Analysis

  • max time kernel
    33s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20260325-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
  • submitted
    20/10/2026, 13:26

General

  • Target
    iBlack - Icon Pack v6.5 (Patched).apk
  • Size 56.7MB
  • Sample261020-qpgwnset8m
  • SHA256 41edc3943222f6b5499cf27197bb26c343bdde99b01744e4a82871e0e9a74eed
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.italiano.iblack
    1⤵
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:5072

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        candybar_database

        • Path /data/data/com.italiano.iblack/databases/candybar_database
        • Size 48KB
        • SHA256 48433ee5c20b949ca9745d95850a10edfe3a54b123fdf626aad0d6aec8a10ea2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        candybar_database-journal

        • Path /data/data/com.italiano.iblack/databases/candybar_database-journal
        • Size 512B
        • SHA256 2b7f86703bfc0a0e08edfc1499b7075dc0b2131006b88c3e9816e53d09a6b8ac
        • MD5 SHA1 SHA512

        candybar_database-journal

        • Path /data/data/com.italiano.iblack/databases/candybar_database-journal
        • Size 8KB
        • SHA256 dc006ae48975440372b2486e4b50b88cf04b35d80e02c852a39862411e28aea4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        candybar_database-journal

        • Path /data/data/com.italiano.iblack/databases/candybar_database-journal
        • Size 8KB
        • SHA256 ab298963e92d960e672e277801693c66befcacd081726dfab69b06da694ea6ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.italiano.iblack/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 e2fceb0fb71ce74b8f4791ae114c235d945d490f984899ba0df31c4c38b2c806
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.italiano.iblack/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 1776cbf2d964a5fbfe586e6fe3d7e1c51e7e556994850b5d515251e339f84415
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.italiano.iblack/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 e16ff2aeca8f7b4fd60c08ef626e9a9103ae341f70cacaa877a1b68a8fe3ca53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.italiano.iblack/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 bbb8b7fa3d89ef9f4148bd5178c4065512b52b1ec86d61effc01031bedb94a3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.italiano.iblack/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 f61fc6f33debf1c159c18ee4368bae3e6bba1053a142ff8d84dc9bc124b7d03d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.italiano.iblack/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 94d2a328d97851ebe2b1ba04a44828a3b51bff1a42554b6675ea820b7ce36bfe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.italiano.iblack/databases/com.google.android.datatransport.events-journal
        • Size 20KB
        • SHA256 516d4834bc511eb2adde01f068746df6ccab8a1303945df91c53b2d16e55148c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        profileInstalled

        • Path /data/data/com.italiano.iblack/files/profileInstalled
        • Size 24B
        • SHA256 b6effc79060f8db2a7104c1b26bd1e5a58ba680be23369920d9e0784c0b19293
        • MD5 SHA1 SHA512

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.italiano.iblack/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 a5846df29d4d49d778612cb9e1adf0a85a5efd64c7f23a176f55c7e00a18dc17
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.italiano.iblack/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.italiano.iblack/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 b7e926df3ca074265914e485efd2123f2270730a862201b7c13f8ccad3531af2
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.italiano.iblack/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.italiano.iblack/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 4ab23307c5b3f88e59b54ff524ed09cc29c7f9304db90348a08ae3633e899aeb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.italiano.iblack/no_backup/androidx.work.workdb-wal
        • Size 124KB
        • SHA256 0d56223b43667a393e0e32665ca00fa2e9cb1346269ab4247f7538d32e1317b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.italiano.iblack/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 e980bafdcca8d4fc5c3af7d06f79d991964e64d82d2d762a906484e88dcc2409
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.italiano.iblack/primary.prof
        • Size 4KB
        • SHA256 f6dbcf87e1317af03bc70655554c32be470a5d7c8eec7858168c8e049df423a2
        • MD5 SHA1 SHA512 SSDEEP TLSH