e75804a21f214a7d8f4d46e22e16adf588bf44ff3583a1ca9197b57a0d5fa705

Analysis

max time kernel
95s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
24/10/2026, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app (1).apk
Size 5.6MB
Sample261024-jxt3msaw3p
SHA256 e75804a21f214a7d8f4d46e22e16adf588bf44ff3583a1ca9197b57a0d5fa705
MD5 feae427055411c4ad4a8cbe898969776
SHA1 8f2e9eb158d37757c4e8a93e0647dcfae872d26c
SHA512 e02611750beffdba452f9243b5ab8b4b61cafe8c2a36d08bc86c021f94fcd090968fcfc6874471543c370200a7fec5cb9cdc033e0765718d4242fbaf37918bcb
SSDEEP 98304:qg2cVwKXVkX4F2SbVR0SnZ8V9LEqmM+1f4WLJLyNnQln69+lcLdwc:qg2cVwKX+4F2KR0SZ8hmM+ZJL0nQln6n
TLSH
T1D5461212FBC5592EFCF3C3311779163650068CA1C753E28BA85476BC24B3FD48A96AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

defense_evasion

System Checks

T1633.001

ioc	Process
/dev/qemu_pipe	com.test.kidssafe
/dev/socket/qemud	com.test.kidssafe

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.test.kidssafe

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.test.kidssafe

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.test.kidssafe

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.test.kidssafe

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.test.kidssafe

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.test.kidssafe

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.test.kidssafe

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.test.kidssafe

com.test.kidssafe
1⤵
- Checks known Qemu pipes.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4802

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation25930371643648054tmp

Path /data/data/com.test.kidssafe/files/PersistedInstallation25930371643648054tmp
Size 90B
SHA256 b7ae6d9f218105d5b826a2eb4b1bce443050309434dd717c40bd11f95fdcf786
MD5 883fadf8f0c9f34ef0329b3438094701
SHA1 bbf2defb9cc74097533aa63b4be5bd3acd6b3f19
SHA512 0e06ec2097f9b2ccc028582c8322ccd22fc705a0fb605946bbcb5190e1d9cbac9c8a85bada62531ed4b2f3410130c78258d0fa822009c8ad26dc29aecf29baa4
TLSH
T1F3B012004B3042828699F3032C8C91001D6124432C898A854A0D904001922F4C307D94
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation5309738604615972277tmp

Path /data/data/com.test.kidssafe/files/PersistedInstallation5309738604615972277tmp
Size 569B
SHA256 75bc48ed262bef2bfd0d5caeb188233d45e7fee100cfbd28324938b7daa09c8b
MD5 6152942355360978ce6a8a8fae15182c
SHA1 6494906607df59a6e19cf24d5ada08f0c72b1bce
SHA512 d327fc26e975e80e82eaf1a0cbb516e9327ac313f29da6e53230424a9414231a55a9065a8b7b8fff7a079e12184d9b0f9f7d800f2116293899796a35cfed1562
TLSH
T1FAF020261A704A48E9D8A3123C08BE113D4C11E63DDB80D56BFF046097F9DFB835F022
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo2MzY0MjkwNzE4NTk6YW5kcm9pZDo3M2I2YjBlNjc0MDU4YzkxZTJjZTg2.preferences_pb.tmp

Path /data/data/com.test.kidssafe/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo2MzY0MjkwNzE4NTk6YW5kcm9pZDo3M2I2YjBlNjc0MDU4YzkxZTJjZTg2.preferences_pb.tmp
Size 345B
SHA256 428f09c10a55ed12ec4ab9f9acef46c4a94c74fe97986a9fe11426c3592a88b1
MD5 bada156950d9fa88c862359a3f922478
SHA1 4d37670284fef7872e180dd86b2cd3ec010539c5
SHA512 a080082eca30d73e99b50580ce6f298988679bab6f24a89d8a26f7717ccef716f3cf4952b9817815dbdb593be5842ebc87dfd5c49197a009dcf2b232bec2713f
TLSH
T162E0C600C7E2ABE218BF120D7BC8021C0F7FB3D02176019925F80180B80E790A8C1F0B
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo2MzY0MjkwNzE4NTk6YW5kcm9pZDo3M2I2YjBlNjc0MDU4YzkxZTJjZTg2.preferences_pb.tmp

Path /data/data/com.test.kidssafe/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo2MzY0MjkwNzE4NTk6YW5kcm9pZDo3M2I2YjBlNjc0MDU4YzkxZTJjZTg2.preferences_pb.tmp
Size 321B
SHA256 c9feffeba66d780c46a97fb25c86557b950b6be46d101450d5d8e3258b9fdae9
MD5 cee5b40e83e745eeb3036bbb3f1ae884
SHA1 c10f89c09f54ec3ed85b679569a1a35cbeefc4b3
SHA512 fd5650af1980d8039eaa0f7b408aea776f74db116cb650aa2b2711ecac345a78cf0165701d48f9c8859bad066791504761de1a03ded28f4949c65f5286745fac
TLSH
T108E02600D7E2AAE0196F124C3B9802180F7FB3902171059925F40190B50E69595C5F1B
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.test.kidssafe/no_backup/androidx.work.workdb
Size 104KB
SHA256 5a4529de8ca15f95cb47b2e7533bab8005c938734627d033dc5584d245cd44a5
MD5 d8b9a204b8eb2968f0b19cf1a781f8ce
SHA1 edd2f2a6cf3be1b5b7f9b284a1bb7f4f33e7dc53
SHA512 fe6bc6ad0c0f6f36cc8953a87ade78c2b333a6b8dfc4232183bf798832298b516859263d819c387abe82d6ff09bf4f32c2d043263e121c97c43a1a91e7e32a20
SSDEEP 384:L1G1N111q1vtidjnfWzzb83zS9eD86u0ED:Jw/3zfWz03zS9eD86yD
TLSH
T18EA3A5CD0F5D1C00D82959B2AC5607F1757E006F8377E3E5BAD212B6BFE64229A098B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.test.kidssafe/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 f3f1837a390df1ba320ffb65cda2ee118f7c14ab6ceab5005f00d2f8c449b6b7
MD5 f5b1aa3a820387211323caf8ba02eed1
SHA1 99c34a1918687ff8ae7665e8938a18ccfe5d3927
SHA512 6b5e6be70b0f8e1946d42cd34c8b175957061b61ff7e1fe4b865e61f933caf5583e8ed1b290b7a402a9bf018a0320571d57011bd7efe34e6445f37e74720f4a2
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.test.kidssafe/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.test.kidssafe/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 931d181cb2f9575980894e75086b183198d5bc20fa57f410f45b33c4854cca27
MD5 6c95a1004686c9ccbe7368498c16b433
SHA1 ff0f4d9b5b0c0c4c137aa741ad4e7409ab1cf9f8
SHA512 ac24941e7c0d1043e5099aaf9fd79aea66f5ff84e804ae4dd755590eefceccc80549f2fdafe999f79d769834a5665491f9fb79ff7b5b5bed3e7d244f835a00ab
SSDEEP 96:cMn/ToR6+etidjnZRWzzb8/KeKcK+zSrLtKz+eD86u0ExV:cMn/TTtidjnfWzzb83zSry+eD86u0ED
TLSH
T198C3108D1F593610C4A968F0E5D00FB1793FC53E9793E3A2259100F5EDE2921EA29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.test.kidssafe/no_backup/androidx.work.workdb-wal
Size 402KB
SHA256 9855beaa842166606fc7a4f8f31d3be60edfac4e4d99c509189c819558510fe2
MD5 861a606abec9d061d0714c576815c246
SHA1 6480ae059bf7892c6fcdcbde593c0253ad5405ab
SHA512 00398e63bb020c9d0d9e35f61ff244791744b3243d68b9a936f5d5ff4246ab5f3599a6cfcadacc87db235e70a2492e3acf46520706de1f0f1a6823813b75dac1
SSDEEP 6144:Xw5HwwwtpwuaecjM4r+2rHdr8dHkdHUdHUtdHVwdH6wdHSzw3pa13dw/3A:i
TLSH
T14A941FD12B2A8854FC295BB93D6B43DC51BF48F650276650B7CB33B1ABF205A934172C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.test.kidssafe/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 61b6335263cc6d92a5a21d1f1aabe446f35a13a265bc1d6cd5e659fad8b9111a
MD5 fc481a8219d0bbc00e04b4f99ff34d72
SHA1 2f5b3361372d00553f34be95368180f17e1c775d
SHA512 c58390b456eb3be1b89df3b54a4d12b6aa955c329bf4b95eeb5163331308c40e35c9e499b523efb1b419971e48769974f1984f0ca7b88dbf844d35a2120c4426
SSDEEP 6:KokRBqceev9FZde/kPlOERX4PBX4ogLugMBX4suuK+/LTl/F06oXPvXu/jiOw2:KokRBpzdeWRmBEyPbP/V/F0zPvHOw2
TLSH
T123722B55734129A3CD452FF358D4C3440E5ADE3E1722C71B275114D4ED527CCD490E0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads