ea75158c4ee6e798f907191da742b310cf1e72392b50ad10bbf5760861ba5095

Analysis

max time kernel
21s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
24/10/2026, 05:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea75158c4ee6e798f907191da742b310cf1e72392b50ad10bbf5760861ba5095.apk
Size 16.9MB
Sample261024-gb719sswhy
SHA256 ea75158c4ee6e798f907191da742b310cf1e72392b50ad10bbf5760861ba5095
MD5 e639f56142c2f5617fa701f65f505469
SHA1 bf0b8ec9e482f07a7a276d67340ef390a8b68370
SHA512 3cc3874f9cda958f98e633e474267ff9034a55081f55a8fbade34178ee0400dd34c002a222e24a75e1a7a1d105e7713170216ef9aa81a4a6b9eab51fe5f2bf17
SSDEEP 393216:3dYyba7YwPwVJAVTFXu9e91NVhJcn7NQr4yVRyYFmv7m/mKvksVrSZ/x:msohPYLe91Ne7NQciavyOSC
TLSH
T140072311F3A87A87E430A03A4656EB3075569C686B02E682791C33FC3B77BF44B653E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection defense_evasion discovery execution persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/data/phones	com.aleghe.hatra

Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://media/external/images/media	com.aleghe.hatra

Reads the content of the calendar entry data. 1 TTPs 1 IoCs

collection

Calendar Entries

T1636.001

description	ioc	Process
URI accessed for read	content://com.android.calendar/events	com.aleghe.hatra

Reads the content of the call log. 1 TTPs 1 IoCs

collection

Call Log

T1636.002

description	ioc	Process
URI accessed for read	content://call_log/calls	com.aleghe.hatra

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.aleghe.hatra

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.aleghe.hatra

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.aleghe.hatra

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.aleghe.hatra

com.aleghe.hatra
1⤵
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:5004

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Protected User Data

T1636

Calendar Entries

T1636.001

Call Log

T1636.002

Contact List

T1636.003

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.aleghe.hatra/databases/com.google.android.datatransport.events
Size 40KB
SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
MD5 1cf3f63c021d755a21623e6d0e86dbc6
SHA1 e40e0f1faa61abcca7ba3394c54c92ff7334b49b
SHA512 38d72e14f3513ffd26989cbda3df46ed3dd6e731bdfae56440eff6b64760cc13f91014281c9add61e018fe3529e49c63a6892ca22479515816c768b546244466
SSDEEP 48:TfkL3u59MENZBdUdndVd/7T9IvdldHlq8/JqYpqPS:zkL3KMEX0xIyNYMa
TLSH
T1AF03EF5D4A202611C2BE083FD7E257931B3CE35F6B2387612E904CF6DDC68B6B821998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.aleghe.hatra/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 75b7f3d353092094c1081990ff5dc06aa158ee6256f01f22c9b5a42e24b32947
MD5 7278719c5a53ffc8644ae57e87f2e874
SHA1 5a16d3cc453b57de05542bf8fcf6203ac98726fb
SHA512 b128df51f4b384eec519f3e07511b440266870ecbff6004114748c4668af57087733950ecf6d9541dfcbb9bae7aecd1cb85eab2bbb028967db086bf99a283615
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.aleghe.hatra/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 34671e5c118ae9c5d17ed05d1d014e1b17f0bbcf389f2bfd9d4135dbd1f095ab
MD5 35069b41c9a3d46999856185c3c31b7b
SHA1 b15c60f147117a31bdec65e8c8175171e86031a2
SHA512 3ed2b4853ef3bd141892b33a9443e147ed80cbe14cc3817e54709bc2147db4290375acd0b458ee8ae7c7196815bbd4885ecfe1d7987c02af6a090df8f376df64
SSDEEP 6:7+/l9Pn1Ug9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK6k:7+t0qLiuWdYRmBEyPbi
TLSH
T12502229863802853C8292A7B90D483400D20A72889A2CB3727F008946E0B4CCA4A0F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.aleghe.hatra/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 06149b2b249a2b3762f5cd75e8d19eb1434339c26995d720de98c788216bab2c
MD5 30645f3368caa1224d143071918f8b12
SHA1 0aad7955a364c56d2de3db798ae15e607d41a240
SHA512 a79dcbcb180ca127522c019f6f52e6a8ce7046b51a2485ccfb4369041bdb99758cd04c61aa76119e478da9a7f88d56deaa5c9f43de532208a0a060e0ec1c4004
SSDEEP 6:7+/l9PMQPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK4/k:7+ttvqLJdeWRmBEyPbHk
TLSH
T14B02128967510D23C62F57B7A0D983542E15E73E9373CB57169108646C46ACCA8A0D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logsManager.db

Path /data/data/com.aleghe.hatra/databases/logsManager.db
Size 24KB
SHA256 8348a7c9621b77ebab17c20fbfa8f05744df0ee067aa15fab914be175df8fe40
MD5 1e6352dd29fedfb3d25eaa571522a48f
SHA1 fa7367e0ce6a0af58448ce501a779c0e88a57e66
SHA512 03724dc345b921e455143ec875b3e8683ae7ec772d4a2b948b6b749aa7293e1bcfb54666908d66008860ef77658a17fcf265d97a4ead6c481d3e8a000ca0bffd
SSDEEP 24:TL5tSuBUZgFjde3QUGSzwD+mm/l7wkkbf:TPaye3KSkDxm/lUNT
TLSH
T1E0B2CED9C3ED3303C2604137A00BE3A2AD455D1CC1A25B572AC13CF84D53919EE7AA28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logsManager.db

Path /data/data/com.aleghe.hatra/databases/logsManager.db
Size 24KB
SHA256 785b0e808eab75a69814c9e77f4a87737d96eec1c23c3a2a7aebcb0860147a0d
MD5 5bee80fc6390fb8db6fb965af86682e2
SHA1 702c205d56bb34e635e8a5244a87b4f1b76157a8
SHA512 0bf5ab4b3c84c103c138085fb8f5820614215fa3587e848c4f3a206e0299ad6d765283f9de89cdea08b99f75157935b97eb079d75046255e0ae9c38e0673e039
SSDEEP 24:TLItukuBUZgFjde3QUGSP/eHD+mm/l7wkkbkRx:TRBaye3KSP/KDxm/lUNQRx
TLSH
T1A8B2E3D4C1FA7303D2A04277A01A9592AC45595DC2B24B576FC12CF90D53819F5EFFA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logsManager.db

Path /data/data/com.aleghe.hatra/databases/logsManager.db
Size 24KB
SHA256 f80ddd5ababe7a26dc4fe484763714b3c0db258e9837080823f440245d850628
MD5 109da0261f3fc1d11b7c6ebdb6523d5c
SHA1 0263664d1a7596738a07302d3fb7eb155fe0331f
SHA512 3ab7de03a8dbf4801a7ea9aeec3df97c4baecce4254d346d142ff3c2e4066183caf534419a9cf437b9b29ab79e02bcf0fcd09eba77a77ea0fc4773f1dc575219
SSDEEP 24:TLbtYuBUZgFjde3QUGSP/hRQqV4anvBHD+mm/l7wkkbxQw7:Tvaye3KSP/heqV4iJDxm/lUNdQA
TLSH
T130B202C481F93303D2B00137F14B5592BC0A6A1DC1A24B966AD62CF91D53C5AF9BFBE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logsManager.db

Path /data/data/com.aleghe.hatra/databases/logsManager.db
Size 16KB
SHA256 e1dcefc68247b3c652e969d6d5741732c6e9a8f9faee1e7d8ba8939b51a3cbfd
MD5 b8406dea0b0c1c50189693a5322677bd
SHA1 c354e217aa3ed1ff2f259aa268a09228d16638a0
SHA512 0d78580e4a9099d4cc3a055b3b748670d6e396491c08a385c35a3636a6b8bca29a0f11960957301d320f29046d812c26e5bfaee275301ba928de1c184764c79b
SSDEEP 24:TLiBtXuBUZgFjde3QUGSP/ifOVIb+hQqV4anv1D+mm/l7wkkbU:TOSaye3KSP/ifFblqV4i1Dxm/lUNA
TLSH
T10272EFC895E97713D2B40177B04A5152F8092E0CC0630BD666D32CA94D53C5AE9BAB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logsManager.db-journal

Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
Size 512B
SHA256 a7673fc910381b886bf069db7895e7baeb06e3e5ca9acaba0214b23be0852584
MD5 25b85a636acac830725a54a1e8b33756
SHA1 3d8d19951a51b308b7e5ee64c042326c14950624
SHA512 e7c5fb2dc868fa52ca14dd63d465b348aaa867029eb2463c8c868125645b4950f787c8c6590af4711eb559630dc3199527b48a876e26a1a0a7a6474fd9982e51
MD5 SHA1 SHA512

Submit Download

logsManager.db-journal

Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
Size 8KB
SHA256 f0ad174d4bb3637616083ae27e4eaa9112e2ba261555e139a5eae99b8efc1d9d
MD5 818607e6d2704456885b4df4b2a40a17
SHA1 335bb499a48e716c42e1b995525699649cb1d255
SHA512 39025f7eee03099442063a387791d047d2c5c174e9176cfd7ed64fba46be8f60669ffa5ea971c4523d18089193a2a3980b04de8a87326ab93453155803eec96a
SSDEEP 6:7+/l9gn1/g9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK61n:7+tkqLiuWdYRmBEyPb51
TLSH
T1560222A86BC00912C829567798D483480E00E7388161CBAB26900C952C0B4CCA4A0D14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logsManager.db-journal

Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
Size 8KB
SHA256 ff8fdb636a728173cf340beb7c5ac3e6850bbea144d5c7c4ca0bd4abf341063d
MD5 29c390425886f3ea3a7f74e4f92a2fce
SHA1 a9fdeb2b6296d3d793ee4ae2f5c9e3fa4356a336
SHA512 a902e4967d083ed613ee86d8ea2e3c31ce0bebc98ed2a28368d3d9991d23122f6d6626e12dc12efdea40b4901b4cefc3c5b8ab4ee43e99cd663e2efb482015ac
SSDEEP 6:7+/l9iUHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKVhK//ebn:7+tvvqLJdeWRmBEyPbwYXq
TLSH
T17E0212CA6B420913C5295777A0D983553E15E7299263CB57169208946C476CCECA0D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logsManager.db-journal

Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
Size 16KB
SHA256 ea22be1f7a8b12120aad4eba2e488c005c8963ea498df000d6238c4d9d808e0c
MD5 dfad8097b09e1536f628f4d87c6bbe87
SHA1 f496cb3534084cf1f6b836c2925ac5fdd7aa7110
SHA512 59dade25bdc4f2ebb2c51fd87d6aaa3249b3f288d4240a5fbfc6c8934385370a441c6e90b3f5802d3326728f11064a8205539ce133a6435f647ded20d6210e0f
SSDEEP 12:7+t74GFqLutB5fu0QHSk2F+DugFjJAOsEexOGQGTuRmBEyPbQ:7+tUCqLutjuBUZgFjde3QUGSQ
TLSH
T1BC72EBD5C65D3320C00B817280465050DC2E2F5DC1E2EBA70BC838BCAE835B9E8ADF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logsManager.db-journal

Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
Size 16KB
SHA256 50514736e73751c7e36b25f30815ed0523306b9d6a4aeccce3c72a4fef0729b5
MD5 98ca5dbd2ac6759bf272b5b02218bdb7
SHA1 8bde630235a28161ec8f4b58587cf27138778f68
SHA512 179cd0f031c624d74240677a2006caa852b79019b6e99d44931826c0af43b5216a6bef86929b05f7b068321b5b1ad119ecc84cf4171be6d0b7d81b8dec13faa3
SSDEEP 24:7+tvElSD+mm/l7wkkb7RqL5tSuBUZgFjde3QUGSl:7M0SDxm/lUNhqPaye3KSl
TLSH
T18B72C2C9C2FD3303C261417BB067A253AC551D5CC1A25B6726C13CFD4D83819E5BAA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logsManager.db-journal

Path /data/data/com.aleghe.hatra/databases/logsManager.db-journal
Size 16KB
SHA256 6c4c79a76d6d9cec279ebaf56721b99c8e6a10ba8f9b57f64ca280e61476fd3e
MD5 c9672de49e96e03aa386d697826a215d
SHA1 3e6ca07c50903182e02631cf056960a7ef4ab771
SHA512 cf03514e5355ff47678c87e27a37f4dccb0a5def0c878afbcbb706b280574b129d6f1e26a2b41040631873102c701256cbdccf00a3a4f323efd31a2ebeff4199
SSDEEP 48:7MgqV4iJDxm/lUNgqvaye3KSQDxm/lUNMqRBaye3KSY:7rqVHJD9im5GQD9uW5GY
TLSH
T1067200D8C2FE7313D2B04177B04A5192B8156E5CC1A24F972AC62CF91C53C29E9BFB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation7403673959573806615tmp

Path /data/data/com.aleghe.hatra/files/PersistedInstallation7403673959573806615tmp
Size 567B
SHA256 1cd588df58835250551987caa51851d32186ea5a1286e1d0af7a78b8bfba4c7d
MD5 70bb7aa58cdfb9d2fce2ceff8e1309c2
SHA1 5017cb8f3e046d5e64840fddd022010cba4f2f60
SHA512 5cafd70ebf38f2d2ba4725d77e4b44f08ef3639495b387db39e0e70a51a63a3f75c1ec5bd921ad3584b813e711137eca0fc6b19c403677d584e44ba52371b5ef
TLSH
T18AF041A02FA00AE9A09A30030A8E2E43D60204B0229B422ABFC658D0B3DF42A821A254
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation7987444867367245592tmp

Path /data/data/com.aleghe.hatra/files/PersistedInstallation7987444867367245592tmp
Size 90B
SHA256 a72e3f6ada3031e7044854ae0b51987cb6b795a8626761c71dc52092155623a9
MD5 5e2133eaafa8ea918fd77a00bfc4be6b
SHA1 110f98e7417b4edb0d73d27f89c75f01e36e30ee
SHA512 359905f2963bfef2b061624880b563c80b29939dac4333b7632b80e61a8abdb9a5727e384ac545205ec4387d70780e6cffe4534b1ab79308b01b9f71c09a7d67
TLSH
T1A7B012005A704192868DB2021C4CB6405D4114C1070B8F0D8E099C8081A11D1C103BA4
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 0146b11f31cfae76c7c4ed8122ce481f1f2f1ffdad9a1f73d0569dab002ac7f4
MD5 6e52e2582d7457871d50d1cf1f7a6fb2
SHA1 89ae9ffbba1d15567154264f93a10d9d5a393ed8
SHA512 88b9523d0848fbfa3d98552f4cacab1e45b154428730cb09ebff47632f9b9c06fce9559a6c87ea731f54963ca30944999825d3be50c8af33b9e05bd3a03863aa
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 3e312afc932cc48cb09e2f7f8e1bde3a813e91e601f43b01c393d85e679f5fec
MD5 85d05d25242ee8bdf1da17527d1cba99
SHA1 d1e3c85fa65d6e82962543a7f41b586e84452be1
SHA512 ffda34da93abc4f3bfb7e5dbd4b3f066c8aa8156a518d32d4c73ef9255b31935751c10e8182513dbdc62c145dd524f5c54a96268781842e6d8dce04a9bfeb826
SSDEEP 96:k6+hdjnHtDRMpf8UzS6+BD8q0ExPhg1/m:gdjnHt9Mpf8UzS6+BD8q0E5R
TLSH
T1CCB3F04E1F192540C499A4F0F5900FB1F97E512EBB93E3E16A910075AED7D20EE29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 fb66fe18d9526225102bea0637ecffe8864edb364e412c94e0c13bf7c51deafe
MD5 77c4726b3baf852822e89c9723021eb8
SHA1 d7840fe687f586cf441cb35e31fdf20e9df6156a
SHA512 f5c980bee45eb99530ca5cc986a2d3bc104d43a657eadca04e98f535c5795ae30ff15974d46a1add774a9e1d98fce419cbbc791a37901b382f696d4629745f1b
SSDEEP 12:9U65Rt3iIK4ZFhtMXrA+EJv1IHSh05N1s1Ef44ZvIwKa4ZvIsSXBeGv1IsqdCI1X:S6ntYA9CP5MKDK4XMWYLdIj+tYAYCQwr
TLSH
T1E704E99EA3494061C3BF607BF4155FF1E8246DA07C0CB29DDB97A1192A6FC0AB77506C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.aleghe.hatra/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 30bbf2fa3b29862d60bb83c23d744e1c50b469ffdd0e379ff9e59f778864933d
MD5 6f3b6551458eaf1d47e1676c1245ffd5
SHA1 57d05e0dfeb09b61c006df9109df46b62e7ebd5f
SHA512 1b3af6503f361d6f181235ed2b4aa5e45d7aff19df253711579befe324137d23b3885cfce5ecbb5f02f5bc4eeb9b594880ec8ef4e417508695870ef03060f4e2
SSDEEP 6:KwzYwsimD9FZde/kPlOERX4PBX4ogLugMBX4suuK+/geEmYES4Ow2:Kwz8PzdeWRmBEyPbP/geEm/fOw2
TLSH
T16A72C25EA3840553C5061732F588CB44CD747719BB52CB8B638109562C6BBCCB460D2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads