3e459ddacb185e3f23302f86d525c7374d4ed3a5a805597badc4a05eb528d16b

Analysis

max time kernel
599s
max time network
584s
platform
android-13_x64
resource
android-33-x64-arm64-20260708-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
submitted
27/10/2026, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LiquidIsland-2.0.0.apk
Size 4.7MB
Sample261027-elwpwabs9m
SHA256 3e459ddacb185e3f23302f86d525c7374d4ed3a5a805597badc4a05eb528d16b
MD5 00dc95f0da618683603f186f48351805
SHA1 3361cc57948292d7505eabe91e43362c23f4f0ed
SHA512 22bee3737b957cfb0febe7acc2e9efcd025f3e9a3a35e2f7fda87aada5227642b7bca8570b14dbb4e5be043e7aee3a40c80dd09d9659a66f43459c767bd72a57
SSDEEP 98304:KG7pE3ydPV4DYRb30uWOhTjEwrbnU4YVad9bT6iQSBVhaJ5lDGYe:T7yiXAufhbhY0VmiQSBVh6bxe
TLSH
T1C4361115BA897C6FC833C1369D46D665642ADC6A9F93C707B0243B3D24BB3E48F192E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.example.liquidisland
/system/xbin/su	com.example.liquidisland

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/apex/com.android.art/javalib/core-oj.jar	4183	com.example.liquidisland

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.liquidisland

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.liquidisland

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.example.liquidisland

Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.example.liquidisland

com.example.liquidisland
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4183

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

core-oj.jar

Path /apex/com.android.art/javalib/core-oj.jar
Size 5.0MB
SHA256 d9d541d074d858571d60e2964fd39fb74130217fa7c92d74ed1695b0962837cf
MD5 f1a98ecb23b9134c358015fcab1f0215
SHA1 e71c1849677f17d5aa83a20853f3483136d449e4
SHA512 8e2a6dd96a89d2195ac770320933a1938977dd55ac98bc822bf33646fec208a2354f1e2dee14463eb776da13b737517affe9bc336093fec1fa9bbc6c7b67f1d2
SSDEEP 98304:Qql+aJkseykHZ+zblfzkriydf5MZnkkrGdOTPUfrLqwQftuBC1u2ewMBGiQxPesC:Q4+aJkseykHZ+zblfzkriydf5MZnkkru
TLSH
T160369D02FA724A33D06D833B85F36B557331F669F7838B5F00159574AE432E26EA72A4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

com.google.android.datatransport.events

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events
Size 56KB
SHA256 86e2ac6b9137f1fd3a6c335aebae3675015c0b2686b0a71c6c0f1237e49d4e45
MD5 6889f3388aa417e72353ebee01bfed4e
SHA1 73d66838bc097a6ed2ecab838d950c6809ffd328
SHA512 5489e39634ed9c4265c9b15ea8f7d91787fa398be675274ba961d2537a3312d338c1783205fe9117b7a69b2941101f07165ef2fbd941e18bf0765fa3f6cb2867
SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSMdHiFXfb7tFXfb4:RMEX0wIyNjaMtQb7jb4
TLSH
T14F43775D9B3C3221C6AD683DD7E243A31A7C83DF9722926139906DE58DC20657C21CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 6867f0843129c471c7d9f19947c1b036f935dbfe79a8bb07d4528b1bf8b89236
MD5 fe3b80f39ed54f9fdf92d549bdc298ed
SHA1 02330c407e54836deb7b25986221622fadfbd830
SHA512 b46d25b2f531c69a0780cc50b05c7f6e3ced58d39befdce086c6de0c1b88b510ffa3e9016ae8db4f9742427d32efca1272fe6e66193751cbbed57c5df48c3834
SSDEEP 6:7+/l9/s8FPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKkvEGt/Oz:7+tdHqLJdKBRmBEyPbyG1c
TLSH
T1BB021299A7410913C91E677B90DD83A41E14E7258377DB575550089C6D476CCA890D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 703a31d6561dd7972926c2c672bb26020721dfd4b4a47e6f06e84aa65dc7f0ee
MD5 661fafde79cfc85c171aeb94f771e872
SHA1 8a09ef0cf82901657cffc8de0b8dbd9799a28566
SHA512 3c27ae9c6a473c1af93c90ce1202bf16472e0ae04777f017b8c4048b667a60f42fff29a746f145e01c0b4a364f93d1b9ccb815e6eb9fd3b4d62a3e3859c2742d
SSDEEP 48:7Mc5qIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSe:7B58MEX0wIyNjae
TLSH
T15AB2615D1A3C2221C5BE6C3EC7E20653593C53DF572391703EA48CEACDC6469B0354AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 bca73de2e8749fa7f4b2182ca9aef1c27d5373474bb367204aad7ec101ea181b
MD5 1f39d7344a7cbd7733eeb1c49305adf7
SHA1 348b36333144ce68c304038d62b47849458780fa
SHA512 e698f0f3c4a890b80275da560b86fdd6a1b61d58ea4a054eb3c56e0bd5d1929ef9efcd8600422970b63aaf67a5b4dc1251814bdba392c65ffb177f7ccac42e69
SSDEEP 96:7xlLnauIfVQxvoviyfDvzMMEX0wIyNjat:7x5wfVQxwKyfDr0jE
TLSH
T16A72EA8DAA3C2631C2ADBA7EE7E546131D3C13DF5723502435E88DEC4FC6479B02516A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 dec1aec5a30a153ddb23896c02d2c641544fcc05a429544880b760ddf79ebf06
MD5 093c8293f16b4beefd39b4e7994f464a
SHA1 bc526b099936b00e8bb7a00303673f23e7fa278c
SHA512 525a1e35f341ef520da0fe3244a4abe84a6117a13526aaf03d3f314f6fedf94ef6c491b9c7ad09ae11e799847464c6624011621e9000c0ef5e449b303a1d40d0
SSDEEP 48:7MmVFXfbwq4g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSl1VNvqs/g59MENZBd5:7HbwsMEX0wIyNjajvcMEX0wIyNja0
TLSH
T14C92729D5A3C2211C6BE283ED3E247A3597C53DF572392703EA48DFACDC246AB0254A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 abc4b4f73ad57554f9950a783608abb64e7dc45f2f5deaa273be7ac0f0807e83
MD5 0c42f2fb270b0f36f1265a2c0c7ab75e
SHA1 a4f010da953eeaeab0ae70bc0a0b96691bd038f1
SHA512 5f6f9ff566a7f86e3c585cc716bc33c91a818adf23b00fb47dd2987e43336d595ddbfbed5be7040e324a66ed85aa3b5af0c09eb4206676208c75002fdceaf2f8
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 fa3f4a744324fec3da570147c19320d5d37c5cba8c3816bb434ac6b81e7b9181
MD5 26723ad79fd2c3969887c620dc35f00f
SHA1 27ee1255f73815cd811845ff29b6946ec5cc6afa
SHA512 695d8ee579e76c7641d627b42c3ce3ba34756b3470f0646baa0370154cb9b7f676278f224aaac4ab5d0ceae506b40c2862ec0b92e6a2191c48436dda1434b02a
SSDEEP 6:7+/l95sGn1+pg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKiL4:7+tsqLiuWd7RmBEyPbTM
TLSH
T1A30222A863801912C81A677790E483480E80A7B88262CB6B16620CAC2CC34CCA4E0F88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6
MD5 62ad4a05cbdca7f47b3206b7dbda487f
SHA1 4f4044cef7b7b1e5c6184ed9025267fc92bf0cd3
SHA512 0936531ed1b2b356a247123200739a43cfc765469ab47a424dcd6e3d1176092a212b0a28591d07f8c2d0cc9d2e0eeddfcea8dde314c2f9343783c61075b071a6
SSDEEP 6:l9bNFl4/Sls1BElO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEBE9zmzrfRmBEyPbBvOwk3
TLSH
T15972C2CEDF102606C6764737F8CAE3A05DA4A22D833BDA476B950460AE42559A8A1F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 70a9a2779c56dea44cf6dc3095df72d2e0a9e830f680619778bbfc231cd21352
MD5 7c80245ddba32feff5afa3cb4759f9ef
SHA1 844abfb8a5b678a9a71563f52068c5a31bce7a64
SHA512 4628869722ba21a939ba4050acc01a5e2a88ca7c190da204c76aa54d9ee6c7cf53b4810f08e6f244818dadd8bbe28bfc6d65d26745200446fd85f2dc120cab11
SSDEEP 12:TL1Es9zmzrfRmBEyPbP/d3O+/0Fl6xAl7:TLvpmzr0GSP/d3OlFKAN
TLSH
T1037268CDBF006703D23B8732B0CBD3E21C74E2199B33EA0B3A440464AE42184A452F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 e3d50fba9b189a8bdd6fac9ad5105ca9dac48d9074efe53df84a7ef98d7cf44e
MD5 423280ed21b2f950c8198d8449ee929c
SHA1 4e332e065326ede58ebe6d4671f689415c7e1a1e
SHA512 6b0b8c45c43c16920647b3365c909ba3feffe55294bb05ddc9e64c02db40404f3ef8017bec8efa80140e1154d944c1e3c8df9e5f242e05b2adcfa89720a6a64a
SSDEEP 12:TLIEsE9zmzrfRmBEyPbP/hr/gW49blqYFle5N+/0Fl6xAl7:TL/pmzr0GSP/h1499F6NlFKAN
TLSH
T1167259D9BA109707E23B4B3560CBD3E12C3872165B23D50739060A2C5E827C58151F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 aece6d86bc2ee640966def7f993eb5fadf2d305dd12fe83d870e6c01cc49a7ce
MD5 de54a8d50d0f3a2875f4ff1b0c765e14
SHA1 11508100690da7d75a57c1aed904627284c9c01a
SHA512 1aab9cd633eb4379ed1af4ecb574d54e15bbc841175efe938f05c02ff36a2232fb0ea074db6e85496af261d1391b6f6921887454c790cd037cb365e7b5c2f6a6
SSDEEP 24:TL6kpmzr0GSP/JKabCCb80i499F6NlFKAN:T2kArSP/kabCCb80/56RKAN
TLSH
T18B7226D8B564D747F2778B3961CBDBD22C3972A75B27EA073D0A2B1C6D423918061F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 1ebf469fa1a9cb40bcafdb7a1e11646449112328f0784f38fc342c7245ffc360
MD5 4bbce9bcebfb4cc73931a383939844a1
SHA1 fb532319136cec8d147def9250b212da94372b91
SHA512 f5ddf28dfb037e81f5ae8bd36a1e49e6fe0e702edc722fae535a3299816c38bde6b44809b53f3e3184aa9ddf342a4524f338356842353b21c2c887a07499d51e
SSDEEP 24:TLWEpmzr0GSP/uKabCCb80i499F6NlFKAN:TSEArSP/7abCCb80/56RKAN
TLSH
T1187226C8B964D743F2778B3961C7DBD22D3932A75B23E617390A2B1C6D42391C061F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 9f6f4374dd851232becd2ebb539d173de72b432b603fb773d4e35f578283a56b
MD5 104a4e8ca1b80816a3a942e522526ce6
SHA1 be5754ed073d3d8acf762c84ec8059af64c805e8
SHA512 d0f4d8b477ec527358d90859b23a692e8f2f16197132454f712e14fc9c3114251f1b833e138dc929818d773a8482a1f2c85d79c602e7fbb3772a6f089ffefb2c
SSDEEP 6:l9bNFlS/Sls1TElO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WK:TL0WETE9zmzrfRmBEyPbP/WK
TLSH
T1B5722BCD9F103603C5774777F4CEA3916D14621D8337DE472B9505B0AE434499051F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download