Analysis
- max time kernel
21s - max time network
152s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
02/10/2026, 07:08
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
41e72ae31b52bcbe123782e0e3aff91b11253ac9efb72d3d4fb6a5b2c5dca961.apk
Resource
android-x64-arm64-20260325-en
9 signatures
150 seconds
General
- Target 41e72ae31b52bcbe123782e0e3aff91b11253ac9efb72d3d4fb6a5b2c5dca961.apk
- Size 16.9MB
- Sample261002-hybf9axvbx
- SHA256 41e72ae31b52bcbe123782e0e3aff91b11253ac9efb72d3d4fb6a5b2c5dca961
- MD5 8944a8d5236e12e4d6b94180bb8de04e
- SHA1 79a0276be7ef6b7f6c4dda65b870b6aa45915852
- SHA512 3e8f62a318fd567882540630467582777b7ba9fdd61b956c697e76aeb2c99e835db74181bf7829d94fe9114a6c9d8ab1535b8ebedf1d215f313c61848097a944
- SSDEEP 393216:UnGN7YwPwVJAVTFXu9e91NVhJcn7NQr4yVRy3m2y7PmIvks/dr4wmf:UnohPYLe91Ne7NQciD2fWyf
- TLSH T1CB072311F3A87A87E434A03A4646EB3075569C68AB02D682791C33FC3B77BF44B653E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/data/phones com.aleghe.hatra - Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://media/external/images/media com.aleghe.hatra - Reads the content of the calendar entry data. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.calendar/events com.aleghe.hatra - Reads the content of the call log. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://call_log/calls com.aleghe.hatra - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.aleghe.hatra - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.aleghe.hatra - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.aleghe.hatra - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.aleghe.hatra
Processes
-
com.aleghe.hatra1⤵
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4989
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.aleghe.hatra/databases/com.google.android.datatransport.events
- Size 40KB
- SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
- MD5 1cf3f63c021d755a21623e6d0e86dbc6
- SHA1 e40e0f1faa61abcca7ba3394c54c92ff7334b49b
- SHA512 38d72e14f3513ffd26989cbda3df46ed3dd6e731bdfae56440eff6b64760cc13f91014281c9add61e018fe3529e49c63a6892ca22479515816c768b546244466
- SSDEEP 48:TfkL3u59MENZBdUdndVd/7T9IvdldHlq8/JqYpqPS:zkL3KMEX0xIyNYMa
- TLSH T1AF03EF5D4A202611C2BE083FD7E257931B3CE35F6B2387612E904CF6DDC68B6B821998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 139bf35f39d48d80456b6276bc21394d5d36cd9f6a37e4505b45f30e267998b9
- MD5 53406d4713e33c535ba0a74ff4590b12
- SHA1 7ab59bc6e430fe9e2c170d16d855924eeff75317
- SHA512 cdec6c8bfb8befbdfcbeaa83014bd2702c29856ada1df0548d212136e492233b21259df2c6b0d15caaa63669c381bc6a70f972c4fca094388bdff615f1b37d60
- SSDEEP 6:7+/l94NPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK0k/N:7+t6qLJdeWRmBEyPbqN
- TLSH T1B402C0887BC40803C03E1777E4EC83401E20AB289333CB1B169108943C07ECCE890F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/databases/com.google.android.datatransport.events-journal
- Size 512B
- SHA256 13fc1fbc4d6d281ff42925ba2bae30f9df6579bf0bddee0fc345e0c5f7e3ad6f
- MD5 9375f688bd78ab669b7c4cadc963ad76
- SHA1 19d9538254fb342aba45c02b9c8d8a8092360789
- SHA512 9c63d13d064aadd9d91fe2de8ea42a15ac373c442735cba08a93a6319cb902b1d3f78cedb49b159c146e8b6897e5015297c915b54ae888f37662a291f84563f2
- MD5 SHA1 SHA512
- Path /data/data/com.aleghe.hatra/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 178d9bc0b43d0c9fd9b992c9926373ca4856ca380bb9c6bd6126933355a45bb1
- MD5 2b2597d5a82adbdb99ca7f302ecc1d85
- SHA1 17a6c05b0ba40ee0e02856ae4fe7616b22c18ae5
- SHA512 c21f40da72d97f9c06d715c8976170c902d962cd8e939759b01e0cb688b0a3e0ba27715c2d0018b5fcc75ee5399f56eb1dcd5cb399d1b54a5ab9c5f0de8c9fde
- SSDEEP 6:7+/l9H/8lFn1n+Wg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKO:7+th0j+WqLiuWdYRmBEyPbh
- TLSH T16802228CA7800812C8291B7BA0D483580D04E7288571CB2716900CE42C8B4CCF4A0D04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/databases/logsManager.db
- Size 24KB
- SHA256 c65ffb125ff655c675b838309c145922f25b86941bb44a857c5a76bc81c98d7f
- MD5 97fca2c241d1d661d46088d8dc326a34
- SHA1 c455a5a21916db232f2ce1e041d3ba517bd5899a
- SHA512 58dc19bba8c95865c46216ab37faa1c5282130b2157928d18bbfdfde00aea901c0277ad69a34b3789223dd5bb72d193e37e4983317f2d841a410150c668157b6
- SSDEEP 12:TL5ta5fu0QHSk2F+DugFjJAOsEexOGQGTuRmBEyPbD3OwOSsWwj0z:TL5tSuBUZgFjde3QUGSzOSsWB
- TLSH T1A4B202D5C74D3310C105453B8046D3A0CD598E5EC1A677A71AC038A99D8391DEDBDF6C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/databases/logsManager.db
- Size 24KB
- SHA256 ec0a4120febef56c074cf5be83e8df2fa3829bdfec627dcc0972f002c2e5cc08
- MD5 6a13452a057b696437c9307ab3d22a1f
- SHA1 d41f364a0080dd83cbe226b7ea0a6ee018a59a37
- SHA512 f41ac991c25566594291960c820a8ba4328bebc0f11c5654ffb02de1169b3ab8f847f2352ca505e0605147e35192971670ffb16b400032b9fec572fbbf3209d1
- SSDEEP 12:TLWXtuQ5fu0QHSk2F+DugFjJAOsEexOGQGTuRmBEyPbP/uqoxpOSsWwPaax:TLItukuBUZgFjde3QUGSP/uDfOSsW+Rx
- TLSH T142B2FEE4D55E2310C1069279805AD0A0CC595E9FC7B2679B5FC43C958E43819E8DEFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/databases/logsManager.db
- Size 16KB
- SHA256 3cea66196cdf773ad45cc3bd09d5a9c46f3f3055c4aa99ad7a32a79ad3723dc8
- MD5 2aeb0985a9f98ebb34bef4a5930dc142
- SHA1 caa71d3d4c1e6382b7a528ad6c55cc7de104ca93
- SHA512 7aaf77511493860585552c987bcea0ce1873e6239c3f50bf57ac427e9362b6657d47b0a0f6f2fe475e5bc4323a5cb514582417eec7c91332f3bb6d202360af3f
- SSDEEP 12:TLbt05fu0QHSk2F+DugFjJAOsEexOGQGTuRmBEyPbP/+mbbwqkZSsWwJ:TLbtYuBUZgFjde3QUGSP/+mbbPkZSsWK
- TLSH T1FA7210D5C58D2312C115417B708A9150EC0D0F5EC17227DB1FD23C95CD4381AE8ADFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/databases/logsManager.db
- Size 24KB
- SHA256 581d147f9cd373dbfbd794661e36e6b13c6d0509c8bd10731e9cf696c3a14717
- MD5 04f6f5929469c5160945f8fc89a3fffd
- SHA1 a0fd0409c845439a91b5e416d707566c8e76baa9
- SHA512 4b6efec21534ae1531557678cb772164b0ed6bfa0f75ae70b4e7437b5107ea6c89426494ad0ffc1efefe4495055b51c2a585dc8f4b96dadd29a7fb414f8c1f72
- SSDEEP 24:TLiBtXuBUZgFjde3QUGSP/hjQq81HZ6u3mbbPkZSsWrQw7:TOSaye3KSP/hUq+ZH3QbY8QA
- TLSH T18EB2EAD8888A1313C224107BB08A9461FC1E4E4EC26327C69AE63C518D8384AA8A9FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
- Size 512B
- SHA256 a103dc83e4feccb57bdabb6d4619cfe81e941c35125f4d5363e40d7069c994fb
- MD5 dd1a9e3c36e57388802b8aa11a302593
- SHA1 6b46caebc1386f11b99f10444542e3a8e37319b8
- SHA512 30dc612d4cbb9e0b502a451aac43e56559edbb5df4ad06f012fd20630cae0e452815577af5423e1649d217e69df02e73acf87cb58a08cfb6ea47adbb1d9e161f
- MD5 SHA1 SHA512
- Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
- Size 8KB
- SHA256 850c205e65e046f1cd74b19ddc859095c27114d08e9a20ba0ad43e1875eecd71
- MD5 515c5c6d236424ecfc8a3955d76f9bde
- SHA1 02ea758c12db305f66cc6712b2236ed5e71191ec
- SHA512 e6ca5704972803a9612e2c2abfe6064bd7452317738ecb0a54919938b5ca0f7fd511ddd46d527de5db647a05d4aa76f2a46f6547b079c100d0fbad034aa68428
- SSDEEP 6:7+/l9qGUHn1SGW2vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK4:7+tslxvqLiuWdYRmBEyPb/
- TLSH T10B02C08CA3800913CA2D1777B8D4C3404D18E7388571CF972690089CBC0B4CCE4A0D14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
- Size 8KB
- SHA256 fadcc584ebb9ae37f1f9c6ba44fb56f1efa6a7597c0fb75cc40a4cea24af58fc
- MD5 4e0081a073d460a37d88eda2357fa210
- SHA1 7089719d006dede0700b2278444db2ed424e9bdd
- SHA512 667282aa8686ccff9fa9140e135c5f03ae2baf05ca0fa75763f6883d42aab2c9626a01948d0a3feb969bf697b4d7c4329157cd8f5a4fb66d100db7ad27c6006d
- SSDEEP 6:7+/l9klFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK+/Gl///:7+tWBqLJdeWRmBEyPbgX/
- TLSH T12502C0CAE3400803C02E1B77B0C883401E16A7289373CF0B1691085CBC077CCEC90D40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
- Size 16KB
- SHA256 6bb383505fe1723786d373920e6470463b0c234c26ae4e87451bf851f299d64c
- MD5 8c2dad4f80bb614accd804d6a5685cff
- SHA1 3589e7fdd5a0626d763b9d46e66bdc86a0d2d801
- SHA512 39d1a670e488ed34cf3dde8f879f5d8030f0430dd111f87460947c773866fc182e09866e667c1b7f62dc28ed7b316854cad06856a5c92f7c2de52756db652090
- SSDEEP 12:7+t75ggBtrqLutB5fu0QHSk2F+DugFjJAOsEexOGQGTuRmBEyPbTY:7+tukqLutjuBUZgFjde3QUGS8
- TLSH T16472E1C5CA5F2311C109C176404780609C1A0E4DC1F357971AC538A84D435AD99ADFAC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
- Size 16KB
- SHA256 d79cfd741338002e482b4f57e01dfec4dee4bd692d4331d3cbf20aabd7e4a794
- MD5 4482e34c9266241d9afdad1a0bc1783a
- SHA1 24c3fac6ad9a2641618d2cdc18716fc7c85ca06f
- SHA512 2e5bd989bd73e43d0859af941a8238d7ec0074eff30a359346558f4ce2a28f8c94e5f27402b8db691dc04b54c6f5a5930f41994476456000dd74aa6ed04c10b5
- SSDEEP 12:7+t7jWDyMASsWw1qL5ta5fu0QHSk2F+DugFjJAOsEexOGQGTuRmBEyPb3:7+tpSsWUqL5tSuBUZgFjde3QUGS3
- TLSH T197722DC8C61E3310C102853B9447E1A1CC194E4DC1A377AB1AC038B98D83829E9AEEA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
- Size 16KB
- SHA256 d440226043f113e116d3cc22532a3a037515c3e93b360858ce032fb31980f27b
- MD5 d286572037e1fe3d007b5248c8335f05
- SHA1 f9aa9f424e743f71d3476d5ce9400fa37e5c734b
- SHA512 86a2dbd2113a43680c7da6faad3c9c08f6649b48fe0fdfdf262259b46c1d2031dc27e90d8d69e074c30e506cbd0a1e3e51615de58baeb2d294986994696b6151
- SSDEEP 24:7+tK0W2kmbbPkZSsWSqLbtYuBUZgFjde3QUGS4n:7MKHzQbY/qvaye3KS4n
- TLSH T1BF721EC5A94E1312C116417EA09A9091EC1A1E5EC2B2279A2F813D968E43C16E9EEFE4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/files/PersistedInstallation8065327837228812464tmp
- Size 569B
- SHA256 b4d8e92b2f0f7dafbf25e9e284d8a3fd6e53e95fbdf547e83ea85e6d79f2cb39
- MD5 e9c96746f8d7e91d370b6791742c009d
- SHA1 6f098e0a92d5578dce94e9016cb1ef2f259315e8
- SHA512 33102dc339b4082f7304acd7ec8e525a79e849be70c4f71c10601eb404699bdf1499370522d92417478a071890d40fd18df61fb54c4d70e7764472c9567e0ba1
- TLSH T102F041DD45109D1976CBE143544CFC14AF5F08D8141B1672BE974870D19A99A5607D00
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.aleghe.hatra/files/PersistedInstallation8287756880098533567tmp
- Size 90B
- SHA256 4b50d3b9855dfb6411836e5cf11ee24eb14801132e27ffdf6f3bfdcf1934f4a3
- MD5 5528fbd57a164130eff31c598994626b
- SHA1 db4733a0b61a7363d07856561b22ac4e7d2c3cb2
- SHA512 e422036a6fac17976afa0e08871a19e830edf8a7fd72dac42d0fe8644d23484fc1664c0fbdc9cf5c657a756443616c8a349f830835aa254f85ad35d9c83866e0
- TLSH T170B01285877142818589F20A2D4CA1005E625441080BCB154E4EE44060C31E48153DD8
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
- MD5 7e858c4054eb00fcddc653a04e5cd1c6
- SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
- SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
- TLSH T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 2d60fa894ab1bbf23e3934b836bf3e8385de351ca4847a4961734627fbaa7146
- MD5 6ae4d53c69f7a148bfa54b776c50437d
- SHA1 660d56da8731e07cd4bc8b66c00ca5c4904836ed
- SHA512 b4b93e34880d15525663d610025dc42a9613444d71760e6c49ef5e10901c67d59973389152bddbcce44225b81e3a1cb7070c3a618789f1aefcede2c0c35aad64
- MD5 SHA1 SHA512
- Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-wal
- Size 108KB
- SHA256 6bbf626935939d516e4b33231d71a88fe62ea2f7648e5a35a4d90ab6135bf485
- MD5 8d57e276b4161cdfd022e8bef73926e4
- SHA1 a5a2da9cff875f8e200119e29546e29c8b11ae3c
- SHA512 2f5bb9015dce1bc43b3dead7f6e4669ce8f797551da58809426a06c8c066a193eb3d828e77bf08bd477c9a4d7d20886ba94a3e2c7baf956f218574b3cf0bc9ca
- SSDEEP 48:TU1FY66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchD:w6+hdjnHtDRMpf8UzS6+BD8q0ExPeRQP
- TLSH T125B3024E0F1A3940C59974F0A9900FE17A3E462ED7A3E3E969910079BDC5D21DE29CFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-wal
- Size 173KB
- SHA256 70e574301974270214569bd00cbd20d8c528c3bbd4cac5a5b3ff569eb99a1560
- MD5 ae427b6b4303ec0cc21b6fa8b507c3a5
- SHA1 82141f01842de3ef0d9e18f158ff03979838c814
- SHA512 a1622604d293fdede9fe3b8070c55add80cfbfbb6fb215671f0386ccb7281638c2e4e4c5c71af4a834edee1dbf1fe6cd8797b5ce6636e2ced9644c12b1a6349f
- SSDEEP 48:EU3tYXpaB+ZF5+lX/1cjLZt33tYa9bUdf3:N3tYklXiR3tYBP
- TLSH T1FB042BDCF36B7DA0D7403FB9896042EE1B8E8D91442682DEA8E6F7303995D5320F4388
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 9af4d39f76f0ebb3e739dbc7b57d1ee289c8f78dc350d4a6840786cab8d90a80
- MD5 00d0663beaf13ced8e9ff0147ba9ac91
- SHA1 94c56ed9317f7408172acb553c2074824cb37055
- SHA512 ea6e4ba5da1467505810dd922b6c97a7b95742f3982b90b62c55f43be7ec04605c1d46f13f6aaeeeb426c4e31d0f2b2d6644c1f1545d6a1d5b172dbb28a65d52
- SSDEEP 6:Kq/GEXaSjJ9FZde/kPlOERX4PBX4ogLugMBX4suuK+/ctsXk8/2+gOw2:Kq/GEXaSjzdeWRmBEyPbP/cf8JgOw2
- TLSH T1CC72C25493C23A53C3192272ACC5C3041F2D6B1A9372CB0F694508147D42FCAA050E0D
- MD5 SHA1 SHA512 SSDEEP TLSH