Analysis
- max time kernel
141s - max time network
151s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
03/10/2026, 06:20
Static task
static1
2 signatures
General
- Target Paar.apk
- Size 4.7MB
- Sample261003-g3w33styct
- SHA256 53df28cf437273bffd14d5b5878ab639502602308ec560ceeaec572b916be449
- MD5 5bae41ac2a6c60573a8210c3227fb89b
- SHA1 58b897d4f560a70e1cfc156a4866948a9c04c7ac
- SHA512 d55e62cac7f2e098a2fef804d4ff81279edfe38b533acb586c169ce18e988310057dd4f177040db0e951c74b6746350ea6ee7db9e1346c23f247db15a4936e66
- SSDEEP 98304:0//rykBwU5+dbFNPozaTFlo0NZjZLoxMk2BcOjya6hCvr8YoPdTXziR:qDLBwUgdbfPYCFloKZ9yMYOF9ETXu
- TLSH T1FA361245B7A9BA2FC83382721C4AC23121169D22CF42D747B45537BDB8B7BE80E953E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /system_ext/framework/androidx.window.sidecar.jar 4983 me.paar.app /system_ext/framework/androidx.window.sidecar.jar 4983 me.paar.app - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal me.paar.app
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/me.paar.app/databases/firestore.%5BDEFAULT%5D.couple-bd6f2.%28default%29
- Size 156KB
- SHA256 89934d10b111c68441bff6f4cd5b5fb97d71da9bb03079206600f2591876830c
- MD5 37795e092ac8be02b383240c3ee8f846
- SHA1 80e21e1b31f1beaf0eb19c71cb66bb5fd7a462bd
- SHA512 c236a9e446b667cfb4825ac4639a193ba52bd9d91a6a60c363f181df02d853a48ec93e8dca364b39430c93b2b15767b83db6a39d9c455cfea90838ce0b53a898
- SSDEEP 192:4bLPddXrBskXxgl3WDDEIyt6GrrgbpBQHNGG:qrdd1syxgFW1yt6G3gbpBQtGG
- TLSH T1DBF364E19E24A060C5C3057771B34BB39EBE8B96F12371617EEC16115CD5A84A43E1EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/me.paar.app/databases/firestore.%5BDEFAULT%5D.couple-bd6f2.%28default%29-journal
- Size 512B
- SHA256 27c64ec417f5bc3c2cf0a0fc2fe268aef319bcd0a6f1942cab54635efc2d5830
- MD5 9feaeee9ffe16394c8bd7e34f2bb1941
- SHA1 601e756a2940459dacb66e4cffe1607a7e909a36
- SHA512 3c0bd9e3c03161438cd3c395422ec7720a78f4f1cffee0acf304fef08c09d71b89ffc760940889b900cba506554d1f789ad4fb5e10f8529d0961a8ab02b8cde4
- MD5 SHA1 SHA512
- Path /data/data/me.paar.app/databases/firestore.%5BDEFAULT%5D.couple-bd6f2.%28default%29-journal
- Size 8KB
- SHA256 d9350f8246a3a4503d9230a6a9bd6a58eb2d8478bb35bbd58e793b9b870c5840
- MD5 04507d5a0a5b72e30c433d25e9e72ecb
- SHA1 3caf8000dd09fe75c6ab4659a9e945585e10ae38
- SHA512 178b0f56e9f456ec14ba7ad1b210b8db0f84b7acfe44015540aee092a9437beebc869f9f3e0977acb6a751626b0351169d5facff12a1c9b71a6a9d604d44077b
- SSDEEP 6:7+/l9V5n1dKJvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK9:7+t7IJvqLiuWdYRmBEyPbm
- TLSH T1D102C09C67800813CC2F9A7794F493410D00F7398171CB1B379008B63C074CCE4A0D0C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/me.paar.app/databases/firestore.%5BDEFAULT%5D.couple-bd6f2.%28default%29-journal
- Size 64KB
- SHA256 7f719e71f4cd8a1756bf9cfce2e0fe73f67c2abbe1e6fe04110fac74ed9835e6
- MD5 c799b48ee3181b7a44f1540b8d83ea3f
- SHA1 d22d61bbdcd88cde1d2f89ae3a02aaadaa929dc6
- SHA512 47ccdfa730cf2778091719384ef71b6fd12e545b200fd2a047a66ea6fbbebfaf574847d7bee0b7fab17ea8ed0e8eac7ec05fef838b6fd8926dcfe80f148b6c35
- SSDEEP 96:7TULgxQVypN6AmNvCjROKOQmRQZbwtnNR:7TUMRL6AsktDmRQdMr
- TLSH T1CC53FFF9D661E091C3A188FBB6635BF2DCDD8DE9A1223074A3DD6E9074449EC60781CE
- MD5 SHA1 SHA512 SSDEEP TLSH
FirebaseHeartBeatW0RFRkFVTFRd+MTo1NzI1MzIwOTUwMzE6YW5kcm9pZDo2NjczZDcwNGRhYmE5OTIwYzVlN2Iy.preferences_pb.tmp
- Path /data/data/me.paar.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo1NzI1MzIwOTUwMzE6YW5kcm9pZDo2NjczZDcwNGRhYmE5OTIwYzVlN2Iy.preferences_pb.tmp
- Size 354B
- SHA256 5ee064513a31178865ae02a668a71db26c3fa320b21f4893a664b7e5c2e3f550
- MD5 fc2edafb61a6a310f2c7f4b61ddfe126
- SHA1 5b94420326ebb318c74b0cb3d626d2f687602e18
- SHA512 bae126db342e918da2e83013c573658c117ce73590fce034608abe2d637445160286abdf4c4db1340b58c9b111c007b5929a57ffea327e186260a11eb6629061
- TLSH T1D9E02600DAE2AEA1182F520E7FA8012C0F7FF3E16175059E21F50184B95EA44D5C3F1B
- MD5 SHA1 SHA512 TLSH
FirebaseHeartBeatW0RFRkFVTFRd+MTo1NzI1MzIwOTUwMzE6YW5kcm9pZDo2NjczZDcwNGRhYmE5OTIwYzVlN2Iy.preferences_pb.tmp
- Path /data/data/me.paar.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo1NzI1MzIwOTUwMzE6YW5kcm9pZDo2NjczZDcwNGRhYmE5OTIwYzVlN2Iy.preferences_pb.tmp
- Size 378B
- SHA256 4f8a20441d2ed0a8e5720fbef3c2de09a7585432bba6558e78f3b1785a7eb068
- MD5 f89ac477cad3607e55a566bce9bf19f5
- SHA1 783dd3eed46bc8ec27add2ef49bcb2292b3c0419
- SHA512 5898ec6c783587b5237e0e34cab9937f0d9852ed6cafdfe087d22d9f35968259311a9676f11f2a912929aa44afbc895e841b4a0f91c15bbca2d86f04c84792fd
- TLSH T1BDE06800CAE1AEA1187F520E7FA8012C0F7FF3E12179045E20E40280BD0E600C4C2A1B
- MD5 SHA1 SHA512 TLSH
FirebaseHeartBeatW0RFRkFVTFRd+MTo1NzI1MzIwOTUwMzE6YW5kcm9pZDo2NjczZDcwNGRhYmE5OTIwYzVlN2Iy.preferences_pb.tmp
- Path /data/data/me.paar.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo1NzI1MzIwOTUwMzE6YW5kcm9pZDo2NjczZDcwNGRhYmE5OTIwYzVlN2Iy.preferences_pb.tmp
- Size 378B
- SHA256 d6df800cbf6a2191cc991f1659537e4a68a16a861c88d1a6b4ebf65b330e0f7f
- MD5 54f88f0470c448b099759abcecd88169
- SHA1 f2a8143c32da20991dba6cbbe3d6f06e7bd278cc
- SHA512 c1899ad55c98c2ec078e6bff21b7ccdb1747b85a26ddead195ebdc284aa0b829d40ed5779caeb989211a24f4acacc2414759670e6119f3d19248da07ed7fbace
- TLSH T198E06800CAE1AEA1187F920E7FA8022C0F7FF3E12179044E20E40140B90E604C4C2A1B
- MD5 SHA1 SHA512 TLSH
- Path /data/data/me.paar.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 69427c9d8628e72e920f8b6556f7117cfa8458d45e7762f59c1b591b6ecccc6d
- MD5 7976fced0a83cf43998d176eed58e44b
- SHA1 089fa62ae9027ee27879f705e442e52285674a31
- SHA512 fb2c69b7b5bf27579e067f703575a4ee99bc233afe3026dad965204ace927708629e0b8a47c7e74deae6d44a815304594a65a1f565b7a90f2b09a6d573c11fe9
- MD5 SHA1 SHA512
- Path /data/data/me.paar.app/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
- MD5 7e858c4054eb00fcddc653a04e5cd1c6
- SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
- SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
- TLSH T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
- MD5 SHA1 SHA512 TLSH
- Path /data/data/me.paar.app/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 bdc36b42a60bc90895ff90c8f50486fa9a20344711b6484239a462b6ad860ae3
- MD5 8bf3d5b582bfbf4e902a0812a117047a
- SHA1 dce62caffb22d1f9ab408f145dbe2b5d6d311094
- SHA512 02f6c14b96cc918a8045b755fa15acb88c2b77cb3f719f2d00bf0385c296a3e93e44e6dab6c9efd685bfd59a642535cc7a85b063a3f02ac3042d1714806784fa
- MD5 SHA1 SHA512
- Path /data/data/me.paar.app/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/me.paar.app/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 4e583dc8f8e135ab7e635d4ed96521377120010a2d2435f914e364de789cfad4
- MD5 1852d3c2184effcb00fe70e8d642be07
- SHA1 dba0789b66f34c87d82b5caca579b1a4f2b8bb83
- SHA512 4978f168a2ccc747186b8d851b0bc1e1171c0256b407f9fa14aa1d00978dcdaa835a127ad35b284eec7326cf1970a426342ba33355af49f1ce5c7b63f74fcf7f
- SSDEEP 6:KEmTMg9FZde/kPlOERX4PBX4ogLugMBX4suuK+/Ge9HEoTOw2:KEmgqzdeWRmBEyPbP/GeSSOw2
- TLSH T17C72C24453401912E92DCBB6D4C6C3111D9156AA5356EB0FDE51AC61AC4239CE970D0C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/me.paar.app/no_backup/androidx.work.workdb-wal
- Size 116KB
- SHA256 5a99395583fe6d75187709fa52c99e5d8d1021ced80c9d5c31fbd5f684fa3c3d
- MD5 b9c28eca29060fd027f7b268ea36ee73
- SHA1 be2da7405dc2c34210e3371855eff4779b59c227
- SHA512 294ffba8ed599647d5aae0bd8af537a143c53a9b13053515031b28f4eef3074f91be7057f4933bfc1dc313cb65eb46af429e8297b848e0aab85ad6b736babdb9
- SSDEEP 96:w0PjJSz6+etidjnZRWzzb8/KeKcK+zSiddKz+ZD86u0ExV:lUotidjnfWzzb83zSide+ZD86u0ED
- TLSH T111C31E8D0F192600C4AD98F0E4D10BB1797E412F9793F3D5ADA144B5ADD2921EE39CFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/misc/profiles/cur/0/me.paar.app/primary.prof
- Size 11KB
- SHA256 991c40f75f8b32b52420c86d73182c2c541092abbf7830739b40ec9d12b20560
- MD5 509ba3714522ef0351bdbc5825f51fe1
- SHA1 9db230be3cb708d5847115a958f9e07b01708742
- SHA512 9c70cf9cba5c5bc462d4807890bd10812faa241b656a47494dce8ddb731a23f22f5fc618874c88e16f1f9d4a0d415ba18135d0d93aca2c25db228523822e1295
- SSDEEP 192:PkxyNC30TaFxRdxxQWhYxFJL9piSVNhdHUAp5kweCAZioLeqLe7/AhLOIAcCc1DS:PkQCgaTRd7Yt9prT/HUAp+weLiqBLwIw
- TLSH T14232C0DA4C9F0DC5F9240ED166E1375B7AB020E36F8C9EA7240854B1BB60253A673DC1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /system_ext/framework/androidx.window.sidecar.jar
- Size 12KB
- SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
- MD5 bdf3529e80318eb14e53a5bf3720c10d
- SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
- SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
- SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
- TLSH T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
- MD5 SHA1 SHA512 SSDEEP TLSH