Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    03/10/2026, 06:20

General

  • Target
    Paar.apk
  • Size 4.7MB
  • Sample261003-g3w33styct
  • SHA256 53df28cf437273bffd14d5b5878ab639502602308ec560ceeaec572b916be449
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • me.paar.app
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4983

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        firestore.%5BDEFAULT%5D.couple-bd6f2.%28default%29

        • Path /data/data/me.paar.app/databases/firestore.%5BDEFAULT%5D.couple-bd6f2.%28default%29
        • Size 156KB
        • SHA256 89934d10b111c68441bff6f4cd5b5fb97d71da9bb03079206600f2591876830c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        firestore.%5BDEFAULT%5D.couple-bd6f2.%28default%29-journal

        • Path /data/data/me.paar.app/databases/firestore.%5BDEFAULT%5D.couple-bd6f2.%28default%29-journal
        • Size 512B
        • SHA256 27c64ec417f5bc3c2cf0a0fc2fe268aef319bcd0a6f1942cab54635efc2d5830
        • MD5 SHA1 SHA512

        firestore.%5BDEFAULT%5D.couple-bd6f2.%28default%29-journal

        • Path /data/data/me.paar.app/databases/firestore.%5BDEFAULT%5D.couple-bd6f2.%28default%29-journal
        • Size 8KB
        • SHA256 d9350f8246a3a4503d9230a6a9bd6a58eb2d8478bb35bbd58e793b9b870c5840
        • MD5 SHA1 SHA512 SSDEEP TLSH

        firestore.%5BDEFAULT%5D.couple-bd6f2.%28default%29-journal

        • Path /data/data/me.paar.app/databases/firestore.%5BDEFAULT%5D.couple-bd6f2.%28default%29-journal
        • Size 64KB
        • SHA256 7f719e71f4cd8a1756bf9cfce2e0fe73f67c2abbe1e6fe04110fac74ed9835e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MTo1NzI1MzIwOTUwMzE6YW5kcm9pZDo2NjczZDcwNGRhYmE5OTIwYzVlN2Iy.preferences_pb.tmp

        • Path /data/data/me.paar.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo1NzI1MzIwOTUwMzE6YW5kcm9pZDo2NjczZDcwNGRhYmE5OTIwYzVlN2Iy.preferences_pb.tmp
        • Size 354B
        • SHA256 5ee064513a31178865ae02a668a71db26c3fa320b21f4893a664b7e5c2e3f550
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MTo1NzI1MzIwOTUwMzE6YW5kcm9pZDo2NjczZDcwNGRhYmE5OTIwYzVlN2Iy.preferences_pb.tmp

        • Path /data/data/me.paar.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo1NzI1MzIwOTUwMzE6YW5kcm9pZDo2NjczZDcwNGRhYmE5OTIwYzVlN2Iy.preferences_pb.tmp
        • Size 378B
        • SHA256 4f8a20441d2ed0a8e5720fbef3c2de09a7585432bba6558e78f3b1785a7eb068
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MTo1NzI1MzIwOTUwMzE6YW5kcm9pZDo2NjczZDcwNGRhYmE5OTIwYzVlN2Iy.preferences_pb.tmp

        • Path /data/data/me.paar.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo1NzI1MzIwOTUwMzE6YW5kcm9pZDo2NjczZDcwNGRhYmE5OTIwYzVlN2Iy.preferences_pb.tmp
        • Size 378B
        • SHA256 d6df800cbf6a2191cc991f1659537e4a68a16a861c88d1a6b4ebf65b330e0f7f
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/me.paar.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 69427c9d8628e72e920f8b6556f7117cfa8458d45e7762f59c1b591b6ecccc6d
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/me.paar.app/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/me.paar.app/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 bdc36b42a60bc90895ff90c8f50486fa9a20344711b6484239a462b6ad860ae3
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/me.paar.app/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/me.paar.app/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 4e583dc8f8e135ab7e635d4ed96521377120010a2d2435f914e364de789cfad4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/me.paar.app/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 5a99395583fe6d75187709fa52c99e5d8d1021ced80c9d5c31fbd5f684fa3c3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/me.paar.app/primary.prof
        • Size 11KB
        • SHA256 991c40f75f8b32b52420c86d73182c2c541092abbf7830739b40ec9d12b20560
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.window.sidecar.jar

        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 12KB
        • SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
        • MD5 SHA1 SHA512 SSDEEP TLSH