa9
SSDEEP 48:7MDqi94hZvoYGXKKelH+9ZUEf8QoxgyjnppYi5dw1pouZX5ouSXsskYnLcA+Sd:7uV98IecGhnIi5dw1zPA7d
TLSH
T10242ADAA391101C1DEDCD33F64B000CE86B6637E9C465BC275E34C0D4C7EA8CA56F599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chatssdb.db-journal

Path /data/user/0/com.gbooking.googleupdater/databases/chatssdb.db-journal
Size 512B
SHA256 574675b263b72972aaf7475a9254a727bd47080caebf27820b5a58ef402d918f
MD5 0021cf8946526f9f21dea93a568bbb20
SHA1 a2cbb4eb5cef22a319833a14aa739e095887374a
SHA512 34e64ba7af66d5d0ab627587766520af13b4c579b7de5315bba7471700f16b2fc667cda6bf8b3407d9e6f6597e49ac9d11fa036e4f4cb6a61d8c9fc15a8046eb
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.gbooking.googleupdater/databases/google_app_measurement_local.db
Size 16KB
SHA256 f022a9179a3894edc03363e271057e48932fc85afba45a928e387c1e7e82ae9c
MD5 dc1d95042cd02169ad92982a500ab6ed
SHA1 02d9c432b115ee9a97ad5d431087812e3c4ec6e0
SHA512 185b019217b71c6a9bbb3d64109e34e5a13b5a95dc87e5ab3a9f838851d818b93703322638cf6a22bdc617dafab8e3e2f849f16dda3077d03ff8da6d3288e192
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WblE:TLiEq9zmzrfRmBEyPbP/W
TLSH
T170722BCD9F102603C1730777B8CE93915C14A22D83779E472BD90870ED43449A091F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.gbooking.googleupdater/databases/google_app_measurement_local.db
Size 16KB
SHA256 2fcc196aeb3ea2408adb06b3f12d2120a39f6db8d15ae974580c9396a3e0bb2a
MD5 1b30dc409b245478516b62210d92ab2a
SHA1 836b67415741975d7d162dce229916aaad508934
SHA512 d329b270c6435ebb297bddbc99168683b8fcaad38eb8cda08408a8c24718651556ab24bfe58a8084b0816019a9d915621a3422ad7a7a5ab03206f1fcd56763f7
SSDEEP 12:TLWuEmO9zmzrfRmBEyPbBvOwu06iOLaOS/yAUGUyWlPMd:TLROpmzr0GSNu0vKaT6rGd
TLSH
T1EE7297CCEBA4A602E2330A7AE4C9D3C06EB872AE0327DB0B3A45061CAD422448461F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download