f0c6f183828396a7d1f0f556ee5a394f6b0184b5eda39de0c39cef0f00f51ce7

Analysis

max time kernel
2s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
14/10/2026, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AFWall+(Donate) v5.0.0.apk
Size 12.5MB
Sample261014-at5wasts2m
SHA256 f0c6f183828396a7d1f0f556ee5a394f6b0184b5eda39de0c39cef0f00f51ce7
MD5 d255ddb1b5e4d4c58d2d84a8e9f50145
SHA1 61474d4d0b5898e8e04d06b65f3986601160b53c
SHA512 ce5a759cf23fc5d132095e5d9d4f16562af1143a3f0522fd67b0710053e700c31f5cde5e9b46feb1b89eb4480951f912171f861b9e3e51174c078c95c3cf4da6
SSDEEP 196608:HfBrGxrj8umwmui4l/5U1PRbBcvJdZ/xpn9Gt9KYltUaUSRU4cR5FG:HfBrGDw1e6PRbKvdxbwFRUi
TLSH
T18ED6018EB798DA2AC0736176C8561177215B4C25AF428763682C3B2C38B35F8CF5E7D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

banker defense_evasion discovery persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	dev.ukanth.ufirewall.donate
/system/bin/su	dev.ukanth.ufirewall.donate
/system/xbin/su	dev.ukanth.ufirewall.donate

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	dev.ukanth.ufirewall.donate

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	dev.ukanth.ufirewall.donate

dev.ukanth.ufirewall.donate
1⤵
- Checks if the Android device is rooted.
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5085
- su
  2⤵
  PID:5135

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

busybox

Path /data/data/dev.ukanth.ufirewall.donate/app_bin/busybox
Size 1.6MB
SHA256 308d440615356fdf2cb70adc6435ee1ad14342828f12f7d7c51f9aa78d720637
MD5 6e8abcc024bb639ec447b8fddf8d796c
SHA1 ce3fbff3fb67f1b6f26d3eca6069cfd48dbd99ce
SHA512 de9fc09c7639599bff080bd71cbbdcf4e5dd682a8bce6cf8bede6bfa6075cb6083689a9f9c87b0ab1730dcb669691cf37ec972adba36d308f67badd4bd5eef95
SSDEEP 49152:wd+hjtPR7s1lGxyb1peDRlC6RE3XYtHkDI6XIkj/Aa0Fi:rtZWh3dDyi
TLSH
T1EB75E614A541D47AD537A1B3519FA2BBC9207B2D1A33C99F6E1CDC987B3F6E08B25203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DefaultConnectionPref.db

Path /data/data/dev.ukanth.ufirewall.donate/databases/DefaultConnectionPref.db
Size 16KB
SHA256 430021e34ad2a1f7c1b92a5f62d1ae011838279ae82af4705406489a5fdcdef6
MD5 17cb8a6b15b83bd2c314ec1f42235217
SHA1 064bbb6e4f35bd8ca49079dd01eddf7a719184ee
SHA512 8d0d4e27df825a3fb389c4ea9cf2a8aa269f187b24520c9140f820a0e822d64deea1f64474c67b1def716c95a8f2a05726d0740b4e02bcc7042086fc3b8f4538
SSDEEP 6:l9bNFlqals15/I0Su7OI/f/+Lu+qv/CDqOg2YM4fERX4PBX4ogLugMBX4suuK0D7:TLpE93SI/f//zv/As2xRmBEyPbBvOw
TLSH
T12B722286BB942602EA178172608E939448389D2E8363E34219341020AC673CDA062FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DefaultConnectionPref.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/DefaultConnectionPref.db-journal
Size 512B
SHA256 4fee1adb9412133bfb0ef69b90bbb3a824a1f6bea1c26110d33e3ae7b295311a
MD5 9ee6bbef17f4f801215ecfe05dd2ac73
SHA1 66b6f0032ffe3ee3ef8406b83f55b795a392cb1e
SHA512 9b8b6173e0f10ece169c8889dfab604fd65919426203ec2bc478404b713e869a39ec6f9bec0daaf70a130e8049cb40098adf26f1c6961222ecc3fc5c79b1493c
MD5 SHA1 SHA512

Submit Download

DefaultConnectionPref.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/DefaultConnectionPref.db-journal
Size 8KB
SHA256 10157526de18b9bb8ea7b1f04271a5480f16e9dbe8eea630b844860559b4e280
MD5 2209e808621674f4b3da6058c9d60d60
SHA1 87a9329c688925adec97dc6848feb1a03b205f0e
SHA512 5afd81c48bfcf7031f11a5b241f8c6d8031f46abc1a9cd6b8c1496353459cf6c21f943fe69f230f86cc1906dc5ee12f252887c82db51de9828146708fc6b40ed
SSDEEP 6:7+/l90Fn1Bg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKeJF:7+t0qLiuWdwRmBEyPb/F
TLSH
T11D02C08D63800C23C81F17B790DC83400D00E719C171CB07156008D83C03ECCE4F0E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DefaultConnectionPref.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/DefaultConnectionPref.db-journal
Size 8KB
SHA256 8eb52dc1e5e1620af325138a198c8f778c7bad93243ccf49336f9466b2c19d82
MD5 edbd8b76253e006ba4e595b624613344
SHA1 4ce58ef121692222921782eabd33774beead73d9
SHA512 6295c6790ec4371353dc8f7e0d7684f70f414cdcfcc0e08f89c31f61022dbe8e4fedd044840a9b370c08737f50fa9a1ef83c72991df0b1d8797932dad83e672e
SSDEEP 6:7+/l9c/GPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKFu/E:7+t9qLJdTRmBEyPbrE
TLSH
T17A02C08D73410813C21D27B790EC83602E10E716F3B3CB071764089C3C0B6CCE890D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogPreference.db

Path /data/data/dev.ukanth.ufirewall.donate/databases/LogPreference.db
Size 16KB
SHA256 5ec038ddf958538cda4f9da3566bb222a50ab0a8ada7167201d30078d73c3899
MD5 d93b899ed685677c47ff2899a4866534
SHA1 f18abb18da5b255d8fb3a7368e8a811fa2b0ebdb
SHA512 9873ad07885b0cc52bddcffaf23ae9bc0b1ec98e7f98347adcf4efa8ad648521ce5d8307e7006ccc64c1058819f16f03daa234144b36e4677c37951a8f913a8f
SSDEEP 6:l9bNFlqals1x/ORXB+G24GoLu+B+GgvFQbb3Ry0/Iih4fERX4PBX4ogLugMBX4sN:TLpEYBY9vFQbDR1PRmBEyPbBvOw
TLSH
T1E0726145CF682642C6A84673384183C50D75553F467BB3471D5114292CC3ECCE0E2CFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogPreference.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/LogPreference.db-journal
Size 512B
SHA256 4db65ee6bca48a305a214a59375e4910a41aad846cb489ec8c327b4a7bc07a6e
MD5 1f08c44ff127bec6413a47a284151dc0
SHA1 290f2cb1ddecc71aeee3b5d45f855737509e7ad1
SHA512 74d3df09d7029870881ea080bae5b31b5d45af752332a63a4f8fad75af913d7f2823e80fa65fa5e9372e46a93ece57e0ae870cf7dc7952a450341e7bd43fc259
MD5 SHA1 SHA512

Submit Download

LogPreference.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/LogPreference.db-journal
Size 8KB
SHA256 0a6e2a8633c12b1231b79e553bf257d845cf391e02b6ea6408e5042a44ff6591
MD5 2bac5807580d456ce4865ce4b3bf26bf
SHA1 45abd0cc44e3652e461af2285afdceba231361b3
SHA512 7cd0d5724828723dce8ff3763f5d7085763d36039d9cc9d4c4c4fdaa6b8de51301f1d9355729ebc2b9fbdb77aa624763450875cbc162eac54e94b552ee491265
SSDEEP 6:7+/l9sn1bg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKA:7+tkqLiuWdwRmBEyPbL
TLSH
T1270222897B810823D82996BB90D483601D00EB19A1A1CB5755B208D83C4B5CCA4A0D84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogPreference.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/LogPreference.db-journal
Size 8KB
SHA256 de3f4889d012117fa8f41a5bd1fce2b88ffeb081d104b112196d6e9efe864c0d
MD5 87c1830439a5132092c6515de634915a
SHA1 ed986d682527d06f97c811ad69299dbaff58704b
SHA512 939fb41c99475e6d7e706a6ef291f227351793b124a774134ba37395a2c7d183f802dc69f2b287df006b48624af45eaef0419b746b545799f77690b0702f8cf4
SSDEEP 6:7+/l9N8FPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKEOt/ln:7+tjiqLJdTRmBEyPb7O1ln
TLSH
T1B602229963C00813C81E97F790DA83482E14E7148223CB27156008AD3C026CCA894D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logs.db

Path /data/data/dev.ukanth.ufirewall.donate/databases/Logs.db
Size 20KB
SHA256 99d84b6ef04c2eefdf156c40dab66d8df5c339097c89a8791e13efe77b5852c1
MD5 5ceb99c0ab41808f89e5bbd8e683b8a6
SHA1 0aed4ede373f97711d9e5831823e649eb9c9cb6b
SHA512 9ba4fba10d2a43d7afa65d299b63820f38bfa421edd6eb02fe0402df93ad70106878dab48afd4879a126a0a9a55182abbd834aa66e0a620aa4fc782a3ea2bfbc
SSDEEP 12:TLKiyNTSFbyBKlVYq9aQb+O33RmBEyPbAVOwG:TLgXmmibSUcGSEG
TLSH
T10C922BCB4E341317C15945B2FC7093E518BA952E96F397535CE008223C83684B0F9DF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logs.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/Logs.db-journal
Size 512B
SHA256 1f075c5febffdd2a975dc61736c902072dd6c3491773908b4c9374796f89740f
MD5 96396af498c6689ca1556923739aed2f
SHA1 358429aaa2a9d800f6fb6d033be5f8b5ad2f12f8
SHA512 5b93e1f0e9b3cd26619cfcf80f4dd2829deb086b0494d9ec4bf6d65c2742fbe3fc4c0e01463634b9e85bbce277bd9f568243c6b6771dee98d4d2e53dc28fa7b0
MD5 SHA1 SHA512

Submit Download

Logs.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/Logs.db-journal
Size 8KB
SHA256 61b93c741e45f47b33937aefc8c9a9eb6485238d7fa9343e04e8c3ac8a3f8abe
MD5 2ee8c6acdb2f35c8173315f4e1a2a598
SHA1 76c072ab252f637ce9a7e8d3025156b0cfe539dc
SHA512 38d65ba1c9f88c0164224d0a163d0d3a6b20875d6265b01f2381a453940e7ca915c3d8aac3407f6e4481c781c00d2d03293c955b79dc0fd0bdf16432113ad72d
SSDEEP 6:7+/l9Wn1Ykpg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKe:7+tTkqLiuWdwRmBEyPbJ
TLSH
T12E02C08E73880823C81D96F7D4D883801D00E719C571CBDB157008D83C034CCE4A8D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logs.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/Logs.db-journal
Size 8KB
SHA256 d8b9286edd788c30d82d22ca6f0f4190e6c244e9e3890a79746c8536c1698f41
MD5 901575e04d97696106a792f2d08972f3
SHA1 5f194abd97ecf77f9465002d34de1ac22bcea1a8
SHA512 3d6aa63e0035672f2e25195b1f814fd6193ddf0a0de26edcbf5f6037c37317601acdb759cf8d9122e2803995ee149f0dddadf81cdb0e93e4d7ae7e922e19c30b
SSDEEP 6:7+/l9EjmlFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK6ykl//8NJ:7+tCEqLJdTRmBEyPbLdlX8b
TLSH
T19E02228973400813C01967B7A4C883442E10A718C373CB2B36A008983C03ACCA8B0D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profiles.db

Path /data/data/dev.ukanth.ufirewall.donate/databases/profiles.db
Size 20KB
SHA256 9b91741e0a810b28f0e979329d7aa7e6f941f36332a15a92f3269b42859bd9d0
MD5 39d6e0c0186179a82963bfc173682807
SHA1 9c0fc44f3262a37c14a68d84b53ca808c73ea881
SHA512 91135ae04eae9297c1cc8575f3b478602ba058ee3fa23a047b3f71468cc0a1c26981bf2c42aa77cffe7ecc88d95ca9e03701a32655bb4cef3ba4f4501f18097c
SSDEEP 12:TLm9DayNTSFbyqJVC9DNRmBEyPbAVOwG:TLCAJMKGSEG
TLSH
T1CC9227CB5A281267C5AD69B1E8B493A61AA0951FC1A39B8329F014053D43284F4F1C75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profiles.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/profiles.db-journal
Size 512B
SHA256 aaa0bbc2bc5f4918472e91bceba18e76c72212cc1108d97aa5e51f2991d0a620
MD5 b6d1d162d8e60397db7b8e9e18e0907f
SHA1 1f31c0069cde6f9cbf3847f9c68c8180bbdb9264
SHA512 911dfa2116bf3171aeb97d4ad4b897cf0f88d4817323dd68beefbf89cdb9eefa21b933b9af19900ce30fa6cee474fa7d2f8db148f2a3257de869cd07030ed65e
MD5 SHA1 SHA512

Submit Download

profiles.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/profiles.db-journal
Size 8KB
SHA256 26d7135b91eec546c253f631da9eccf29d73c922e12f7639ce6d208f8a7b3d89
MD5 dc4efb2cf327b9351e7493d044db17cf
SHA1 b284689d14dee6859cd19a6c8d3f4f0398184925
SHA512 134415689e69b7cc9b055f105af3ec7f583cc9bc88f611da9b5197d7cad5c9a5b79b5aba34e022b116e012d984987f725424dc56a63c3c41543f47810808c823
SSDEEP 6:7+/l9c8lFn1E/+Wg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKVn:7+t6d+WqLiuWdwRmBEyPbS
TLSH
T1FD02229963802822C82D16B798F4C3802D51E7A98161CB0759E208983C034CCA4E4D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profiles.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/profiles.db-journal
Size 8KB
SHA256 75e9e836638ed386bcd4888fbaab9a049f3bd957c1b9d7c45112064396d035f0
MD5 cf690a66820e4231db876a717d45ccd3
SHA1 3f78ab280cefc9336bdd5ddd4f51698c0c21f3ae
SHA512 f84eedc61a3ee1537f7dde10cd68c2f57fdd2c75073ea9162750fc89306714f2fec0f51137a789ceb49894dea48571e50e206938b90312f49b0550f723472ef3
SSDEEP 6:7+/l92sSFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKgkt/9:7+tsPqLJdTRmBEyPb619
TLSH
T1B302228EA3400813C6191BBBA0CA83492E90A71482F3CB1725A018B83C02BCCA8A0D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rules.db

Path /data/data/dev.ukanth.ufirewall.donate/databases/rules.db
Size 20KB
SHA256 af9d8be8e43569aae8ed8ce854b1df33b33cad638e38e6660cd3345419883beb
MD5 6722da98d68a815065f3394128d2db5c
SHA1 e6a8f2898ef949f3a2d62115ae26a4c153603e38
SHA512 f9ad01c7e1ea794b1c751d7924dabb2d2d9bb3b7c64aec6760fd68b6276fda644ae5a7f9ddc56ca9dcf0aeb4bd640934f2fc3a9b98a88f7f4aacaf69af5b521e
SSDEEP 12:TLmA//UyNTSFbyZUZ2f9DAyCRmBEyPbAVOwG:TLdB4o8yRGSEG
TLSH
T1BF925CE75B31223BC51809B1EC78D3E61DB5F11AD6A3E79B3CE004107C82A88A4F0DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rules.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/rules.db-journal
Size 512B
SHA256 8465bfee6b6ad2d1d0242dc3642815dc348a04157a404bcc675ae51a71c26e45
MD5 de836b8aabe94a5768b250f05ad958d7
SHA1 329ecffd43adc7078cc491037200d8f8a137dccc
SHA512 bcaebf958a608f68a427e622a4893053f97e0af616a09ff949dc11d792cea772a6ac9154e7c758bf36d8f87718ffb734b0a329d83bf2e17c965427609b0b19d6
MD5 SHA1 SHA512

Submit Download

rules.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/rules.db-journal
Size 8KB
SHA256 d74de11aef45fec2ca10a6bef170c25302aa3c0148e1e4bfa3dab90e44fd5a9c
MD5 808e9d8670dd323070d8c232fdabda19
SHA1 d4d51747bd7fb4c767040ef116cab2f766904002
SHA512 c5fe5380190a6cbfb0dcd9ea577d63fc96485c9161bc337cd6ff83040a383f3e198bd52c38c19372f3a2a0d53820edaf414ddb03f0b26386f5689d65fdff3384
SSDEEP 6:7+/l9Vzn1+vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK/:7+t8vqLiuWdwRmBEyPbg
TLSH
T1B602C08D67800823C81F16B7D0D883400D10FB1AC171CF07176008DCBC077CCE4A0E18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rules.db-journal

Path /data/data/dev.ukanth.ufirewall.donate/databases/rules.db-journal
Size 8KB
SHA256 f34d280b007948f400c7eae0baca0191c78245857f763b8b969ee4c4b480edb0
MD5 72e6cc5d9bca10caa81a071f2a9117ef
SHA1 cc8df297419275e596545213e188556d990b9bc3
SHA512 308da1762467b7a2ca9d0b5fad8fa941bdcdc81680bddbbe208b2021e504ca0cba621db2b672b42449d371653f4021e5ab956b1a115518f63155ae616609e723
SSDEEP 6:7+/l9qPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK7/j:7+tUqLJdTRmBEyPb4j
TLSH
T1910222D967401813C41927FF90E883402E10AB1C8323CB0F166008983C026CCA894D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads