Analysis
- max time kernel
11s - max time network
151s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
14/10/2026, 00:31
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
AFWall+(Donate) v5.0.0.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
AFWall+(Donate) v5.0.0.apk
Resource
android-x64-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
AFWall+(Donate) v5.0.0.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target AFWall+(Donate) v5.0.0.apk
- Size 12.5MB
- Sample261014-at5wasts2m
- SHA256 f0c6f183828396a7d1f0f556ee5a394f6b0184b5eda39de0c39cef0f00f51ce7
- MD5 d255ddb1b5e4d4c58d2d84a8e9f50145
- SHA1 61474d4d0b5898e8e04d06b65f3986601160b53c
- SHA512 ce5a759cf23fc5d132095e5d9d4f16562af1143a3f0522fd67b0710053e700c31f5cde5e9b46feb1b89eb4480951f912171f861b9e3e51174c078c95c3cf4da6
- SSDEEP 196608:HfBrGxrj8umwmui4l/5U1PRbBcvJdZ/xpn9Gt9KYltUaUSRU4cR5FG:HfBrGDw1e6PRbKvdxbwFRUi
- TLSH T18ED6018EB798DA2AC0736176C8561177215B4C25AF428763682C3B2C38B35F8CF5E7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /system/bin/su dev.ukanth.ufirewall.donate /system/xbin/su dev.ukanth.ufirewall.donate - Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /system_ext/framework/androidx.window.sidecar.jar 4968 dev.ukanth.ufirewall.donate /system_ext/framework/androidx.window.sidecar.jar 4968 dev.ukanth.ufirewall.donate - Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground dev.ukanth.ufirewall.donate - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo dev.ukanth.ufirewall.donate
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/dev.ukanth.ufirewall.donate/app_bin/busybox
- Size 2.1MB
- SHA256 1faa49a4752e53a7c5ff6de03905a1547fb81e8fdba0b4d84efe3d836ddadef3
- MD5 9910d13d769f7f2400576a4f8709f476
- SHA1 45815f553cb841d32d892fbfeadbcd9e1cc472c4
- SHA512 8ba16a8d607a70b00b3ff42975c84e6b1fc07c2bc9c041167f1773b73685349ce292a36a76537055b6632932ddcf11bb9254bf3940e58e3bddcf44032e09dcd0
- SSDEEP 49152:wd+hjtPR7s1lGxyb1peDRlC6RE3XYtHkDI6XIkj/Aa0Fl+Meq:rtZWh3dDyl+h
- TLSH T16AA51804E641D0BAD927A0B3519FA3BBD9206B2D1633C9DFAE5CDD547B3B2E08725213
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/DefaultConnectionPref.db
- Size 16KB
- SHA256 c4ae57d6903a381b9ceacb646e541528f097fb365969f9442461ceb951f36f42
- MD5 9a96e7bbd6a53f54b40bd9ea222a5516
- SHA1 dd63adaa5cedf0aba9b67f5faa488e153dcdd6c9
- SHA512 f0829065accf108b6f5ca9d59aecdd00165ec2e2fe23bdfda24d6ef30c25726c80b52c6cc488266daf25537f721e128dc4ff349c1dcdb994514bdb46505ec311
- SSDEEP 6:l9bNFlqals1r/9/I0Su7OI/f/+Lu+qv/CDqOg2YM4fERX4PBX4ogLugMBX4suuK:TLpEF3SI/f//zv/As2xRmBEyPbBvOw
- TLSH T192726886BF942602EB27817260CE9394483C5D2E8373F34319741021AC673CDB0A2FDE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/DefaultConnectionPref.db-journal
- Size 512B
- SHA256 9883dc3ae4ed47377db8a7c86841ae2fd89d1f4c6f6808c60146ca834e52c02a
- MD5 bcaa7db7144a6d2de9afe7de4ffd34e9
- SHA1 8a106e58155930e9c9d32919bbf56f595a6fcdc4
- SHA512 0906caeb41159b727a4d84e7199b921e7fe35684f3286c914470576e0a24854e3b2a1c9331d003ce2070f8b3954025d75564cc564a0b278508de3c41ffe95518
- MD5 SHA1 SHA512
- Path /data/data/dev.ukanth.ufirewall.donate/databases/DefaultConnectionPref.db-journal
- Size 8KB
- SHA256 084a470a37892881207d653eb17f7bf3a49ab8305f6d3eed44c0163e4186160b
- MD5 80a0767adec01d8a9389c2319e1342de
- SHA1 518702ae87659c9c44677543478e6385de7281c9
- SHA512 36629533211a805ba69587276d0751017cb4a76d2db3924f3bc1081824aec53614bf85391df51d70d59f775788cb1781cb16bb718b34a50e53a21a55b62be7f8
- SSDEEP 6:7+/l9kqrn1bYg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKR:7+tHYqLiuWdYRmBEyPbu
- TLSH T11802228863811812C829167BA0D483D20E01EB28E2A1CB3716A008943C474CCA4A0D08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/DefaultConnectionPref.db-journal
- Size 8KB
- SHA256 55ae1b74a568b33e1e67fac7389d54b63cc1838611be60c6e246762a20187073
- MD5 9b5a42ab0b5a5f8906cf74b28150375b
- SHA1 c2cf68b57a214bb36ce9e2ce61eebf90352e83db
- SHA512 9add257d040396e9af65cc7a5fbd267508e3f121a1e1587f2860a234d6f99929aed17b7a404f03f78c44a1951ca09ed64dff2d0d362db69765d9386c7a7a2e9a
- SSDEEP 6:7+/l9Rzl8HPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKSC/5h:7+tbuvqLJdeWRmBEyPbZS5h
- TLSH T1F202228967400C03C02A17B7A0E883401E10E7289327CB9716A108543C0A6CCBC90D00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/LogPreference.db
- Size 16KB
- SHA256 68251a0188cca9d53d2d265ff8343485afe27a7a617b49eb4013797acf3cf432
- MD5 524575a5b1d05f502bc48e6c68e94572
- SHA1 9240fe91b8721b3d1fa7695748f227a56091fa5c
- SHA512 98f3d21cafe3f51ec5debd4c2e53029ef156504e0c57d97ebc53742cc0c6df607800c6336f9dda2468dcbadf872f0498588f845c467a4199bea861c81f4acd4e
- SSDEEP 6:l9bNFlqals1r/F/ORXB+G24GoLu+B+GgvFQbb3Ry0/Iih4fERX4PBX4ogLugMBXh:TLpEgBY9vFQbDR1PRmBEyPbBvOw
- TLSH T105722B45CF682642C6A94673384183850D79553F567BB3471E5114261CC7ECCE0E2CFC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/LogPreference.db-journal
- Size 512B
- SHA256 b3417bd031607a40fffdee4b82e690a49c8d04eefe620e10ae129124e2555dd5
- MD5 096e1990f45ca47daf3a4087009b2280
- SHA1 710d168e9b15e0861c04a0b964f6608f56daf23a
- SHA512 235dcea219578dc8715a387005e5f1712c3e205e8b962946099bedb08a1221e174a0def1cc904cc670c48c45469b86bae6c4ea46e9628e574328aed67927a2aa
- MD5 SHA1 SHA512
- Path /data/data/dev.ukanth.ufirewall.donate/databases/LogPreference.db-journal
- Size 8KB
- SHA256 a4eb2a19477a6cbc62711d339dae8a0b65a970eb14471abc11d91604b31d0a92
- MD5 950f60450dcfce2e9e4d50117d689d52
- SHA1 34ae0aeb7799b2ad2d8ea9431528b1159a3a7cd8
- SHA512 f5b4707f0cfccaa160a7320a80d0b3b251c4b772abcfa57a0ee5edbfe542a21f511d36be693d3cb22574ac4e043f6fbe9316305b14c45cc0b0f114e4c45f6437
- SSDEEP 6:7+/l9ZLHn1OlsWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKgc:7+tkWWqLiuWdYRmBEyPbPc
- TLSH T190022288A3821813C9291F77A0D883540D00A7289261CB1B1A9408A43C074CCA4A1D04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/LogPreference.db-journal
- Size 8KB
- SHA256 dfd61c60280e6d5608e93142c9f2f56c0a36808d7bdd1735a46f0af648fa8482
- MD5 2b3d2691c40c540360bb8b538807ff39
- SHA1 1ea15cbb380c7257d2a9844677e22b9c7afb5560
- SHA512 7bcbcc2a9d3b738bbf7cc1cfae8f7589b9a2e8d0cf29816b130059ae14609b0c375c53c41205e3a0d58886b517f983d596d8a95e4e68c3ef220d77ac366195be
- SSDEEP 6:7+/l9tlgPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKk1lM/9:7+th4qLJdeWRmBEyPbTls9
- TLSH T128022288A3400A23C82957B7A0EE83C01E10A7299333CB4F1A9108542C076CCA890D80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/Logs.db
- Size 20KB
- SHA256 249e8138a8dcba43f2a017abc9e98391b046f114f8219566a5d5bba40e5736e9
- MD5 3abe280845f847f8ee5036c6d9bacfc2
- SHA1 f25e51913d1d307ba395382776a35f6bac0295d9
- SHA512 7a6df96267e2a3cc29908ead2a528ce9ee7a2ac16c228ebb6c40d06b680ae670cdbd9a7085691d94fe34f878b73a411019306c07ee2184b548f64e099068c213
- SSDEEP 12:TLe1iyNTSFbyBKlVYq9aQb+O33RmBEyPbAVOwG:TLe5XmmibSUcGSEG
- TLSH T1D5922BCB4E341307C1594572FC7093E518BA952E96F797535DE108232C83684B0F9DF9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/Logs.db-journal
- Size 512B
- SHA256 2cc3e0177e799c2413a797e8e0d6891533d27bdfb90433413457b73dc86f1e08
- MD5 a40fa4c94d6760a3d4547eb3a694417c
- SHA1 6c02ef0d2582e6d00f85223b6ca303e704c888b4
- SHA512 3b46f46572e5e7650b1f24789d78ad9f188e498f79983153a18d2d6684ac9e8a72b284c4de309d11ff2a72081a7d6e9070d77ee8649e339f3b0a4e06c40ba675
- MD5 SHA1 SHA512
- Path /data/data/dev.ukanth.ufirewall.donate/databases/Logs.db-journal
- Size 8KB
- SHA256 176421afbd54c6309cd38dd8c9d557bbe8cf924152011192a5fcba6b8c6e149c
- MD5 4532bab3bc786f40c8ead5645428e698
- SHA1 241826eb1ba9d4167f7429bd79296ead8e8e6763
- SHA512 4135c9c3f26dca92800ff42ed333dbe375b286d92c7155eef9dd4d17ca121635ea464d25a22543a084d8b75cd72c3d830fba6df60426227e4fc8cf14e5d59623
- SSDEEP 6:7+/l9+n1Zg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK6:7+t0qLiuWdYRmBEyPbF
- TLSH T1B802C08C73C00813D82E1A77D0D483C40D00F729CD71CB9716A008BC7C874CCE4A0E04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/Logs.db-journal
- Size 8KB
- SHA256 f8d159846970b033f4796aeb30501f52492f3dc72a183e5f82988720ef6c6e59
- MD5 6adc14fa4c5a9cce5a2f0015c4710d1b
- SHA1 870cd1d2e34ccfe79b5c769c6875500cb5937ebc
- SHA512 d7969ab3247af8060d5a1992c754dc5318791c582f21f09669ed5ba0d70695053c48b6cd92689f0ca06127e052b38fb9f285d427636c4de4bd9b64d7f531cb90
- SSDEEP 6:7+/l9CPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKIBa/r:7+tcqLJdeWRmBEyPb5qr
- TLSH T14402228877801903C02D5777A0C883581E10B72AA223CB07179108953C476CCB890D30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/profiles.db
- Size 20KB
- SHA256 b0f1e4d2350663eeebd2da3eb4e71efa7590dcc01f372082df12222c9ee7431e
- MD5 c7af230d04b98bd44186403367fb0023
- SHA1 d73c4aabc9dd3dc95424ea7e336067fb349ab368
- SHA512 f0a943b0e35d2a8c74ed44bb813277362332208f07e66f5b66d9b8ff58c60b00249edb81fb2b21d7a05d796a6b9694a785f2f15cf4e8bbd461c3ddf26593c767
- SSDEEP 12:TLmaUDayNTSFbyqJVC9DNRmBEyPbAVOwG:TLXaAJMKGSEG
- TLSH T1209227CB5B281267C5BD6971E8B493A61AA0952F91A39B8329F014013D43284F4F1C75
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/profiles.db-journal
- Size 512B
- SHA256 eaf8eaf8820e880ccf2cf481b3210c3fdda8abdf71d0146745cdb7dd7b7d9d09
- MD5 4cae9a3389aaab2df7e1ff0ea43f9ab4
- SHA1 c1458edc764ae407c67c428d07c7425b342ceee4
- SHA512 e8cba5a2801e09bfe9e819b56d083300b06bfa0ca211516c980f1099d117aa09796d3fcdd79f241b68772094af9eee324cdfd1050f0b90561a79a6c4583631d2
- MD5 SHA1 SHA512
- Path /data/data/dev.ukanth.ufirewall.donate/databases/profiles.db-journal
- Size 8KB
- SHA256 bb0476d53faf50672fb6b2ce5bcbfa8a504a5be1bb3cc8b43c7b5c43d1f732d8
- MD5 dd26aad26004065c415a8ebdd5802648
- SHA1 d4f90446a99970f5ff5c0342e43d21277a67472a
- SHA512 24bdf3973dfc7736f5adc39bd59611395f3623dbd5a79dd3b377de3b6ec9e0dd4700de06507446d8d073c13c966a5a54c12630c6de38e14525b47a50c23c4d0f
- SSDEEP 6:7+/l91sHn13Rg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKuFn:7+t0RqLiuWdYRmBEyPbfFn
- TLSH T11102229973801812C8395A7B90D883C01D00AB28A9B1CB17169008942C074CCB4A0D44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/profiles.db-journal
- Size 8KB
- SHA256 098b67bb989a13ddc11709387487b08f4f35fac6b2b31b3c5e3a95b154bdd6ec
- MD5 def65a7de920de5d9387f32e97eb3d25
- SHA1 d30fb2f56274272d9d7b997a2a774a5617c9a3ad
- SHA512 34000f8b3acd2826dd81b6fb10ddac0be0c41de5ff5af1b19408a85b7c4c2c97fabc8ba4cfddb8cdb37a2303c2eb56ff6580e9a644c21e75c4c6598733b00b4d
- SSDEEP 6:7+/l9HzPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK8Z/A:7+tlrqLJdeWRmBEyPb3A
- TLSH T16302C09863410A03C43D3777A8D8C3801E10A7299333CB0716930C583C07ECCE890D00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/rules.db
- Size 20KB
- SHA256 254412eed8d7b9fe1370493d8948c264b4f30d038d8c61da659f036a28e91c7b
- MD5 5463be9c1da47a85928cd039e4001823
- SHA1 7cd3e95be30d93f87d5ccc341d8866095e041988
- SHA512 cd6e82b1943f25cc8e5be76d2a20c8633ac2547408d6cfbe8c81b117ab993219b68edb209cd35fe5eab8b9418edcac4d19ed39c5f77fc32f1c898a9a2c851782
- SSDEEP 12:TLmaB//UyNTSFbyZUZ2f9DAyCRmBEyPbAVOwG:TLX1B4o8yRGSEG
- TLSH T1DB9227E75B312237C5280971EC7893A619B5A11AD6A3E79B2DE004106C82A88A4E0DB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/rules.db-journal
- Size 512B
- SHA256 9960b0df5ff0621ab555183f2103e0617461b90e53ea3bc035164950774a55c8
- MD5 e9312b5c20ec6c8c0468a1471407fe73
- SHA1 4b0b526a4ca6c2ba16362c914900f40313f87367
- SHA512 4f562ed3aca8c8e553ff26a6aa8f8858224fbfe19ee185cbc832a1abd3b297e4aaa785f7122038d695bcda69c08df48f9cc0978e36c51d5c12fe4e180ab68585
- MD5 SHA1 SHA512
- Path /data/data/dev.ukanth.ufirewall.donate/databases/rules.db-journal
- Size 8KB
- SHA256 5688ca9dc7d82f4634f8af5ba7751bcfdb4ee5d369b79091e2e8ee8c9b742544
- MD5 6bb5a17947664157230fd8fb6124e2c6
- SHA1 f0b4412ec8b442f4e37af54176d30fd4727d24cd
- SHA512 350ad4ceb7a99ba098d44064caa195ff97492e4dfaab22b2d415913b0850786af2004522ddb18f03ae6908c83d31ddce59d1626aef89641ade149f82eadf6ca9
- SSDEEP 6:7+/l9Z4n1TJvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK4f:7+tgpqLiuWdYRmBEyPb1
- TLSH T14E022298E3810813C82D1677D0D483400E38A7288162CF1B16A208A47C075CCA4A0D04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/databases/rules.db-journal
- Size 8KB
- SHA256 e27fdb43bb8a89cba2212b177ea634682734c28587bc4aeda7d1ba53bdc711d5
- MD5 842a40e63435d1c04a841561afeb3aa9
- SHA1 78e5e2b1649e47cb819adeb2e9baf0c30c1476c7
- SHA512 1c88b7e5a99258aadbe6dd26b387363bd9bd4cfa9661e3b8c2176f744c87e188a061068c15e239f0be78454e65c5e49da9956022a9ca75b8273c0123b0ed5b24
- SSDEEP 6:7+/l9t4Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKf/n:7+trwqLJdeWRmBEyPbIn
- TLSH T19C0212E9A7810D13C53D5BB7A0DA83541E18A729A263CB5716A10894AC466CCB890D54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/dev.ukanth.ufirewall.donate/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 fec275b310f35cdc91252914b256dc0872a4760546183e5c6d3455371f2b9534
- MD5 fc4765beed9a3c7ee4c42b33f2069d9e
- SHA1 f3bfb46b685900ad6219b84e67c49891a586984c
- SHA512 9019461a1a26f8ff24f3b94400ad1599fcb4baaff34dfac6bd55c778e553842e390efefde8d7c184004553b36a61de01a9d53e4fc9a4b6a3ed6c69c1ed875964
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/dev.ukanth.ufirewall.donate/primary.prof
- Size 2KB
- SHA256 f64550c6389e45dcf617194d48cb228cfa09142b3675cd046180eecc4c9b419f
- MD5 335635a1df03f1cc1057a121e682301f
- SHA1 d7db71ab542742ea5c7cde873962ce3217c1a7de
- SHA512 4a59fab2e3ca2a5d5cd32528ced9043476e3278fa009c8e8d334a0fe5b818f335eead7e16c00ad23db0cce5fcb3f84d10a8fb7f25bd88734984bba701e430259
- TLSH T1BC515B696A0DF21D87F236665E967A519780BA033295420EB0C01C8F1FDED037DD03D0
- MD5 SHA1 SHA512 TLSH
- Path /system_ext/framework/androidx.window.sidecar.jar
- Size 12KB
- SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
- MD5 bdf3529e80318eb14e53a5bf3720c10d
- SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
- SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
- SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
- TLSH T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
- MD5 SHA1 SHA512 SSDEEP TLSH