3e459ddacb185e3f23302f86d525c7374d4ed3a5a805597badc4a05eb528d16b

Analysis

max time kernel
599s
max time network
512s
platform
android-14_x64
resource
android-34-x64-arm64-20260325.1-en
resource tags

arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
submitted
27/10/2026, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LiquidIsland-2.0.0.apk
Size 4.7MB
Sample261027-elwpwabs9m
SHA256 3e459ddacb185e3f23302f86d525c7374d4ed3a5a805597badc4a05eb528d16b
MD5 00dc95f0da618683603f186f48351805
SHA1 3361cc57948292d7505eabe91e43362c23f4f0ed
SHA512 22bee3737b957cfb0febe7acc2e9efcd025f3e9a3a35e2f7fda87aada5227642b7bca8570b14dbb4e5be043e7aee3a40c80dd09d9659a66f43459c767bd72a57
SSDEEP 98304:KG7pE3ydPV4DYRb30uWOhTjEwrbnU4YVad9bT6iQSBVhaJ5lDGYe:T7yiXAufhbhY0VmiQSBVh6bxe
TLSH
T1C4361115BA897C6FC833C1369D46D665642ADC6A9F93C707B0243B3D24BB3E48F192E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.example.liquidisland
/system/xbin/su	com.example.liquidisland

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/apex/com.android.art/javalib/core-oj.jar	4444	com.example.liquidisland

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.liquidisland

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.example.liquidisland

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.example.liquidisland

com.example.liquidisland
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4444

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

core-oj.jar

Path /apex/com.android.art/javalib/core-oj.jar
Size 5.3MB
SHA256 26f2a49dffe39e31bf24520d07802e1409526c0ebecf6426d447f8fa3101e9a0
MD5 e86c9eb7418c41207df5641bc0de3f6d
SHA1 8a9701f74dcc4fb12c3ff281893c0b4fb72238b8
SHA512 f45feab5613edd0702bffee9b998f4f9110ec6e0d2a28992e9439a57374c198df90be66ae85022f758608270e81aa84af37654e5f29621143cfc4ad9da034703
SSDEEP 49152:zsYn7xMlf9a0RT7B4RmQURzzhJqJBIfOF4K371O/Yzz24g+34jbnGNuPA:zsy7xMlf9FP+Bcit
TLSH
T179469D53E6A31F32D06CC33784F34B95B73AF1A92B870B838404A6746E537E67E561A4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

base.4444.tmp

Path /data/data/com.example.liquidisland/cache/oat_primary/x86_64/base.4444.tmp
Size 704KB
SHA256 7734015f2c431a46cc8f8774b68723522745690c5be7efc273c61e3f1776e0c6
MD5 f4a25700a6eef53adc60a1bb7ab69964
SHA1 2743389f74d06c82b767c7661cc5406e010cc877
SHA512 0508b130f572f7ce449d5bfd67363f17f4ce4b7005e8b3d26322e125687a10710e343baf4e8136ab5b9bff2980215f616c6f4df50fe9eba8e27884b3a8ecdae4
SSDEEP 12288:2iBqvqlno9nkPQv4MiYo07xOUvnSYjRHdG+694WLlDJURp:qFqTVW7xSYHIiWLZS
TLSH
T1C9E48DBFA722C055C1DFBFF78A4B05F5FE76811162423A1490A2A73E6913F04AB71B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events
Size 56KB
SHA256 f5243df28a65447af797d14d74c4a9ad8d3919a560fc7219684c78b4678f1097
MD5 bcc64f51c3f5d7e358e0accb3c12ef11
SHA1 42211d91cc9352dea00f3bf4af19e0dffe3b2109
SHA512 0ea9cd0f6f1be6327575ec7faade72fb7e32f3b9ca0ad0b98f21f2e53cb7f729855bd6c5804a9976cbe5d67e149ceca98a3edce38f60a2807545a205472f3856
SSDEEP 48:T0g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSMdH1FXfb7tFXfbg:FMEX0wIyNjaMt7b7jbg
TLSH
T11543775D9B3C2221C6AD683DD7E243A31B7C83DF9722926139946DE58DC20657C21CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 46986bfa9085f917b7d133a5d91ce4493392eaa38b09c5a883d45c9a5b14f402
MD5 8fd861c7dce5647ef71e216074158dba
SHA1 2c77395432fe66a87923a0fb249542f3a895ab71
SHA512 02b27611dc14063898d1ab284ffcfce75447c6de409518188d2844a67276a9f1128aa25c76930b3af26ccaaf53e6d9f7bad392967550bb8db51341267053f36a
SSDEEP 6:7+/l9J8lFPg9bNFlLdvtAlOERX4PBX4ogLugMBX4suuKSVp8t/J:7+tolBqLJdIRmBEyPbX2J
TLSH
T1E802C08CA3401803C02D17F790C883902F10B719C333CB0705600B643C037CCE890D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 b905e3cb6bf1234f6bef4774ed28d1d3e46725106c9bd2879ed104c5c9192a46
MD5 4ccde8c07380967f9dbdc9fb50d79ab8
SHA1 e037c0129cdac3a7e74fec54ae29b902abd72e0c
SHA512 fc650bd291c43bece9ea7f8c664dda52b9e9d1782dae1c402159a8d6aeb1d59518c1d9b606b99a4852ddb19d2e411285cda870bdbee93f5e09104a90aa3a8608
SSDEEP 48:7Mmjq0g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSFP:7DjIMEX0wIyNja1
TLSH
T157B2439D6D3C2621C5BE683ED7E10393693C53DF572391703E948CE98DC246AB0395E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 595646ea11711a45aaf9825a58018ee87d5ea4c7ca971ec299b89ec40cc10302
MD5 4f7d87428e61e1d12484c8307654226d
SHA1 aa58c4aca1c37a25c7fbe35c83ef53b318507144
SHA512 c81e4781d89855718bb491674cdf14cd780e0549e403345c4bf02efdd2b512d255245bbe6f9574d8d2ec6ac3c7e45b780db372b9567105dc74da672aeb258a60
SSDEEP 48:7MXDyRQ4INKvC4gQfW5GWHaWWvGWHNm9cw0671QWxWqEg59MENZBdUdndVd/7293:7WehdvVgQ0VoV8ySgYMEX0wIyNjaa
TLSH
T1D6720B5DA92C1232C2BDA53ED3E509131E3C13DF5773603078ECCDE88E8546AB01555A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 71582f1e6cc55d0fa5f1e03359d95c5c966840c241d298aef2212f15b1e58f0e
MD5 388c43f2f594b6e651f34d4e0acb196b
SHA1 78838de708e0f76de0afc2b68f12a422ea473493
SHA512 e8256e7758bff389aacaec687e3a1ed2c66d6fd07f537abebb2dc5c54ad547f57e3e6975c171e420a52d0fbe599634de63720753a14a33b37f01287e1f202766
SSDEEP 48:7MwVFXfbyqkg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSMVMqUg59MENZBdUdnv:7pby4MEX0wIyNjaBoMEX0wIyNjaj
TLSH
T19D92749D6D3C2211C6BE283ED3E243A3597C53DF572391703EA48CEECDC246AB0255A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 a78edaa1add77b1eb64a7f85c878a62d080ea7f091aed4aea8948d76feba2742
MD5 3dfae507f4360ad9bf15a2afeabc13f6
SHA1 21db0d4ae82e2304e375741eec82f782bd13031f
SHA512 3c22eb20f12f3888201d6afaf78d13246a887b61e530b63997a44b75408dc8c6e107799b2dffd62b6039255987749318e17e166f3b5bc69e78c1141adde779d2
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 ba4a7220dd3dd4684c985a7feffe22958d628b1134bd00bdc8117579c72c2459
MD5 79ff25d2793ac749ba8ff2e37f3e5415
SHA1 ce967f6e1231b4b9f86f6b2d65c2fc1eec8a335d
SHA512 7d67e10b92f0692929f2d132d7820d05ae234a48db1a2f956a76f612848de22e4032f03ee9651f04e14bc4c53329abe4721d7a821bcf606a103ee98d0701689a
SSDEEP 6:7+/l9Wf8Fn1uf/pg9bNFlEuWdxEAlOERX4PBX4ogLugMBX4suuKga:7+tEft/pqLiuWdxBRmBEyPbja
TLSH
T19102C09CA3801813C81D2ABF94F683440EC0FB98C1F1CBC7095008943C074CCF4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 82a040773a89d30c26a0970356daa3a94e4ca0b62e85fecdb59abc10d313b356
MD5 b5a82d8220aaec4508990b66dc934477
SHA1 eeee1c5282c1c2027cdc522ace01bf0e8533bea1
SHA512 ea6c41f5ccb401314b943ec2f46d7897e9c33f94298be09e6bc459c6fcb7cba31c7a221245ecb2751f3689cdc41244be79fc823570feb582c85781e550cc15b4
SSDEEP 6:l9bNFl4/Sls1WlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqNsvuoVNs3:TLWuEW9zmzrfRmBEyPbB93k3
TLSH
T19972C2CEDF102602C1B60636F8CA93A55E64E22D8336EA4B2B950460AD4244AA8A1F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 d81d651047de5da7fa286a6fee126ba027421f1a2ca6dd708d43bf05c49b6b24
MD5 f1f83bec04297839a38ee9e715ba018d
SHA1 4b2eae6088b07ecede95f81cc190d9bf1c48f3be
SHA512 d3613e31e4fa2bb5eca9420fbacdce8a1b70631337aa74a341087fe0e4a786662a1e2ee57b921c526d62373e1fe1ece5ceeea49f7ab187e5115e5eebe5d8d189
SSDEEP 6:l9bNFlsls19lO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6ksM:TLiE99zmzrfRmBEyPbP/P+/0Fl61C7
TLSH
T14B7268CCBA106703D1B7473670CB93E11C30A2198733DA073B450474AD421C99042F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 496ef8d1a01e9233d94465c96846bbd717fa9095a95419ab264c40493a5ae6f9
MD5 2333086f29cb657839f1d7c11bf75e98
SHA1 788bc20b73c742cdc52f3c1fc540be7d01b22fed
SHA512 7f527ce76b7941a27627f73a12106a06a092c2b234b4ccb9dc2a087f47a548b185196cd600a855fdcc73bf6823c48612cb1617e01de7d30ab62e16211dfed3e5
SSDEEP 12:TL1EjE9zmzrfRmBEyPbP/hr/gW49blqYFlR2N+/0Fl61C7:TLbpmzr0GSP/h1499FGNlFYq
TLSH
T1FF725999BA10D707E2770B3560CBD3E12C3472168B33E50739461A6C5D823C68012F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 9182004cee3e9ac89b1b33fe8f1614ba26d4777e03627b200f2d0d1693fa06e4
MD5 ed0235d8c1704e842edb6af58c15f562
SHA1 2ce4ae26a083b16dbfea6d309426a42a0ede438b
SHA512 e88c7eedcf64277bf058c82f6d1784d9437988af7c1d3baf2d456265dbc0ee27823f04c0c03d9dce8644a3eea37cb75ae0fb73d539893301c3404045dbb11763
SSDEEP 12:TLIE1h9zmzrfRmBEyPbP/JOLabCAUEWlCuUyWlzW49blqYFlR2N+/0Fl61C7:TLrpmzr0GSP/JKabCCbA499FGNlFYq
TLSH
T176722698B564D707F2BB4B3961CBDBE1293472A74B23E6073D4A2B1C6D423968121F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 8e379bd32dc213c04883ddd759bf71d2d718c712bdff526c1ac246e9db1b3b54
MD5 37434132f1c46445358ac5578ec4e604
SHA1 e7e88e3923e35f11bc81cba3ae9f67a80e610164
SHA512 74ce8a09922b7c6e833c0126c8359d24c5e6b5451278be68b7b23c72ca54138b0988d3f22359450a600ccc5dd3645a3bdb114ca71b077ba797ac6a2bf36782ae
SSDEEP 12:TL6uEa9zmzrfRmBEyPbP/uOLabCAUEWlCuUyWlzW49blqYFlR2N+/0Fl61Cv:TL6Apmzr0GSP/uKabCCbA499FGNlFYe
TLSH
T1D5722698F564DB03F2B74B3961CBDBD1293572A74B27EA17394A2B1C6D423C68021F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 28633cb72b4c6b6492a29843f442314f44534a63c6451f3b68486a9dab0041a1
MD5 69251b6832245c56175da4c83e90b617
SHA1 d1d226ef9d32e71034a16fe0ff46e09ae72032b0
SHA512 ff782ab9a8315ae46f5a643ff597f22f142c86e9f3f680bcade1a937bde583ece6ebdcbd1387ddefc035e7ae2613e49658df13892993ee6e81766b47523ee71f
SSDEEP 6:l9bNFlgls18/ElO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WK:TLuE8/E9zmzrfRmBEyPbP/WK
TLSH
T12E722BCDDF102603C5F30777B4CEA3916E14621D83379E472B990570AE8344A9051F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download