e720e76ebde4ddd5666e615a6d29273158f84e9af8a531762a58193f810b6d58

Analysis

max time kernel
127s
max time network
153s
platform
android-13_x64
resource
android-33-x64-arm64-20260708-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
submitted
07/10/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
plpetrosoftrailsmobile_30293527.apk
Size 13.7MB
Sample261007-w798tses4l
SHA256 e720e76ebde4ddd5666e615a6d29273158f84e9af8a531762a58193f810b6d58
MD5 6acebecf89ec3a15729b1fc350d31015
SHA1 6734d8e5e1e8c6b0c508b6d811f99dc9628b2430
SHA512 24874a7ab965524c14773739319bfbc0d2fb32f464d3952dbba0a709e12276f89c0bf249470371b6b96b783c4956001888e2e86417f7ed6c93ba9715392e664a
SSDEEP 393216:KzYnkg+ABDRskpphA21NdpaCEfjUJZxFs:6YTnvppp1RqUrk
TLSH
T101E601AAF729593EC0BB00B38C6B55357A6A4E759742670725043B2D34F72E84F8D3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker defense_evasion discovery persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	pl.petrosoft.railsmobile

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	pl.petrosoft.railsmobile

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	pl.petrosoft.railsmobile

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	pl.petrosoft.railsmobile

pl.petrosoft.railsmobile
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4157

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/pl.petrosoft.railsmobile/databases/com.google.android.datatransport.events
Size 56KB
SHA256 d10f7204b33fac1d337e5de1e94b68653dd63e5021e91e9726392a54dbfd9026
MD5 407d0a2ccef92190741d8b651c23b464
SHA1 3202b1b9b1016f505a5ccf198c615c3de998e416
SHA512 85902a782e4385d324b888ad51d42481587772e9aa82dca030268dd95036e099caa96f8c2a158a32d360d3b63c6b16fe2e6ba86ea4bae646ebf6e9f1d3376b85
SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSc:RMEX0wIyNjac
TLSH
T1F843639D5A2C2221C57E283ED7E143635B7C93DF5723926239908CF98DC206974354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/pl.petrosoft.railsmobile/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 d9ba846c8eaeddc5bb1edd5e2ac8ab9fdcddf7ffecb98111ecc29b433473f326
MD5 d6c7891fcf5fa22a8b54db9038ca22a6
SHA1 5bd566deae65cb30b026d487c74c9e6bb7a4c075
SHA512 83860b40153a3a4f1f52fad28d5f9b74cdb79fd47be438a429d810036504888301d9cb0de87ca42f9af2f3ff35d61cfb025f2544328acc42ed5e2b0d099fd40b
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/pl.petrosoft.railsmobile/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 e0c1d03c08d2127b409da10c27de6a275dee2dd89369410829b8441ede55da20
MD5 f39af70aa66a08f223382e19eddfa1e8
SHA1 eb4489839340a9e6bdbe52f4c211aafe5df8f22a
SHA512 0d685f1f5b186ce6de8159ea9ec172245255803c7b119adda00e1de74cd46e3d13fee1157a276cfa4c4db9cd051dd0189c7b850513436c0c22da2f90f28c2086
SSDEEP 6:7+/l9xQn1YWXvg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKql:7+t8qLiuWd7RmBEyPbbl
TLSH
T1B00222AC67801922CA19567794E983890D10A75D8262CBC7469008942C074CCA8A0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/pl.petrosoft.railsmobile/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 96aeb29c79ddb4535e02c79440802d3990448712e7ac55c31a4e1af4459fc16a
MD5 bcb03a7968a08d9663e3c44dee917a60
SHA1 0b6400b7a7c63422e8bb139441ee44df285033fa
SHA512 83f53676e9f83a7b266ddb73e65a9a67c89483c58480a1d9452c68284269f4fe11943da79e8f08ab5757d58653227f6b0cd557e978654978aafcc54ebbe50164
SSDEEP 6:7+/l9JqTGPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKrlC/8b:7+tFqLJdKBRmBEyPbmlS8b
TLSH
T17C022288A3400803C21A577B90EA83C41E10A715C323CB07456008A42C037CCA8D0D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation1100276016092241448tmp

Path /data/data/pl.petrosoft.railsmobile/files/PersistedInstallation1100276016092241448tmp
Size 90B
SHA256 e9616407544c60271060920311502cfb2ca8e2cfedf68c6a285ec98e4c3917c2
MD5 232fd97ad815bdb83194334f30e51ce2
SHA1 9a2c731637142987c35d2d13a7396aa718865fd9
SHA512 14a26fff8beeea56688115ef6c80086da621c527b273bf3fbaeb5ea01b09b700cf1415c821d223e859d8b444401245481a08f7934009312f6e254494dfbf4f97
TLSH
T1E0B0120247314191C5C5B2471C4CD2005DD134418409CE448F3BB64001C11D49243DE4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation5554551865419688702tmp

Path /data/data/pl.petrosoft.railsmobile/files/PersistedInstallation5554551865419688702tmp
Size 562B
SHA256 d3004af5074eb94d1428989b322e85ea613e2463c2d5ce05fe743d53a49bf659
MD5 439a9ca0a8f25740ab6a10569333082e
SHA1 95cb316f34557caeb062fa97ab0c493ace5a12d3
SHA512 d0c311581ea07a73ffec4b23d005c748f7b71e2b07368785e6eab73ef099c44a0d316737844b16a2b2caa5a504f1849db9173d247a4705ba8e5df8d9480ee463
TLSH
T197F0EB8A1054ABEADC14A702288CB914184460F67A5A18B5FEEBEC7091D007A638F2F0
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/pl.petrosoft.railsmobile/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
TLSH
T183810250534000E1D05446B354E113080F06D19496428B03550100428C415440C60E88
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/pl.petrosoft.railsmobile/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 da66fdf402aa11b2f214a52ea497a805c10b0394dbee93689c5de9c2aa7f2f06
MD5 ffdc0bd6e09f064fa223063a8f8a295c
SHA1 fabf225084823fa53536efd261f8351a6191a128
SHA512 b50e4fe6ec4776787a13dc39c64ce5317d73c7ee1fb84bc40c4844fdcfea6aee7ce8a7808942e7af69414159261bf27e8528d13a5f8644c5d918d1d1fca69c63
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/pl.petrosoft.railsmobile/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/pl.petrosoft.railsmobile/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 b3bca3fa8bcee875459aed52df6670927dea7d9037c99136b8c2beb755e98faf
MD5 4dd95c6bff1744059b893dcb77a12c73
SHA1 9b6959c87a632e20f0148ca19a6367d073537983
SHA512 59e225ea3003b050478b62995e5295bb4d85bcb8dad5b924dfcefcce5624d49366fdd4e174aae5810817888803163896503845f7ba589953ec94ffa25a2364df
SSDEEP 96:JYl5UWkDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:JY7U5ndjnHt9S/f8JzSV+6D86T0ED
TLSH
T102B3009D0F692584C0EE64F095900BF1793E492E9B97F3E165920075AEC2D30EE25CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/pl.petrosoft.railsmobile/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 05a057e6e62a6f3b4863bd0ba05c56aae288ad54cc9bbe61cbec7b33f46ef0ff
MD5 2fa2903ff96a5fa6379fd7ed335212df
SHA1 3200439c9d9b1b8fc7a01bae2de0974b98bc4ccf
SHA512 75c3d6c0e5c856dec9611cba963e221c126a42ed976635845873b8168370121edd9281b02f63d431280c01db81934a623b20f06ea58f7d4e3d1c87f65a36775a
SSDEEP 12:KGGLClzdKBRmBEyPbP/gGrD0QVWD0aWOw2:KUzhGSP/gET022
TLSH
T178722BBDA3D11ADAC19C033A50C4C3E50E306F189B6BFB07558714206D03FECE4A0D49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads