Analysis

  • max time kernel
    34s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    20/10/2026, 06:02

General

  • Target
    82b864eac42f141d86685f5b9170ba49d42cdc734a3fb716cbc4b085b1d5a5c3.apk
  • Size 68.0MB
  • Sample261020-grrn8aae43
  • SHA256 82b864eac42f141d86685f5b9170ba49d42cdc734a3fb716cbc4b085b1d5a5c3
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Checks the presence of a debugger
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • org.traccar.client
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    PID:4807

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 eff1644a0afc886203d7f5c5013f9adede65ca04aa25d7eda8cdb28738617718
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 96d8e69314a2732e6ba156aa247963c93518131f96fc71b056df2da9a2835612
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 2f2a5ccb54ed33e412b7b54bdef5e9670fc19ee90091be2847731a43c57859f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 bbfc316744109609897838d1e99aeab8f414d26398198a5827b55dddbdf2857a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 3d78649db2cf50596a047ecdc7be09d57941b087381d2b291362b74150000d66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events-journal
        • Size 20KB
        • SHA256 a6ac283528b83533ba496eb70dba4dc6ff648f06644dbd40df732269d0762412
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/org.traccar.client/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 bd875aa17ed6310a7f3473cc56ff4608053a579b84aa0cbcfce869682bd6b791
        • MD5 SHA1 SHA512

        google_app_measurement_local.db

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 fecda2e650a2cbb3652d60ee1843b2e8fa9858bab765aee964b59b80a73d5c97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 636651b5b846f3f6b1d8f9c4ad6000a8bd253634ce15c6a0556bdfcf15bacf5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2511c03a0fa6799a37e7bc25c9f1bcc661e6b77600031fb4dad3eb0f900301bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 8f437b2cdf155a40f61d43ad6eb949666278aa78b4d40b3c0c3e09675d3f903d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 b10f1a7e08be349eed70fbb35c596906f49313d38f62a010b5af2cab887a247e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 9821764b63f652bd60ee0d8ae2b44bd2cd4c3bfc836c92ac68a06e7ec0c3d33c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 43f4e4a1b66f300dab374aba1cec22d54f738fc30d44627b06e30dfecc6f3cf3
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 2acebec0551493890349dff9dfc0f33381420de6aa931d8aea7c401a6b2054be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 57f4d0a3d1ce780a0f20ef8330b52bb712dc610a2739e08661aa9ca5a8e13421
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 fa16c41a59b2393632049c739010d10837d9cc34015ad9b7acf9b48fec612f89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 aa6254a8acb23b98f75264208bc0bf02e3cc9589fd1def8a8f9eae7661053a50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/org.traccar.client/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 d99bfcd7f6f0f0fa1f2958c21f191943b95392a2f33ad15b61b08134251927b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tracker.db

        • Path /data/data/org.traccar.client/databases/tracker.db
        • Size 32KB
        • SHA256 78e4aa545cd05dd6ddd008142f9b7712cb8dc84a7dea4d1cca8ce02a85c9ffd5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tracker.db-journal

        • Path /data/data/org.traccar.client/databases/tracker.db-journal
        • Size 512B
        • SHA256 620a42b570525a67ee95d1ca418c9f6227bd02f23f78e49356d7e01cdef970a8
        • MD5 SHA1 SHA512

        tracker.db-journal

        • Path /data/data/org.traccar.client/databases/tracker.db-journal
        • Size 8KB
        • SHA256 9f2fa8b298c30244789bc34eb0ff133246e213dd8555ba286846bed262a5ca55
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tracker.db-journal

        • Path /data/data/org.traccar.client/databases/tracker.db-journal
        • Size 8KB
        • SHA256 0655312a4f5e34413bed624adf9aa0a203d584627cbec387636f32c2bed5d160
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tracker.db-journal

        • Path /data/data/org.traccar.client/databases/tracker.db-journal
        • Size 8KB
        • SHA256 cdfed6ebb9168e0e5669e43b7ef0506f0235e8600ee4f3bb6f68ef6796df4a76
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tracker.db-journal

        • Path /data/data/org.traccar.client/databases/tracker.db-journal
        • Size 12KB
        • SHA256 afdcb272415449e81490d2f2e21d250fc5202f3c6ea0732e57663bb835bca7b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.crashlytics.settings.json

        • Path /data/data/org.traccar.client/files/.crashlytics.v3/org.traccar.client/com.crashlytics.settings.json
        • Size 767B
        • SHA256 c3a0614b7ad7ec959d2602d451756c214e36243d74e708ac0d9451b79a950f4a
        • MD5 SHA1 SHA512 TLSH

        internal-keys

        • Path /data/data/org.traccar.client/files/.crashlytics.v3/org.traccar.client/open-sessions/6AD704180170000112C7A3D07DA2B933/internal-keys
        • Size 107B
        • SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
        • MD5 SHA1 SHA512 TLSH

        report

        • Path /data/data/org.traccar.client/files/.crashlytics.v3/org.traccar.client/open-sessions/6AD704180170000112C7A3D07DA2B933/report
        • Size 823B
        • SHA256 cfd2b59c39256b3c3ace6d952a7e5c878cfc8f2ba28639b5d5b2ad5156410b07
        • MD5 SHA1 SHA512 TLSH

        userlog

        • Path /data/data/org.traccar.client/files/.crashlytics.v3/org.traccar.client/open-sessions/6AD704180170000112C7A3D07DA2B933/userlog
        • Size 189B
        • SHA256 290f360980d025ba4ef832dd661f1641c06adfad5785462f908d9e419d2d6b63
        • MD5 SHA1 SHA512 TLSH

        userlog.tmp

        • Path /data/data/org.traccar.client/files/.crashlytics.v3/org.traccar.client/open-sessions/6AD704180170000112C7A3D07DA2B933/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        PersistedInstallation1142856582970961616tmp

        • Path /data/data/org.traccar.client/files/PersistedInstallation1142856582970961616tmp
        • Size 558B
        • SHA256 887d244739d66dc2693d37f6c1423fa6efa57d77beee153092e55dc3ebbe522d
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation6304925057950477791tmp

        • Path /data/data/org.traccar.client/files/PersistedInstallation6304925057950477791tmp
        • Size 90B
        • SHA256 a067055d394ad93c2e0304cac7c80512415768a81ea701f24495f04dd5aa5810
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MTozOTAxNjQ3MTM5NjphbmRyb2lkOmIxYzcxOTRjNjk5YmZhMjU.preferences_pb.tmp

        • Path /data/data/org.traccar.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTozOTAxNjQ3MTM5NjphbmRyb2lkOmIxYzcxOTRjNjk5YmZhMjU.preferences_pb.tmp
        • Size 480B
        • SHA256 daa4224f6db15e1ac7a342d7b5bc0d10a7e2b60c7c45275b15009e3e6de64faa
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MTozOTAxNjQ3MTM5NjphbmRyb2lkOmIxYzcxOTRjNjk5YmZhMjU.preferences_pb.tmp

        • Path /data/data/org.traccar.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTozOTAxNjQ3MTM5NjphbmRyb2lkOmIxYzcxOTRjNjk5YmZhMjU.preferences_pb.tmp
        • Size 504B
        • SHA256 74a37657a00e335892a2fa84a1c7538beb88c6f314bd69dde48a57355a2c85bc
        • MD5 SHA1 SHA512 TLSH

        FlutterSharedPreferences.preferences_pb.tmp

        • Path /data/data/org.traccar.client/files/datastore/FlutterSharedPreferences.preferences_pb.tmp
        • Size 34B
        • SHA256 e875df99f05889dfce362f76812f069e124df33951b3585def773113021b5f23
        • MD5 SHA1 SHA512

        FlutterSharedPreferences.preferences_pb.tmp

        • Path /data/data/org.traccar.client/files/datastore/FlutterSharedPreferences.preferences_pb.tmp
        • Size 60B
        • SHA256 6ea3c4b945d72b0bd26a9e59a90bfb8acdce2c02c4b49a06bc670efc102726ca
        • MD5 SHA1 SHA512 TLSH

        FlutterSharedPreferences.preferences_pb.tmp

        • Path /data/data/org.traccar.client/files/datastore/FlutterSharedPreferences.preferences_pb.tmp
        • Size 92B
        • SHA256 575700376e6487e8591a84359bb87b65f7592960ab26caf08b83afc3fe0eb888
        • MD5 SHA1 SHA512 TLSH

        sessionConfigsDataStore.data.tmp

        • Path /data/data/org.traccar.client/files/datastore/firebaseSessions/sessionConfigsDataStore.data.tmp
        • Size 145B
        • SHA256 b6b46fb8c409abf4172404ca8b9fb785008b2baff719c407c70c5ec1ddf83144
        • MD5 SHA1 SHA512 TLSH

        sessionDataStore.data.tmp

        • Path /data/data/org.traccar.client/files/datastore/firebaseSessions/sessionDataStore.data.tmp
        • Size 278B
        • SHA256 ef4a3fb01678ad0347c003f46fdf6935dfb31df7162daa7cb8d575032d84f6fa
        • MD5 SHA1 SHA512 TLSH

        flutter_callback_cache.json

        • Path /data/data/org.traccar.client/files/flutter_callback_cache.json
        • Size 226B
        • SHA256 d569ac2f32d1dc07ea9feb5fd881d78786e724bbd95743de69e2d82a940048c9
        • MD5 SHA1 SHA512 TLSH

        flutter_callback_cache.json

        • Path /data/data/org.traccar.client/files/flutter_callback_cache.json
        • Size 389B
        • SHA256 cf90534b15b1f7497d031e5911bdc6a75578fb215f8d66beeaad72f9ad7e1fc3
        • MD5 SHA1 SHA512 TLSH

        snapshot4023792895953853203.pb

        • Path /data/data/org.traccar.client/files/phenotype/shared/snapshot4023792895953853203.pb
        • Size 6B
        • SHA256 5fc3a03e1948aacb288bcf005d4fc74c21a2dd6fa9149bb56548bbad15ee13e8
        • MD5 SHA1 SHA512

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/org.traccar.client/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 1bad325a041ff5de8feb96e43c2edc0dd326d51fbd9c345472e6cceec2944284
        • MD5 SHA1 SHA512

        primary.prof

        • Path /data/misc/profiles/cur/0/org.traccar.client/primary.prof
        • Size 1KB
        • SHA256 a66bc6d712a8c4af22ee5eeb439c5c3de78c3aef0b78f2ad43a05058c9765c2b
        • MD5 SHA1 SHA512 TLSH

        androidx.window.sidecar.jar

        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 12KB
        • SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
        • MD5 SHA1 SHA512 SSDEEP TLSH