Analysis

  • max time kernel
    126s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    11/10/2026, 07:37

General

  • Target
    29d617110741d2922c03daf441a394641ed68d11d7224c8f396b493d83ab356d.apk
  • Size 94.7MB
  • Sample261011-jf6ecaeb52
  • SHA256 29d617110741d2922c03daf441a394641ed68d11d7224c8f396b493d83ab356d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.pt.bark
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4912

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        environment.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/environment.json
        • Size 12B
        • SHA256 80be2eb0944c0453a6ad339a56e1c8f39f8cc57a4e627758246ccfd274176fd8
        • MD5 SHA1 SHA512

        release.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/release.json
        • Size 24B
        • SHA256 3d5c22f00fcdab164c273c215867beee4ae197a8ad711122fa55f8e5ebecfdcd
        • MD5 SHA1 SHA512

        sdk-version.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/sdk-version.json
        • Size 591B
        • SHA256 a2625a0de4dbf9e9f371de1b18983725ac8b39db9ce2bb582bec82be941cda1e
        • MD5 SHA1 SHA512 TLSH

        tags.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/tags.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512

        breadcrumbs.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json
        • Size 4KB
        • SHA256 bb8fc3bd6bbb6b10d7d9106d5ad5c13e9359e1bbb200405ec63f8cd7b2f60a9e
        • MD5 SHA1 SHA512 TLSH

        breadcrumbs.json.tmp

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json.tmp
        • Size 12B
        • SHA256 ae1afdb53fc94d62b6862659f839a20634382b65a7354f32b5e81cd29fb4270d
        • MD5 SHA1 SHA512

        contexts.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/contexts.json
        • Size 62B
        • SHA256 01870d5d7b208dcf75df9c13c2f8c636dd5b711abfd33f4f424fd3808d753cc1
        • MD5 SHA1 SHA512 TLSH

        contexts.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/contexts.json
        • Size 63B
        • SHA256 dda403ea3f2dc79793e354552c63edfb2be6a7676df6d0ecdd02a12055fcdad8
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 3013973de6e415d8cc4f548e414a28bdf9b809c90e63eb4477065fc2a6e7d000
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 188B
        • SHA256 b01405bfb69264f07f7743c590b4270e306f06f20633e4dc08ca61630a9dc169
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 29820c075e05ac3ec41b120b0766ca439981898e25ec2fe636bcfe2a040cea58
        • MD5 SHA1 SHA512 TLSH

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 18B
        • SHA256 96f7a5db03a7c5ec7847b1ca053fa92d19552fe07cf22a21a004e4aabed4a95c
        • MD5 SHA1 SHA512

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 16B
        • SHA256 96c4b7db81f09c9990c9e856e2d350b49f8ca5e0657620be9a6632cc3d7aaf1c
        • MD5 SHA1 SHA512

        installation_id

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.sentry-native/installation_id
        • Size 70B
        • SHA256 40e53ef63b349bd7cfa8b365c150b6f5631ff77d6cc01ebb17cf813971e4d5c0
        • MD5 SHA1 SHA512 TLSH

        2502edeedff14c23907cac9b43d78468.envelope

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/2502edeedff14c23907cac9b43d78468.envelope
        • Size 935B
        • SHA256 5cc9554e2e582fca0205bb2963c81a15e31acb5d34687f81b1ed797466da978c
        • MD5 SHA1 SHA512 TLSH

        session.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/session.json
        • Size 268B
        • SHA256 ec12037b98d2673282f31fa9cf2588a790e39d153dec14994b101e28fad20089
        • MD5 SHA1 SHA512 TLSH

        OneSignal.db

        • Path /data/data/com.pt.bark/databases/OneSignal.db
        • Size 52KB
        • SHA256 491c9687657ca71661a5cf42a763249f88fa222edaef20eaf552c4599458f99e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 494eeec5ad6fdc732a6dfd3ef7c31b211ba0c443219b4eb5e5eb2abec66dc6cd
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 7da4a60c076bab3d5773dc55cd63b8385ad26e1903cade76400061bd97de30ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 3d639dc8257bcfc3951e0a4a34d32441b83dfb42d17c0f44cc0ef1255d11d69b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 ecbf99c7e4c28d2704f23641f6a0bc54832c1b99175dfa58bbb708d4885a7016
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 6e0b8ecf67b0d21ce7ac905032c16512fa3154ec91834c41a400cee6ca58b456
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 07360c82df7644dc4069d895e93d8f29408b6083389ed518079b91a4f41649ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 a15a70fd605a7625b5b325db13dee53bf12f44b09af1e05e4a574345e573d355
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INSTALLATION

        • Path /data/data/com.pt.bark/files/INSTALLATION
        • Size 32B
        • SHA256 02a0199a17c7b62587feeeea589c243c98d7b88ea19ef615a904e51f8aa95d41
        • MD5 SHA1 SHA512

        PersistedInstallation1096808381785847197tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation1096808381785847197tmp
        • Size 568B
        • SHA256 eca41685ee0542a051b21ac9b5e9b365f09f74ee9a83312b9f5f9165b139fab5
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation1418302435506511302tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation1418302435506511302tmp
        • Size 90B
        • SHA256 aa5e8295ea17b44b3b4e270e17216ecbaaed3bc77fd14d3025f5fac419495262
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation2090773580241382122tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation2090773580241382122tmp
        • Size 90B
        • SHA256 06c2de795c73a6ff3b1c54853bdd3177cd47a323bed88b1eba6537b3d555cf6a
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation6090203042440354536tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation6090203042440354536tmp
        • Size 569B
        • SHA256 e6acecf930e599d5074580be993876e461f2b7a900a0f46a118562480e68224e
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.pt.bark/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 c54109faf6827950ddd8b4bf7cc4bec0ff6a4eb32f3c677ff7859785945b3ade
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb
        • Size 100KB
        • SHA256 776f3f57ff8ca32af3d6e26b6c28efabd49d5956a2475f4d1eee568774befb5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 0e80c50a02f65033a06694eaf5f34efe235d8d05d1f1e7cf3aa48f9a3424ee1a
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 2107ebe9b6bdd9c5490d8b40d95e029b0936d80acac7631b1586e18a41a5a47f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 3e1650b321cc63104c68f281e9b6c254f8dd153e26bcca3c9ac5aa6a1b5d4fd6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 410KB
        • SHA256 c8014899d436da40c19671b43c85300ac3d8f9e490fbd6b63434a32e2e236943
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 1KB
        • SHA256 bfc16c3dc40230f63d419733215a5773d91ac39bbaeb91f3cd2c9c03f058ba98
        • MD5 SHA1 SHA512 TLSH