Analysis

  • max time kernel
    35s
  • max time network
    154s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    07/10/2026, 07:30

General

  • Target
    7dd30b39ff19bdcd6443bb94738e897dc386f5491fb5e54f81c2d3d767144a0c.apk
  • Size 68.0MB
  • Sample261007-jbsmpaft7n
  • SHA256 7dd30b39ff19bdcd6443bb94738e897dc386f5491fb5e54f81c2d3d767144a0c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Checks the presence of a debugger
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • org.traccar.client
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    PID:4972

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 f8e3836ef4f4d12784b5744da95f574affe633d006791f4ef05182adcb9c2465
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 886da53fb5ca9ca079ceb33acfb874d9de7d41eed15515a6d30a041d5dc85175
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 9db00684b8e4822b3e9e3423a430a0dded2c62b9a8f85fe4610d5d4163112f90
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 2dd29f06817d61c991a32e35a2fe68109d401ba9a98a2f20b762551e8c04b7db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 8d2974ea1b3144f89dedde346a7ebdb32ed39489f3108f41510f757a1c86f14e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events-journal
        • Size 20KB
        • SHA256 c317d5cfdcd04c7d6e6a367d3e8f5354e6b7996d4eb459e4f2dc852c12f3b854
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 adfb03cddac9392c3fc46a591cfffa659186f0af316356bcd6ceac63b2b246ce
        • MD5 SHA1 SHA512

        google_app_measurement_local.db

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 fecda2e650a2cbb3652d60ee1843b2e8fa9858bab765aee964b59b80a73d5c97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 ee9e4646a8c731ca9e0efd5fae2cca4d5074bfbef2565f33b7a3533f82114d58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 b80bd4eafd2d5dbe8b660707b35479d91c9dcb63352335a642fb72f5f1ad797e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 a099729f7901074738c525af3c0e4e581f4321a0e5d0df953281ce68844561b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 3837adcac2aaaf2e96d9d062642f1b326f253a307d4934bbcc2a970615c9634e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 8b476649983b8f64c9c1bbe651fdb646bee575cd914a230fd733facd0d0863ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 0c66d26dda39f4c649897768e9ad5a855b7f00537d6605ea53aa1a5d1d08e807
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 d912171782eef896eed14e9323c41a9910a3bfaa6b976b1e86b072f7936579d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 f5f1b19c7b0024487bbda25559e79a128eeadff322840353b8b7de0567b96f73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 3050d479630c0f4a7d02b7ad5d1b2732b6f1bb8bb5f942bb617fffbacf2c0a20
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 9c0ce0eb0965f70e5727299029c852005f08ac3ac754e6ef637c68e2a878d184
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 0e2eaa60825ca13ce4a9e5929b9e6b7ab25e5a1319887ef713bfcc160f889003
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tracker.db

        • Path /data/data/org.traccar.client/databases/tracker.db
        • Size 32KB
        • SHA256 6eb41081e03332166c0a6421519f9c8d0fd769b4a05c5a19aee49f60a49ca173
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tracker.db-journal

        • Path /data/data/org.traccar.client/databases/tracker.db-journal
        • Size 512B
        • SHA256 a9b6dcc9f9e79a4cc6778cfeefffbe5f4398f618e25285caf07e2f23fc7d54f0
        • MD5 SHA1 SHA512

        tracker.db-journal

        • Path /data/data/org.traccar.client/databases/tracker.db-journal
        • Size 8KB
        • SHA256 8da065b9d035b40ce0f9ff53b9524650e71e35505567e6867892890c173a8551
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tracker.db-journal

        • Path /data/data/org.traccar.client/databases/tracker.db-journal
        • Size 8KB
        • SHA256 3765fc20d949c492d0865ab8502a0111e4a645c7d9657a6d711d90edee775e9c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tracker.db-journal

        • Path /data/data/org.traccar.client/databases/tracker.db-journal
        • Size 8KB
        • SHA256 ea9ea72a774a3835808d5ced548996f4788cc904f83f2cf247a4f6933b54e201
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tracker.db-journal

        • Path /data/data/org.traccar.client/databases/tracker.db-journal
        • Size 12KB
        • SHA256 f4484bbb2f5063a3580b07baa442a099a5f3348e7b6f0a0f06b8092c596b0103
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.crashlytics.settings.json

        • Path /data/data/org.traccar.client/files/.crashlytics.v3/org.traccar.client/com.crashlytics.settings.json
        • Size 767B
        • SHA256 e0e990f5d4436ffd97fc3e0a8b0da2ca1307cb36075136c3976ac2784452c8f6
        • MD5 SHA1 SHA512 TLSH

        internal-keys

        • Path /data/data/org.traccar.client/files/.crashlytics.v3/org.traccar.client/open-sessions/6AC5F518013A0001136C713C5D7E9298/internal-keys
        • Size 107B
        • SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
        • MD5 SHA1 SHA512 TLSH

        report

        • Path /data/data/org.traccar.client/files/.crashlytics.v3/org.traccar.client/open-sessions/6AC5F518013A0001136C713C5D7E9298/report
        • Size 823B
        • SHA256 6fe1d9961510946438476fd22c17dad17102cde308f143ee385cb2780f59198f
        • MD5 SHA1 SHA512 TLSH

        userlog

        • Path /data/data/org.traccar.client/files/.crashlytics.v3/org.traccar.client/open-sessions/6AC5F518013A0001136C713C5D7E9298/userlog
        • Size 189B
        • SHA256 1ebe04b77c1f43096e227074b12f84c73d0e97e8617d2ec7f3e3c0bad7bc79a7
        • MD5 SHA1 SHA512 TLSH

        userlog.tmp

        • Path /data/data/org.traccar.client/files/.crashlytics.v3/org.traccar.client/open-sessions/6AC5F518013A0001136C713C5D7E9298/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        PersistedInstallation2277338735111352386tmp

        • Path /data/data/org.traccar.client/files/PersistedInstallation2277338735111352386tmp
        • Size 90B
        • SHA256 036c717a1303a0ce83a8bbec52f62fc108746307246a32fcf6382b3783e1b7ec
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation7055845008344398001tmp

        • Path /data/data/org.traccar.client/files/PersistedInstallation7055845008344398001tmp
        • Size 557B
        • SHA256 262ad9fd5f9b65b594ca7c261d418014d7590cbade079416cf3e80f4f48b1a6e
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MTozOTAxNjQ3MTM5NjphbmRyb2lkOmIxYzcxOTRjNjk5YmZhMjU.preferences_pb.tmp

        • Path /data/data/org.traccar.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTozOTAxNjQ3MTM5NjphbmRyb2lkOmIxYzcxOTRjNjk5YmZhMjU.preferences_pb.tmp
        • Size 481B
        • SHA256 f42b623b9bd0462597c3cc387955b247ac2052c267a75a1ba69fc771ca4c9fc4
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MTozOTAxNjQ3MTM5NjphbmRyb2lkOmIxYzcxOTRjNjk5YmZhMjU.preferences_pb.tmp

        • Path /data/data/org.traccar.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTozOTAxNjQ3MTM5NjphbmRyb2lkOmIxYzcxOTRjNjk5YmZhMjU.preferences_pb.tmp
        • Size 505B
        • SHA256 68ec918cb440733fc4df3876de98a7c9b16e0df67f5156e5c0ce416acb5ae8dc
        • MD5 SHA1 SHA512 TLSH

        FlutterSharedPreferences.preferences_pb.tmp

        • Path /data/data/org.traccar.client/files/datastore/FlutterSharedPreferences.preferences_pb.tmp
        • Size 34B
        • SHA256 17840bce0cea671e0fb34d992bb617e3fc817134b6aabfc2ab7c2b21da0d1a6a
        • MD5 SHA1 SHA512

        FlutterSharedPreferences.preferences_pb.tmp

        • Path /data/data/org.traccar.client/files/datastore/FlutterSharedPreferences.preferences_pb.tmp
        • Size 60B
        • SHA256 d639018322749c733c002c9527864baca74c503f629ec2c652c773b5e84fae83
        • MD5 SHA1 SHA512 TLSH

        FlutterSharedPreferences.preferences_pb.tmp

        • Path /data/data/org.traccar.client/files/datastore/FlutterSharedPreferences.preferences_pb.tmp
        • Size 92B
        • SHA256 1cbc070e0cc26aa793901dd40ecbc61fa4477549689c75290139f2dfcd4b3b21
        • MD5 SHA1 SHA512 TLSH

        sessionConfigsDataStore.data.tmp

        • Path /data/data/org.traccar.client/files/datastore/firebaseSessions/sessionConfigsDataStore.data.tmp
        • Size 145B
        • SHA256 dc7fd6876bcaa6e574bd6589ebbd8df7a70d4a382d866797c34ea44cdc616b40
        • MD5 SHA1 SHA512 TLSH

        sessionDataStore.data.tmp

        • Path /data/data/org.traccar.client/files/datastore/firebaseSessions/sessionDataStore.data.tmp
        • Size 278B
        • SHA256 29ae0175fbc70b3f722b6c2a4423f80a7fadac3fd8bceddb6454145ecf82d6f6
        • MD5 SHA1 SHA512 TLSH

        flutter_callback_cache.json

        • Path /data/data/org.traccar.client/files/flutter_callback_cache.json
        • Size 226B
        • SHA256 d569ac2f32d1dc07ea9feb5fd881d78786e724bbd95743de69e2d82a940048c9
        • MD5 SHA1 SHA512 TLSH

        flutter_callback_cache.json

        • Path /data/data/org.traccar.client/files/flutter_callback_cache.json
        • Size 389B
        • SHA256 cf90534b15b1f7497d031e5911bdc6a75578fb215f8d66beeaad72f9ad7e1fc3
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/org.traccar.client/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 fc1f9f17e9333816205d766755e631c614c11458417078dfe6401601df73aeba
        • MD5 SHA1 SHA512

        primary.prof

        • Path /data/misc/profiles/cur/0/org.traccar.client/primary.prof
        • Size 1KB
        • SHA256 2d8b0846766ed8f327868d8b71d465f9b8c9aa4ae5a09ac74c792292db541d69
        • MD5 SHA1 SHA512 TLSH

        androidx.window.sidecar.jar

        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 12KB
        • SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
        • MD5 SHA1 SHA512 SSDEEP TLSH