Analysis

  • max time kernel
    139s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    02/10/2026, 07:36

General

  • Target
    29d617110741d2922c03daf441a394641ed68d11d7224c8f396b493d83ab356d.apk
  • Size 94.7MB
  • Sample261002-jfk4eaxt9q
  • SHA256 29d617110741d2922c03daf441a394641ed68d11d7224c8f396b493d83ab356d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.pt.bark
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4812

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        environment.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/environment.json
        • Size 12B
        • SHA256 80be2eb0944c0453a6ad339a56e1c8f39f8cc57a4e627758246ccfd274176fd8
        • MD5 SHA1 SHA512

        release.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/release.json
        • Size 24B
        • SHA256 3d5c22f00fcdab164c273c215867beee4ae197a8ad711122fa55f8e5ebecfdcd
        • MD5 SHA1 SHA512

        sdk-version.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/sdk-version.json
        • Size 591B
        • SHA256 7f4c5c11a11641abdbe3015733912cce9a6ad252ec46b1abea7ce3d46f59020d
        • MD5 SHA1 SHA512 TLSH

        tags.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/tags.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512

        breadcrumbs.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json
        • Size 4KB
        • SHA256 d1aa18e81e452e6b6605e2a53ec53235a26993842e62af73c743aeb83c320b33
        • MD5 SHA1 SHA512 TLSH

        breadcrumbs.json.tmp

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json.tmp
        • Size 12B
        • SHA256 ae1afdb53fc94d62b6862659f839a20634382b65a7354f32b5e81cd29fb4270d
        • MD5 SHA1 SHA512

        contexts.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/contexts.json
        • Size 62B
        • SHA256 01870d5d7b208dcf75df9c13c2f8c636dd5b711abfd33f4f424fd3808d753cc1
        • MD5 SHA1 SHA512 TLSH

        contexts.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/contexts.json
        • Size 63B
        • SHA256 dda403ea3f2dc79793e354552c63edfb2be6a7676df6d0ecdd02a12055fcdad8
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 8003b121da21a411afe9c58a270102377a8963c6ad52929075e37e072036de92
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 188B
        • SHA256 83e97941867aa6d0478a95421e44a03b6fa9e4cb4e594ad8eca88c4c87817431
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 0ce092bde6e3dd30a7a77e004c5cc342fabc970e9141b605d1b6de3ac55656d9
        • MD5 SHA1 SHA512 TLSH

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 18B
        • SHA256 96f7a5db03a7c5ec7847b1ca053fa92d19552fe07cf22a21a004e4aabed4a95c
        • MD5 SHA1 SHA512

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 16B
        • SHA256 96c4b7db81f09c9990c9e856e2d350b49f8ca5e0657620be9a6632cc3d7aaf1c
        • MD5 SHA1 SHA512

        installation_id

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.sentry-native/installation_id
        • Size 70B
        • SHA256 8484a5b01196ecbb7d156b327b573a4548b95f1755a9cfeeaed30a415805a0c1
        • MD5 SHA1 SHA512 TLSH

        150b8a2fa757415dbe9aa334576c1d02.envelope

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/150b8a2fa757415dbe9aa334576c1d02.envelope
        • Size 935B
        • SHA256 6c406ec3a344646806c351d00dfeeef62f3d381b3dc5bb39a042672dda1e7e20
        • MD5 SHA1 SHA512 TLSH

        session.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/session.json
        • Size 268B
        • SHA256 e2ebbc51347012412442936b977453254475e214c876a9f6b5c744e61ad4c4d2
        • MD5 SHA1 SHA512 TLSH

        OneSignal.db

        • Path /data/data/com.pt.bark/databases/OneSignal.db
        • Size 52KB
        • SHA256 491c9687657ca71661a5cf42a763249f88fa222edaef20eaf552c4599458f99e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 2e1746d1ba598a617d885003071ded967912daabca9d971de236efcde6972b72
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 aca671dd188e73fe5ca0462986394ee2e50a69cace6ab86ff62bacd342da7431
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 b19b9341975498c31546d79b01573b3c233ea1dc47e6d8ab6b9e87e6ab511c44
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 bacdf60d3dba7fe9c9db7b49d2a2628a7d08aea19847f1b70ac2a8af56f769fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 85f2a989917e04e38608305b5c0a783d4c74172b6780081532e18cdf8a18dafd
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 9de6b1430cc82ae9a9619a29434c2cc969e237a774fa505fbf1febc8196c75e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 e9aee96ff6207a361c77c3ad426fd9991048c7c52f494481634205b483c2bd86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INSTALLATION

        • Path /data/data/com.pt.bark/files/INSTALLATION
        • Size 32B
        • SHA256 372ae6ff180418925a497ca87ff42f6a51f513c676575627c4831511df0f87e4
        • MD5 SHA1 SHA512

        PersistedInstallation3065017779802643692tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation3065017779802643692tmp
        • Size 569B
        • SHA256 90c11dd0632aaae1822a8f1b3c7d11b75009bb891f2f00dde2a9537059467836
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation364437495805709581tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation364437495805709581tmp
        • Size 569B
        • SHA256 b79aae161c73f85b43681658c084333d5eb7a621b8289ab1ef8c5f15d15a9244
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation4690661172957104925tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation4690661172957104925tmp
        • Size 90B
        • SHA256 3d436b9c184ed3737f089d71f90709879577eb44d7ba8acd5a6e041ad87a0133
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation5328530595436526767tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation5328530595436526767tmp
        • Size 90B
        • SHA256 2d8eeab75a69d0d8f4c72b0799ffd6c3f54213bf69c3e8644e6ab0680f57a377
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.pt.bark/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 f8bfcae43eacecab031abce96a468f08ba4064146c66350f796940a0438ceeb4
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb
        • Size 100KB
        • SHA256 a6d6517379ecbd5d168531e62a3ce33e24e6a0f028b78c1fc29fad2dba22a159
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 44e75cacd2650937b8a1ef31b0d6c41cefa4e05e2f3308173b9e6f53b0d94248
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 0fa57160613085699dbba701b537c71bd8260374f4ffd3a567649c353377eaba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 f85e44ac48c5df1096b40bf12501366ce205088aabf1b5a25dccc16f4b0ba0a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 410KB
        • SHA256 e0e94a017c7b1c230c48fb84de516508d3450df2b924494e573f0f3959cafaf3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 1KB
        • SHA256 bfc16c3dc40230f63d419733215a5773d91ac39bbaeb91f3cd2c9c03f058ba98
        • MD5 SHA1 SHA512 TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 14KB
        • SHA256 046df2639da92bfaabcd16e5025a8e1ec8f8abc10a7abcad716eac51e9dd7293
        • MD5 SHA1 SHA512 SSDEEP TLSH