6c332f710d9448270637f07a8950d85082db77e58c7e1c9b9f2a0aad1cc7b917

Resubmissions

12/10/2026, 17:39

261012-v8bafsec877

12/10/2026, 12:32

261012-pqy1xaet3k7

Analysis

max time kernel
147s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
12/10/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app.apk
Size 19.6MB
Sample261012-v8bafsec87
SHA256 6c332f710d9448270637f07a8950d85082db77e58c7e1c9b9f2a0aad1cc7b917
MD5 4273a53ca8df17107944c0bb942d2db9
SHA1 cf445680e491f9d4480afc08e393403bb323d489
SHA512 513ce3c8495baffadb2b2fe059d1a131cf788a68a4eaf4825175d89f1a45dfc07ed588f42dc57f72d34a96053fa4dcac11cb45e4d1134ba0f92a19b940ea3d87
SSDEEP 393216:DBl6wXgzwmb0OgHwEr8G4+ujF1mhMFytwHg1:2fzwZmGGjF1maF5i
TLSH
T180272346FBE99E1ECC7340314F9A43359618AE26C782D743DA643B1C797BAE00E943D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sa.fiscalcenter
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sa.fiscalcenter

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.sa.fiscalcenter

Queries account information for other applications stored on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.sa.fiscalcenter
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.sa.fiscalcenter:guardian

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.sa.fiscalcenter

Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.sa.fiscalcenter
Framework service call	android.app.IActivityManager.setServiceForeground	com.sa.fiscalcenter:guardian

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sa.fiscalcenter

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.sa.fiscalcenter

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.sa.fiscalcenter

Starts a process using built-in Unix shell 1 TTPs
Android's native Unix shell environment acts as an interpreter to execute scripting commands outside the standard runtime environment.
execution

Unix Shell
T1623.001

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.sa.fiscalcenter

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.sa.fiscalcenter

com.sa.fiscalcenter
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4771
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:5213
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:5244
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:5260
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5285
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:5302
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:5318
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5342
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:5360
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:5376
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:5422
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:5439
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:5455
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5479
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:5496
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:5512
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5536
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:5553
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:5569
- logcat -d -t 120 CoreService:* ContentSyncService:* WebSocketClient:* HonorProtect:* HuaweiProtect:* OppoProtect:* XiaomiProtect:* VivoProtect:*
  2⤵
  PID:5595
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:5616
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:5632
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:5648
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5672
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:5689
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:5705
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5729
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:5746
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:5762
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:5789
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:5806
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:5822
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5846
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:5863
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:5880
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:5902
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:5919
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:5935
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:5969
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:5985
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:6001
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:6025
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:6041
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:6057
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:6082
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:6098
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:6114
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:6143
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:6159
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:6176
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:6200
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:6216
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:6232
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:6256
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:6272
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:6288
- sh -c appops get com.sa.fiscalcenter AUTO_START 2>/dev/null
  2⤵
  PID:6317
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter AUTO_START
    3⤵
    PID:6333
  - - cmd appops get com.sa.fiscalcenter AUTO_START
      4⤵
      PID:6349
- sh -c appops get com.sa.fiscalcenter RUN_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:6373
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
    3⤵
    PID:6389
  - - cmd appops get com.sa.fiscalcenter RUN_IN_BACKGROUND
      4⤵
      PID:6405
- sh -c appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND 2>/dev/null
  2⤵
  PID:6429
- - /system/bin/sh /system/bin/appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
    3⤵
    PID:6445
  - - cmd appops get com.sa.fiscalcenter RUN_ANY_IN_BACKGROUND
      4⤵
      PID:6461

com.sa.fiscalcenter:guardian
1⤵
- Queries account information for other applications stored on the device
- Makes use of the framework's foreground persistence service
PID:5026
- sh -c settings put secure enabled_accessibility_services com.sa.fiscalcenter/com.mygov.services.service.ContentSyncService && settings put secure accessibility_enabled 1
  2⤵
  PID:5144
- - /system/bin/sh /system/bin/settings put secure enabled_accessibility_services com.sa.fiscalcenter/com.mygov.services.service.ContentSyncService
    3⤵
    PID:5162
  - - cmd settings put secure enabled_accessibility_services com.sa.fiscalcenter/com.mygov.services.service.ContentSyncService
      4⤵
      PID:5178

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Command and Scripting Interpreter

T1623

Unix Shell

T1623.001

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

keepalive.log

Path /data/data/com.sa.fiscalcenter/files/keepalive/keepalive.log
Size 296B
SHA256 5627939cabf42d8571da598beb5e3ddb6d68d027244e6479f9c6cc170d056ea8
MD5 7474f4cc89f14d0abffcb74fcce558b7
SHA1 07ffd55edd94ce46369d9a43222f795d457496a7
SHA512 c397b84bc4f954e2cf7640b96e41741ea264935e79ccaa7a7e87ac064ce4535e113da416784286e640b421a773356a54ec18ba945d06760fdf5bcf443100e300
TLSH
T1F3E012586824D11BF5FF06B41F95D02CA108B430524460D85E60D71D44B63C8E8857C6
MD5 SHA1 SHA512 TLSH

Submit Download

keepalive.log

Path /data/data/com.sa.fiscalcenter/files/keepalive/keepalive.log
Size 399B
SHA256 7a28fa7f533ba139c4c2d99bcd5ed1e0403a0166416d69227a2fbc12fefbd9ec
MD5 8be0bab4e164df09951be0f80368e7ac
SHA1 cb7cca6708815d07cafbfeb9192419eb30148f81
SHA512 dc8ccae1c6138ccdc9d37de9f6f59e0dc270c542efecbecaa550460dc0740cebe81a16a8c700588539d2b1d91aca93d0fc89acb3aceca4df6c16c965ce6e8f52
TLSH
T183E092580841A266EABFC2712E9B922889049036068420852AF8D22C45EB398E9927C2
MD5 SHA1 SHA512 TLSH

Submit Download

keepalive.log

Path /data/data/com.sa.fiscalcenter/files/keepalive/keepalive.log
Size 497B
SHA256 82b9184f34a99261810c05dd94b0af1b8a8b2ad99f26ae02e2d0ee9e6676949e
MD5 caf77e6b4e372f7cb6bab4b0a25c26ee
SHA1 d57c09de7e4542c45466762f7d6f103ef89b8085
SHA512 e6dae68eb0a6678e3d9d682be4999c88356bcfa8977a4a6fb0251e704c796475269c9a087f78b873137ec29b1ca77218392502d9cd767ed1898ac879625efdd3
TLSH
T107F0922F8441D117E8EA253A3D96A02900479131680009A4A6A086C82987140894569C
MD5 SHA1 SHA512 TLSH

Submit Download

keepalive.log

Path /data/data/com.sa.fiscalcenter/files/keepalive/keepalive.log
Size 1KB
SHA256 86eb8a91e04ae619461b1b5a33a01bbde970c05bb27476a85adf1c6fbcb49b3f
MD5 13f6a379dd07c86b35c33dd8a7bd91b8
SHA1 f03e8f301268f56a47756f07b8cc67d19f7b7cd1
SHA512 2a8e5dadfe6ef411d7f6686745cf981c10c65a2fe4c8d398faf5a5e4ca4e2d61115691291c33ce8dba15694bad9c6abc07c19020f3451f340d8fd28ea6b058ba
TLSH
T1D61192181C89F22AE4EE817432E40124B33C94358040134825E0A27DC8EB3A81D07AD2
MD5 SHA1 SHA512 TLSH

Submit Download

keepalive.log

Path /data/data/com.sa.fiscalcenter/files/keepalive/keepalive.log
Size 104B
SHA256 d0d99eec87cbbfa14fa92eb7303ac2fc9823c2935973f52f636041f6c451ec33
MD5 87012f4fb1dd1fb9de431644cef3149d
SHA1 c6623794a9d7255a27a94caa1e00f18fd663fa93
SHA512 bf06a57994d7164d89093f3f3430309e1d7aa79dd4e276650d92553125b387709d9038734766dabff50ca758b70848f468a65efa3b1f00b6d8969f1841370af4
TLSH
T183B0123C055BF52F18EF43103308672D5449D27882291DD42DB0E10E44C73600451B76
MD5 SHA1 SHA512 TLSH

Submit Download

keepalive.log

Path /data/data/com.sa.fiscalcenter/files/keepalive/keepalive.log
Size 204B
SHA256 3e1ef76d82ea5e9aa900204ba6e3b49101d1fe905581950ee6d4c6f9f7f6f920
MD5 8b09a11efccb8262598dc3dca0f2c707
SHA1 3d50afb78aefdb86874226a9ba44b19adfe258a4
SHA512 a05f13ceb2eb886de515760c5c895934459f89ea1629a8caca722619af53de557d7dae3bc736c0ece71fb5f58e08fd4cc6a5ac433a7191eb98d85fe4ac82012b
TLSH
T1D1D0920C1886A667E8AA42736FAAA0288258A034801472642EF0E10D88D6968040AB91
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path /data/data/com.sa.fiscalcenter/files/lockpwd_logs/debug.log
Size 63B
SHA256 4cc2bbd10bb62953da47002310244cb028e5594ba820f7b4412568f05de79c4f
MD5 dd4a41eeec7bd0985cc35dfda88700ac
SHA1 c2e628a7d0215a3ded246dccb1a1cd557e69f3b2
SHA512 8c82a20f2c36880d4d263787945f6edc5162511cac4b0961fa669f946fe282037d016e539eba576429172e3d4b8171cef7b0a7136ecc95cbd76dd7d6c71e95d9
TLSH
T1E7A022C8820800C0E82AC880808000A00CB2003CA330800000ACA8F02082E800BB02A3
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path /data/data/com.sa.fiscalcenter/files/lockpwd_logs/debug.log
Size 66B
SHA256 bbf86ab557343c72d412c4ae5d6644595a540abad7c8670c35894864e14bb387
MD5 95f004bb2bfbbdfd127f87194a028507
SHA1 c155f48224ec72affe2deaa88bec1b00f5352faf
SHA512 c94646aac3898c2afb4d611b39b7091ce66a3756e09e9fda66904840296e77b2963642c32ccae214c7414a90ae371aee739f56de9916671fb52b8ed3100fe092
TLSH
T151A022C80C0080C0F2E2BAA03203FA820C3038280022C80CC0B0F0203330C00A028000
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path /data/data/com.sa.fiscalcenter/files/lockpwd_logs/debug.log
Size 111B
SHA256 338bbc3743bf48efc2fceb63a59036367d054e272dd6302de09766c56b7d9589
MD5 9e86d8c295a0cc3a354ac881d64c290d
SHA1 5057c31795d78d6c0b88bbb5d714db06eac584de
SHA512 8d277e30deddea558d10777c1793b991c97ed212d2a3cdae548b2c609fd8338f85f00a7d5861d64648446a6520c3d9fb28a5f52e44059cb2695b3d4eeb58957f
TLSH
T14FB0928912642C6E38A93380166308021CA7238A652A9882AEF50887A99284922A99A2
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path /data/data/com.sa.fiscalcenter/files/lockpwd_logs/debug.log
Size 71B
SHA256 01df841bdac6ad9a7ce9b2ee3f62a30478a7193e73efedbe5cd136a1c788f201
MD5 5465b20b7759eecb4b8cd50b4fda547f
SHA1 1af395fc7a34cc6fd8f2d221169fe4285fbe2d04
SHA512 6fd8bef52542672b1fd7434817c4bf5e56a4697a1d7025c74cf053886f2d6cc237a04568c471dd1f04225bfc6d46aa6487034c842f1cdd6d0b7439a10d311428
TLSH
T18FA022880A33003A308E8B3300F30C00283000008A32E00288A808A0FE0FB0303F8EE3
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path /data/data/com.sa.fiscalcenter/files/lockpwd_logs/debug.log
Size 117B
SHA256 6e61fee991a910053defab17827399e4c90415e18dec904783aebc574316203f
MD5 8bc94f4a2f2ab31729ace4d28622dfb5
SHA1 c7945f40f7e3035fa46e45f5ff6344abe9389f4a
SHA512 5792d8fb86556d17b1c2fe3594db7a3202bae9ecf45980cd6779067cab05b6ac40a47f517edf91ed4f07293964d302c7aa5f29ed302a0528b1731d7b806c2ee6
TLSH
T13DB09228233244A5229FA240385B3C19C4243293CA310C820B8026ABFB0B502C3B6BDD
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path /data/data/com.sa.fiscalcenter/files/lockpwd_logs/debug.log
Size 117B
SHA256 02be65aeb3708d99d726d0badcd144ca55de2209d39af8bc23a0b96ded6f3df0
MD5 40ea3e04d7f2f6b4b07b62ee605225f8
SHA1 edb278830638649f54d86489cecb03c18974344a
SHA512 1624185ed8909ba6609697f546437f9bd7a40f5cf59616339041dd0a5b4d02d8aa7e30ce699b021dbb39780d074f821562d31f3207c32b96c57a3b905cee0ba6
TLSH
T15FB09B8432681C6E391D279511664A015997578E1A755045BAA11C4294448441575997
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.sa.fiscalcenter/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 2b2920265ae49327f028b7435863d0b878c3f6ae44ec58ceafb7608fa5d58c8a
MD5 c9fdc23ec215defa952fae251e1214d6
SHA1 527cae74288eccbbcfc508e2a6d9001a3b8b40c2
SHA512 446de90c26946ceec22c329e39dcdba8dec56217e44580f13d84086dd3135f663b34539a818b1d23e288f6de52c73ee075473810ccc2f63a74be5674a3fb0786
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.sa.fiscalcenter/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.sa.fiscalcenter/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 63625b421869324e358c96d74586f3f4a8c695d0a7cbeb8e32b6c26767a49312
MD5 fcd2e2cb86cb4f556d16063924fa3f33
SHA1 275e1390cda57a16bf23136120cb49630f0b4b7a
SHA512 1ddc42be671367e460819adcc6e952400593172eab3fe7f705ca567f9d8fe21a4702c1a2961893b7ba6ab93e544facd887c1f59193c2fb775865710d572a8046
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.sa.fiscalcenter/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.sa.fiscalcenter/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 eec05fa81fb42b70c7a5ec2ddc91481da0e74499cd09cd49c124b2ca3730d755
MD5 1268df672026d867844bf798ce666564
SHA1 a175f5295b3b2558d184f350f826adb2e2568960
SHA512 cad0a3472612fd4c3a0661d50a1eb82bc8e11054774e1365b9ebb9dbd888c6635763dfdf05d578ba200c87d2ddbc7df10ffa9d7a1cff6041726fbd118e34717d
SSDEEP 6:KnQGxWg9FZde/kPlOERX4PBX4ogLugMBX4suuK+/CslDdqLQnOw2:KnYqzdeWRmBEyPbP/llXnOw2
TLSH
T10172C2B8F3400912E9998FB298C9C3441E7012AEA312C74F62511C9C6FA13887953D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.sa.fiscalcenter/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 fe1e5c346fb01487cb4323208cc3fdfc74b2da25d4bb5804342c556560e831ab
MD5 7b8a0d0b8bdd250837b5fce935b87d27
SHA1 401e2c7cdb41a8f19ff2033d557e78e9d42b0f5a
SHA512 fc4064729da24df07fa8dfa3e903a7cc3939970ab96448a6fd14cc2d70b3ad1aaf475bf5c6ce7a3bc7668d807d8d8fded63bb14e317537d0f29bc6036bf9dfca
SSDEEP 96:2hPS5c6+etidjnZRWzzb8/KeKcK+zS4ddKz+ZD86u0ExV:sPS59tidjnfWzzb83zS4de+ZD86u0ED
TLSH
T110C343AD1F592600C0D958F0D9D00FB17D3E416ED393E3D565A100F9AEE2921ED2ACFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.sa.fiscalcenter/no_backup/androidx.work.workdb-wal
Size 229KB
SHA256 b5fac6c4b19d8aca69e7edb7de7b4ed15b00fd9660787aa56d5f92f9db720b4e
MD5 e65ba278ce12b943999409637feb02b8
SHA1 1df19a49d945d11a6770cc2bfbf049d767796f56
SHA512 f0339467bc111343bac631eb6be82613ac1c6496906c77ad655322f02082e75aa25edcec0f677851c096c23701efe667936015c0a59814211d52f6760b33e253
SSDEEP 768:4ADtYV4DDhtt3rADtY5wZADtYiADtYuADtYia5:ThYk8hYhhY9hYRhYd
TLSH
T14734BFF9F6D442A4E0150EBB65D682E41FB81DE8CB8415471773AFC82AF648CBB36474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.sa.fiscalcenter/primary.prof
Size 6KB
SHA256 051e5935de7c5dbf7f5469bfe468cfe7e479b1eab5eece64964ddd85b00c5172
MD5 3fc1687510d6fa08e40c06717c4c49b6
SHA1 afa24821d770ba7430fe895cc7af27a1056a84b4
SHA512 4f669d89fd3ed48d264a625383f8c7405e3d0bb9a16cc990eec58da0caf4b708c72d36e07dcb2122e01048c03b8da615636e1f30ba42eba9770b20a0b396877b
SSDEEP 192:XTLl22x25vOhYU+Eqh8LKHtyStRIztM4RV:vbxcOhYnVyStRIzq4z
TLSH
T149E17E9CBC77AF0DA6E03F491DF15B887F945965C08404CEA292C31645B5068B7BBEA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.sa.fiscalcenter/primary.prof
Size 10KB
SHA256 2eccd64a35a9f112c61eb40f9daff735eee71826e5f10e3092bb25076b9c4316
MD5 c2ed685fb372a99d7f81a778dc99d466
SHA1 2ca89e7dae43f65a573175a69a1a091f6c30afdf
SHA512 e811dec7cf233d06fd64c2e1c4c4bc8d28c05c5e110e716c114ff5812d86e784604fe01b7788b0c631569e3c05cc265177cac9cceede9529cea423bec7e356e8
SSDEEP 192:nSs263Fz+JF1javzizffyxtWrOWzbIYWooq5/sG/QAHipTCGPRCysx0YQhu:n3263FIfavz0yPGtzbP9oq5tQfpTCGPO
TLSH
T1E322AE1F0D031648A26B131D78FF796642AF353B562098910E7E5F83DCB8C2A7A90B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads