Overview

overview

8

Static

static

6

kawendra-zpax.apk

android-15-x64

8

Analysis

  • max time kernel
    16s
  • max time network
    152s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    23/10/2026, 13:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    kawendra-zpax.apk
  • Size 12.5MB
  • Sample261023-qzcppses6q
  • SHA256 cd3a042bb2135040024cdd4e7b0dfd5f2db950e6fc111f529b5e5887fbf7fc47
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
bankerdefense_evasiondiscoveryexecutionpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
    defense_evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Acquires the wake lock 1 IoCs
  • Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

    Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

    defense_evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Checks the presence of a debugger
    defense_evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • cm.aptoide.pt
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Checks the application is allowed to request package installs through the package installer
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:3252

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        base.3252.tmp
        • Path /data/data/cm.aptoide.pt/cache/oat_primary/x86_64/base.3252.tmp
        • Size 490KB
        • SHA256 b1007a4bb321e89007031c3d597df95b9962f0dadaf81a732976a8faeb3561c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aptoide_task_info.db-journal
        • Path /data/data/cm.aptoide.pt/databases/aptoide_task_info.db-journal
        • Size 512B
        • SHA256 210bf6abafa5846a060ff5d3d589de11d3861f0fa366f94d492ce4e3962b931b
        • MD5 SHA1 SHA512
        Submit Download

        aptoide_task_info.db-wal
        • Path /data/data/cm.aptoide.pt/databases/aptoide_task_info.db-wal
        • Size 40KB
        • SHA256 6c22d8059781459c341aff12fce5b528665220f1ea341e1a7d9f9b350b012500
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aptoide_updates.db-journal
        • Path /data/data/cm.aptoide.pt/databases/aptoide_updates.db-journal
        • Size 512B
        • SHA256 5485e798eeb78e2a5fd0a156c7494292a2a9adab8b44e1fabbad93d954f2a9e4
        • MD5 SHA1 SHA512
        Submit Download

        aptoide_updates.db-wal
        • Path /data/data/cm.aptoide.pt/databases/aptoide_updates.db-wal
        • Size 36KB
        • SHA256 7bb04b57710b4925e530332cf6beec06d3516d9c1fa923341f0e130d9ba3659f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events
        • Path /data/data/cm.aptoide.pt/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 8f22a6496005c7b332b20d6e363b4e749e18ea6ee27bc4b6e5e7983ac36f50d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/cm.aptoide.pt/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 8463089212821f75e5f77f60e29b94d1b30501c911747248430e40e0abe8c56c
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/cm.aptoide.pt/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 19b1d2063ed8d80a6441cdc18e5324f9aab9b90104718edf0c2ec04d63110406
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/cm.aptoide.pt/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 c5b4de2038565c3782dbfb36004744b2fca0052272fd605808649017ddf96fcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 d1ffdca7ba8c0925bec4d10295b7c355bc1cace5e6b44d6efe9f812023f9e772
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 79edba757bf9eb964f44fea43ab8ea775193a7989baac802a19e4df937dedcdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2cc738fcc4f9ccf87d5515bc65e657cd36b796b99f61b4706b905083f4451015
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 aa4b93380c1054295a0fdbbfc31bdd95f471033a461537c1bbac4db77fa82646
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 62e4e78e2044736d8ba02d5c9166e313f5681b82b8d5ac08d1efffff4e906d08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 4bf12d67f863b21d6c4492698ba0d822655318c0b6b2c54944a1890c7a15472e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 10c60b908bebe1bc1302f72df66eae408f401a65ce318de24a87c4eefb9de633
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 347a74c410fa433f918b53576979fde14eb9187be2f9f257e9fb333e86888711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 c4a3ff8fca785abcddcf31706ebc464da5d5b21da8a4113a37b2cef9490d0e94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 67e15729a5f911062b3d3cd2caa2a87e6d151c8b50fd35b203e4bacd29e9746d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 3c3e763a0eb754e5b73b63db094acdc6f89b5c0aafaa2aecdc0d5aca0272cd28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/cm.aptoide.pt/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 a807daf6a9486cbce1c98fa0227a9f1994f7bc7a59b855425cdb5bbc83b01cc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.crashlytics.settings.json
        • Path /data/data/cm.aptoide.pt/files/.crashlytics.v3/cm.aptoide.pt/com.crashlytics.settings.json
        • Size 762B
        • SHA256 f1fe259f43bab4781c3a2c321174214e57c83f4310c959a9f203f64b84a8b132
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        internal-keys
        • Path /data/data/cm.aptoide.pt/files/.crashlytics.v3/cm.aptoide.pt/open-sessions/6ADB6418037000010CB466640267FCAF/internal-keys
        • Size 207B
        • SHA256 07d12b054a91d3de7a46430ecd63d3ad9b4fd5ab0036db77751e7b5c1fb0febe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        report
        • Path /data/data/cm.aptoide.pt/files/.crashlytics.v3/cm.aptoide.pt/open-sessions/6ADB6418037000010CB466640267FCAF/report
        • Size 797B
        • SHA256 1e8c62df8f8aec78a8ddacc0d383f5e97d7aa891ec56b7fed20a01a5e84ec1f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        userlog
        • Path /data/data/cm.aptoide.pt/files/.crashlytics.v3/cm.aptoide.pt/open-sessions/6ADB6418037000010CB466640267FCAF/userlog
        • Size 163B
        • SHA256 efee18d8506880e2354c52d8a3cae014e584a1fbabff0f0dca9d3ca30fcd09d9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        userlog.tmp
        • Path /data/data/cm.aptoide.pt/files/.crashlytics.v3/cm.aptoide.pt/open-sessions/6ADB6418037000010CB466640267FCAF/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512
        Submit Download

        PersistedInstallation3276008569979349472tmp
        • Path /data/data/cm.aptoide.pt/files/PersistedInstallation3276008569979349472tmp
        • Size 569B
        • SHA256 9ca3f38a58bed87f9d2bba9f5ff0befb43cf36a13876581a8474ce57254be472
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation9029812092678104721tmp
        • Path /data/data/cm.aptoide.pt/files/PersistedInstallation9029812092678104721tmp
        • Size 90B
        • SHA256 5935412fe613b21607431126e24e54291fbf02e4f9c2391b7fdf108e0ce1f68c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FirebaseHeartBeatW0RFRkFVTFRd+MToxNjMyNzQ5OTkyMzI6YW5kcm9pZDpkMmY1MGE5MTRlYjgwMDMxYmU3NDI1.preferences_pb.tmp
        • Path /data/data/cm.aptoide.pt/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxNjMyNzQ5OTkyMzI6YW5kcm9pZDpkMmY1MGE5MTRlYjgwMDMxYmU3NDI1.preferences_pb.tmp
        • Size 410B
        • SHA256 e967fc6f9a75c2b51282af397ff2eff376596fddc1b230cf0fd59eac7b7214c4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FirebaseHeartBeatW0RFRkFVTFRd+MToxNjMyNzQ5OTkyMzI6YW5kcm9pZDpkMmY1MGE5MTRlYjgwMDMxYmU3NDI1.preferences_pb.tmp
        • Path /data/data/cm.aptoide.pt/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxNjMyNzQ5OTkyMzI6YW5kcm9pZDpkMmY1MGE5MTRlYjgwMDMxYmU3NDI1.preferences_pb.tmp
        • Size 434B
        • SHA256 9e35c66faf560cfcdbe37bb5d2e04fd01cc2862c3e7c375bed0fc39120900366
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sessionConfigsDataStore.data.tmp
        • Path /data/data/cm.aptoide.pt/files/datastore/firebaseSessions/sessionConfigsDataStore.data.tmp
        • Size 145B
        • SHA256 04c459a04f51a859875b2dc76aef678ba2d00c2c1d2615597752cfa36830d370
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        frc_1:163274999232:android:d2f50a914eb80031be7425_firebase_defaults.json
        • Path /data/data/cm.aptoide.pt/files/frc_1:163274999232:android:d2f50a914eb80031be7425_firebase_defaults.json
        • Size 546B
        • SHA256 54d808d1b66da8025fe1c485cbd8d1002ac166faec987d3a00d76ead04a83c26
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        storage-info.pb.mobstore_tmp-3252-67-1792762915000-0
        • Path /data/data/cm.aptoide.pt/files/phenotype_storage_info/shared/storage-info.pb.mobstore_tmp-3252-67-1792762915000-0
        • Size 53B
        • SHA256 6976e4504d460bf52af1177deae7819115538eac818de4bdbfb65740b9e8ebff
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb
        • Path /data/data/cm.aptoide.pt/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/cm.aptoide.pt/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 098ed9814f3f64a8962ed6520e535b96056779ee04bf8a5583488fd119a1c302
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/cm.aptoide.pt/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/cm.aptoide.pt/no_backup/androidx.work.workdb-wal
        • Size 181KB
        • SHA256 0195b5caba98d454b236d01bdce4791d85640dbbac9bf1bc7f7e6c4458a4de20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        device-encrypted-storage-info.pb.mobstore_tmp-3252-67-1792762915003-1
        • Path /data/user_de/0/cm.aptoide.pt/files/phenotype_storage_info/shared/device-encrypted-storage-info.pb.mobstore_tmp-3252-67-1792762915003-1
        • Size 46B
        • SHA256 72f3ebc45500bfa7a729fcf011c8fb8856fb0a24c37df1d0588e2e46bb0a2cf7
        • MD5 SHA1 SHA512
        Submit Download