Analysis

  • max time kernel
    11s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    14/10/2026, 00:31

General

  • Target
    AFWall+(Donate) v5.0.0.apk
  • Size 12.5MB
  • Sample261014-at5wasts2m
  • SHA256 f0c6f183828396a7d1f0f556ee5a394f6b0184b5eda39de0c39cef0f00f51ce7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs

Processes

  • dev.ukanth.ufirewall.donate
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    PID:4968

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        busybox

        • Path /data/data/dev.ukanth.ufirewall.donate/app_bin/busybox
        • Size 2.1MB
        • SHA256 1faa49a4752e53a7c5ff6de03905a1547fb81e8fdba0b4d84efe3d836ddadef3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DefaultConnectionPref.db

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/DefaultConnectionPref.db
        • Size 16KB
        • SHA256 c4ae57d6903a381b9ceacb646e541528f097fb365969f9442461ceb951f36f42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DefaultConnectionPref.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/DefaultConnectionPref.db-journal
        • Size 512B
        • SHA256 9883dc3ae4ed47377db8a7c86841ae2fd89d1f4c6f6808c60146ca834e52c02a
        • MD5 SHA1 SHA512

        DefaultConnectionPref.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/DefaultConnectionPref.db-journal
        • Size 8KB
        • SHA256 084a470a37892881207d653eb17f7bf3a49ab8305f6d3eed44c0163e4186160b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DefaultConnectionPref.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/DefaultConnectionPref.db-journal
        • Size 8KB
        • SHA256 55ae1b74a568b33e1e67fac7389d54b63cc1838611be60c6e246762a20187073
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LogPreference.db

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/LogPreference.db
        • Size 16KB
        • SHA256 68251a0188cca9d53d2d265ff8343485afe27a7a617b49eb4013797acf3cf432
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LogPreference.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/LogPreference.db-journal
        • Size 512B
        • SHA256 b3417bd031607a40fffdee4b82e690a49c8d04eefe620e10ae129124e2555dd5
        • MD5 SHA1 SHA512

        LogPreference.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/LogPreference.db-journal
        • Size 8KB
        • SHA256 a4eb2a19477a6cbc62711d339dae8a0b65a970eb14471abc11d91604b31d0a92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LogPreference.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/LogPreference.db-journal
        • Size 8KB
        • SHA256 dfd61c60280e6d5608e93142c9f2f56c0a36808d7bdd1735a46f0af648fa8482
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Logs.db

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/Logs.db
        • Size 20KB
        • SHA256 249e8138a8dcba43f2a017abc9e98391b046f114f8219566a5d5bba40e5736e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Logs.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/Logs.db-journal
        • Size 512B
        • SHA256 2cc3e0177e799c2413a797e8e0d6891533d27bdfb90433413457b73dc86f1e08
        • MD5 SHA1 SHA512

        Logs.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/Logs.db-journal
        • Size 8KB
        • SHA256 176421afbd54c6309cd38dd8c9d557bbe8cf924152011192a5fcba6b8c6e149c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Logs.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/Logs.db-journal
        • Size 8KB
        • SHA256 f8d159846970b033f4796aeb30501f52492f3dc72a183e5f82988720ef6c6e59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        profiles.db

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/profiles.db
        • Size 20KB
        • SHA256 b0f1e4d2350663eeebd2da3eb4e71efa7590dcc01f372082df12222c9ee7431e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        profiles.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/profiles.db-journal
        • Size 512B
        • SHA256 eaf8eaf8820e880ccf2cf481b3210c3fdda8abdf71d0146745cdb7dd7b7d9d09
        • MD5 SHA1 SHA512

        profiles.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/profiles.db-journal
        • Size 8KB
        • SHA256 bb0476d53faf50672fb6b2ce5bcbfa8a504a5be1bb3cc8b43c7b5c43d1f732d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        profiles.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/profiles.db-journal
        • Size 8KB
        • SHA256 098b67bb989a13ddc11709387487b08f4f35fac6b2b31b3c5e3a95b154bdd6ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rules.db

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/rules.db
        • Size 20KB
        • SHA256 254412eed8d7b9fe1370493d8948c264b4f30d038d8c61da659f036a28e91c7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rules.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/rules.db-journal
        • Size 512B
        • SHA256 9960b0df5ff0621ab555183f2103e0617461b90e53ea3bc035164950774a55c8
        • MD5 SHA1 SHA512

        rules.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/rules.db-journal
        • Size 8KB
        • SHA256 5688ca9dc7d82f4634f8af5ba7751bcfdb4ee5d369b79091e2e8ee8c9b742544
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rules.db-journal

        • Path /data/data/dev.ukanth.ufirewall.donate/databases/rules.db-journal
        • Size 8KB
        • SHA256 e27fdb43bb8a89cba2212b177ea634682734c28587bc4aeda7d1ba53bdc711d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/dev.ukanth.ufirewall.donate/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 fec275b310f35cdc91252914b256dc0872a4760546183e5c6d3455371f2b9534
        • MD5 SHA1 SHA512

        primary.prof

        • Path /data/misc/profiles/cur/0/dev.ukanth.ufirewall.donate/primary.prof
        • Size 2KB
        • SHA256 f64550c6389e45dcf617194d48cb228cfa09142b3675cd046180eecc4c9b419f
        • MD5 SHA1 SHA512 TLSH

        androidx.window.sidecar.jar

        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 12KB
        • SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
        • MD5 SHA1 SHA512 SSDEEP TLSH