41edc3943222f6b5499cf27197bb26c343bdde99b01744e4a82871e0e9a74eed

Analysis

max time kernel
33s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
20/10/2026, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iBlack - Icon Pack v6.5 (Patched).apk
Size 56.7MB
Sample261020-qpgwnset8m
SHA256 41edc3943222f6b5499cf27197bb26c343bdde99b01744e4a82871e0e9a74eed
MD5 4bc02c65d776f3e14b18b4862ad4563f
SHA1 91e216302e323b64cf40dc69abffaeb99f4b15ef
SHA512 981783b328ff019806efa77eac3203e83036f58a5c4be8692141097ccf21bad11d73e81d2fb7ceac2742078bd9cc2d67259f49c2e1171715dcc18c3b2f814930
SSDEEP 1572864:Jnn7uZs7pFRykJHMLjGPCyDUe4nXzQZJ5:hKyLRyTECmh4nDQj5
TLSH
T155D7BF1BCBECBD5BD472E5302339528231940F581185DB65828BF98DEDF2D92A910EBF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
40	raw.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.italiano.iblack

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.italiano.iblack

com.italiano.iblack
1⤵
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4698

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

candybar_database

Path /data/data/com.italiano.iblack/databases/candybar_database
Size 48KB
SHA256 df571467df8f6df89c244a0ab36eaa76ccab815454f541ec8af9f7930153464d
MD5 b84552c92aba3cac7175bb0833e57194
SHA1 8d093c7d9c7fc5bea45cde684cae8dd20e7c573c
SHA512 57181d832a75e39c37e1271c1e319a1bbc093609302efb6513df15a445b153b71e6d6b1f81c14f2cfca35e54ef2c620e0f8f0fca359c4709ba0dbaa0444af906
SSDEEP 48:Tv0Y0YIUY8oiFY8YIovc4ez0t5MOtmAVEcoQ5S:oY0YIUY0Y8Ye65HEv
TLSH
T1F623FECFAB143610C9E40131CCE117B35DB8B75E2B100BE25AB030E9FDD5496C97582B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

candybar_database-journal

Path /data/data/com.italiano.iblack/databases/candybar_database-journal
Size 512B
SHA256 15d677c4829d1b3906332cbf38a5a91c2246451ff8883ee639799838d71749a1
MD5 c99b861039ecedd9732950fbbe99138d
SHA1 8929a34dba6ad4b89a93f672c20e8864172c5fa6
SHA512 10996b03006bb4ae3bd0c52b4c637e7e9380ca6e995bea4af150ddd8cc5f890664abd8757889beae785a510cdc48bb05d4c33b9f356e6a3f8893f92b08d1cd58
MD5 SHA1 SHA512

Submit Download

candybar_database-journal

Path /data/data/com.italiano.iblack/databases/candybar_database-journal
Size 8KB
SHA256 1025e788c7695947ea3ba230db190ea53b1f227ff51a72d7d680327faeacbfd7
MD5 9b1a8015202a13a12024506b47043692
SHA1 1d444a005c68fc490065dcc653f53a8c9b7202ac
SHA512 efbbfabf86f854e90e1320a3535cae5496859349a01e2d05c70909289afcad2551f92a48bf420424b18f1609d8cb234f64d441aa4999c683c2c3737ccb19c10e
SSDEEP 6:7+/l9bOn1lg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKy:7+toqLiuWdYRmBEyPb5
TLSH
T14D02C0CC7B820C13C82E1677D0D483400E08EB388171CB373A91089C3C078CCE4E0E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

candybar_database-journal

Path /data/data/com.italiano.iblack/databases/candybar_database-journal
Size 8KB
SHA256 06c9f8e8c4027828d8c1b9481bbedf219cf02a914938ed285535799aa9c3ca09
MD5 630ab7302d2cb34c23ac4522abc49cb7
SHA1 ca396822c28f9da3e9e11dff4a1ed7eaefcf7cdc
SHA512 2ac6f5183a52ec34e3d34a6c2aa59b55b38a24cffe8aae3185644033c0d6bf849b6ed7d68b15f4e5a06925086233b4df5396cac505264159f3663743d633c768
SSDEEP 6:7+/l918Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKuJK//bn:7+t0qLJdeWRmBEyPbfAb
TLSH
T1E80222C873400803C0299777A8D883802E20A728A223CB072792085C2C0AACCA8D0D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.italiano.iblack/databases/com.google.android.datatransport.events
Size 56KB
SHA256 dc56a8c517b525cff03fdd1bfcd05cf600ae46789b80469fbfde89f5ca23acc2
MD5 967be1ba7904f04473757415196c01a8
SHA1 9ad1ae78365771d8ef8af89b0f35671df0ccb983
SHA512 84509112798f14981d100a122a8aaed75cd99e8da50408b19ce39f953a814059106dde4ece27ccbee07cde4cebf915466607d269b4192aa95475cea706267766
SSDEEP 48:T2w3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSlFH4FH:iwAMEX0wIyNjaC
TLSH
T174432F9D1A3C2210C56D243ED3E343A35A3C9FDF3726936339D48CE98DC24697825959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download