Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    02/10/2026, 07:14

General

  • Target
    6194aa250a7ec0c9e956c5a661ff9a3fe7db7135177a130fe97e0e3c8421115e.apk
  • Size 17.0MB
  • Sample261002-h2qeksws8m
  • SHA256 6194aa250a7ec0c9e956c5a661ff9a3fe7db7135177a130fe97e0e3c8421115e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.alienmanfc6.wheresmyandroid
    1⤵
    • Acquires the wake lock
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4815

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 1789a5a1be860ec7996ab49372001f01e013d0be007f4aef29a87c50d7bb8e08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 999cdf2154e7a576acbffad1e9d6675aa2ccb9a60206abaeabe49ee83589ba1e
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 3dd009bc55ff3fce307f9159e9b2a16565da5708bbbce4ede688513ec3d0b0f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 933c8c2ffb073d943739b9e2f0cd05448f40a10452a7ba5ea726f4592c13c004
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db
        • Size 28KB
        • SHA256 129233b76e17a518c6d5b0a6178d89066713c8115991065b373e137fb41ea21f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 512B
        • SHA256 84cf8c916fe87252d352e57ac31301002553b9d5d670bdf634fca45b673ecd9c
        • MD5 SHA1 SHA512

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 877e9648e177a3a26018c8e00339377f226dfe704368ff99669b210497100881
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 4KB
        • SHA256 31d629146aeb98129dd749722e94d69a9a4ba17c6a4ea8f88e068f7bc8215231
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 3f3cbd31aaaefd5a4d16b736e4bee6a6b31ccd305695199884aaa514ac295522
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 8KB
        • SHA256 e4a7d8e53682df3c5a5d6781237a694a4cf2e104ecb077c2250214d1aaaf7d94
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_analytics_v4.db-journal
        • Size 12KB
        • SHA256 fa62e8da42e7a4e7386c6f1ae4db726b6c2acdbac461500e93583155538068a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 690d0b8acc04ab3b9fb8319e32456379d2732388bf153bbec8c8dcb661c739bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 c63c8598bbdff9b51216d8cb5ed646773c450d9f2debf8cc7464e2379f011f73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 ee5fb32feb83cdae3a008107d22e860390407e099a280032de8792f54a3cfd2d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 c49eeb7cf49cfc6394e38ed1b8994c3407a6edcf34818e0f2952fc3119208e97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 b0b63a87432b7a3e63f22203c036adb36c4801f6de19638226107cc4bc94c68d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 5068db2282e38bcba2cd3355e51e23882051b32bb3418487303ee3439144ccfb
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 bca6b4bde1940c15fe6de850e5c48e70d220481b3b10ea709139a128ba9c51af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 ad1f2c6378ebb5fb140cd0027d58bec56936d133baed7707314f37a0b02c0881
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 aad2402304231f0c71f52f2c36ad9f034c6760a58e59affbd7f4bcc9945a90d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 1b4aa7a1d5c9666452fc946ad4b317885ce4e06f84ef574b1aa2885351632bab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 098174e71e5b5b946f81f710215cb5931402c435b2baf8226d44ddbfffcfe401
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wheres_my_droid

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid
        • Size 4KB
        • SHA256 2bb0c03237c8423ee364a6fd21160aedc3aab0d156476ea9af963dead5f5eeb5
        • MD5 SHA1 SHA512 TLSH

        wheres_my_droid-journal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-journal
        • Size 512B
        • SHA256 4900fcc280e70915a0c1d4cab2914831206438c4d7145f1646db0039dc68a43d
        • MD5 SHA1 SHA512

        wheres_my_droid-shm

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        wheres_my_droid-wal

        • Path /data/data/com.alienmanfc6.wheresmyandroid/databases/wheres_my_droid-wal
        • Size 321KB
        • SHA256 dd63a32f34ae93cc087b1dea62dacf5eb7761494a3d185143e29b5c63f605e1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation3992159738267593984tmp

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/PersistedInstallation3992159738267593984tmp
        • Size 561B
        • SHA256 a87a5afb09cb40f6252f83634aabae42eccd64404ebe4b3a44c62b1a97ddf6bf
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation6490808985848692926tmp

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/PersistedInstallation6490808985848692926tmp
        • Size 90B
        • SHA256 c916f2d1e8348283fd63d2c49b7b4b6f014e77bf5cf7645afb3c518f0b4ff4a7
        • MD5 SHA1 SHA512 TLSH

        coverage

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/coverage
        • Size 65B
        • SHA256 413aaba125d27848fe11723fa2127335f524354e768ce5b4b605a890bc1da150
        • MD5 SHA1 SHA512 TLSH

        coverage

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/coverage
        • Size 54B
        • SHA256 b2c3de313ddbe97841fa2256287f0b03a7b86ceffe6056c4402eb6a114efe24b
        • MD5 SHA1 SHA512 TLSH

        gaClientId

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaClientId
        • Size 36B
        • SHA256 e8c1b0aa7906d1732a3bf006346dc51a8aef7cc3c19f48bb726d31c98f8747ce
        • MD5 SHA1 SHA512

        gaClientIdData

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaClientIdData
        • Size 32B
        • SHA256 ccffd7d93020eb956884935fe1a46465c023f1046b544cfddf10e5bb02d5b314
        • MD5 SHA1 SHA512

        gaid

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/gaid
        • Size 85B
        • SHA256 4da8790eae77fb6aa1060cb0f41e336cfeba3591eb33b6b261fc4b338119fc93
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 7e2eaf423ae2a9a589ca2527b07f25d5c4a268115bcda981bbffbcce7ba4ca9e
        • MD5 SHA1 SHA512

        regulation_consent

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/regulation_consent
        • Size 1KB
        • SHA256 c423e1170cad1713c00b90a68b0999ba425d3c0f15dfa8657a056d80b72d53d1
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 113B
        • SHA256 f91c4758326194d12adaa31e40111eed67827c442d7118e37aa5e6e828946c02
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 98B
        • SHA256 94363d4079068c5b103f3d7fd19942f69d783974e7b97c50feffd75aa8621c9f
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 161B
        • SHA256 54dc7360e4f3c0045ce8ab87e75120b1015dbc38611437bd0c11b4f3971bcc16
        • MD5 SHA1 SHA512 TLSH

        server_synchronization_status

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/server_synchronization_status
        • Size 97B
        • SHA256 3f62a8a9fe29d97943bf7e594b7ecf730eca2931c602c206ad4c1ee7a9a9c1ed
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 602B
        • SHA256 de1ef3bf255414323689a019375f9c4c04b8c1c523bbfec739630cb600d88f08
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 602B
        • SHA256 94dee8c991212dc903a43f1364af25a0d875e7c0c3df67bffab053870b57c00f
        • MD5 SHA1 SHA512 TLSH

        settings

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/settings
        • Size 695B
        • SHA256 20e217df8ed814cf0bc41d4a4598c08f2234da8780f0361f28c51dd9e1f41322
        • MD5 SHA1 SHA512 TLSH

        should_attach_if_allowed

        • Path /data/data/com.alienmanfc6.wheresmyandroid/files/should_attach_if_allowed
        • Size 31B
        • SHA256 53ade896a4b756ca5058942117acbe4b3d069c77c64b75662da74d2fcc558e3c
        • MD5 SHA1 SHA512

        primary.prof

        • Path /data/misc/profiles/cur/0/com.alienmanfc6.wheresmyandroid/primary.prof
        • Size 2KB
        • SHA256 4fdb914bbb522d296fcb021cb703ab975e3d3eb44a016b9c1a17696a9e1d563e
        • MD5 SHA1 SHA512 TLSH