Analysis

  • max time kernel
    21s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    02/10/2026, 07:08

General

  • Target
    41e72ae31b52bcbe123782e0e3aff91b11253ac9efb72d3d4fb6a5b2c5dca961.apk
  • Size 16.9MB
  • Sample261002-hybf9axvbx
  • SHA256 41e72ae31b52bcbe123782e0e3aff91b11253ac9efb72d3d4fb6a5b2c5dca961
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
  • Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
  • Reads the content of the calendar entry data. 1 TTPs 1 IoCs
  • Reads the content of the call log. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.aleghe.hatra
    1⤵
    • Reads the contacts stored on the device.
    • Reads the content of photos stored on the user's device.
    • Reads the content of the calendar entry data.
    • Reads the content of the call log.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4989

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.aleghe.hatra/databases/com.google.android.datatransport.events
        • Size 40KB
        • SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.aleghe.hatra/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 139bf35f39d48d80456b6276bc21394d5d36cd9f6a37e4505b45f30e267998b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.aleghe.hatra/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 13fc1fbc4d6d281ff42925ba2bae30f9df6579bf0bddee0fc345e0c5f7e3ad6f
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.aleghe.hatra/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 178d9bc0b43d0c9fd9b992c9926373ca4856ca380bb9c6bd6126933355a45bb1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.aleghe.hatra/databases/logsManager.db
        • Size 24KB
        • SHA256 c65ffb125ff655c675b838309c145922f25b86941bb44a857c5a76bc81c98d7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.aleghe.hatra/databases/logsManager.db
        • Size 24KB
        • SHA256 ec0a4120febef56c074cf5be83e8df2fa3829bdfec627dcc0972f002c2e5cc08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.aleghe.hatra/databases/logsManager.db
        • Size 16KB
        • SHA256 3cea66196cdf773ad45cc3bd09d5a9c46f3f3055c4aa99ad7a32a79ad3723dc8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db

        • Path /data/data/com.aleghe.hatra/databases/logsManager.db
        • Size 24KB
        • SHA256 581d147f9cd373dbfbd794661e36e6b13c6d0509c8bd10731e9cf696c3a14717
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
        • Size 512B
        • SHA256 a103dc83e4feccb57bdabb6d4619cfe81e941c35125f4d5363e40d7069c994fb
        • MD5 SHA1 SHA512

        logsManager.db-journal

        • Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
        • Size 8KB
        • SHA256 850c205e65e046f1cd74b19ddc859095c27114d08e9a20ba0ad43e1875eecd71
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
        • Size 8KB
        • SHA256 fadcc584ebb9ae37f1f9c6ba44fb56f1efa6a7597c0fb75cc40a4cea24af58fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
        • Size 16KB
        • SHA256 6bb383505fe1723786d373920e6470463b0c234c26ae4e87451bf851f299d64c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
        • Size 16KB
        • SHA256 d79cfd741338002e482b4f57e01dfec4dee4bd692d4331d3cbf20aabd7e4a794
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logsManager.db-journal

        • Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
        • Size 16KB
        • SHA256 d440226043f113e116d3cc22532a3a037515c3e93b360858ce032fb31980f27b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation8065327837228812464tmp

        • Path /data/data/com.aleghe.hatra/files/PersistedInstallation8065327837228812464tmp
        • Size 569B
        • SHA256 b4d8e92b2f0f7dafbf25e9e284d8a3fd6e53e95fbdf547e83ea85e6d79f2cb39
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8287756880098533567tmp

        • Path /data/data/com.aleghe.hatra/files/PersistedInstallation8287756880098533567tmp
        • Size 90B
        • SHA256 4b50d3b9855dfb6411836e5cf11ee24eb14801132e27ffdf6f3bfdcf1934f4a3
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 2d60fa894ab1bbf23e3934b836bf3e8385de351ca4847a4961734627fbaa7146
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 6bbf626935939d516e4b33231d71a88fe62ea2f7648e5a35a4d90ab6135bf485
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-wal
        • Size 173KB
        • SHA256 70e574301974270214569bd00cbd20d8c528c3bbd4cac5a5b3ff569eb99a1560
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 9af4d39f76f0ebb3e739dbc7b57d1ee289c8f78dc350d4a6840786cab8d90a80
        • MD5 SHA1 SHA512 SSDEEP TLSH