Analysis

  • max time kernel
    35s
  • max time network
    131s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    27/10/2026, 04:02

General

  • Target
    LiquidIsland-2.0.0.apk
  • Size 4.7MB
  • Sample261027-elwpwabs9m
  • SHA256 3e459ddacb185e3f23302f86d525c7374d4ed3a5a805597badc4a05eb528d16b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • com.example.liquidisland
    1⤵
    • Checks if the Android device is rooted.
    • Makes use of the framework's Accessibility service
    PID:3377

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        base.3377.tmp

        • Path /data/data/com.example.liquidisland/cache/oat_primary/x86_64/base.3377.tmp
        • Size 572KB
        • SHA256 d373d7fd9fcf7a8157f42dba0e0ea7e69a61fd52c8860b32a3f5002a3066fee1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 8dc8c4bd3ade3e0fcf1e932f84c6ad626c7b64629d2aa7a3723e7224f2e773dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 79fcfd3df4e1fd9c88d51c1d8461a36fbd07005d3ecd3f4038079588d082b56b
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 c03bb8a878685f83a11ac134725bf0f061eea2fc3e8613a0b06a9fe99e430469
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 6e8108e74bb95e6af55173cd9c34744d56ab6fc3a88c0d5c7a4ad282dab04947
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 4d50af04849c9e5704a49a6b3eac2d0b4942d612c53dba659646afb1ec8bef19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 76a00a92536c1da0c62787802e53c7194304b993844eaf45ef9e8862b887bd83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 1ebc90f8e26ebc575725d7475ee5f568580299ebde14b328558d87f8af6b941c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 572c8fbb976543da8b590df85c5000358b2943285473a276524979bc38ec4635
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 1af8f0163370ac04c5adfafede949cb502bbf78430f0033917648a96f663ed79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 dad938360bd2bdf859a85463fde106f864e8c65051eca3f3cf5eeccb62e3ed05
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 2ec844a0464a7c2f71b6f750925ad4a81ab2e03c35363bcd2c686b9ee8b9fb56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 02db07644dd5afcd604961fd0ae14288de755578ab08077eeceee238bef96fe9
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 8bcb3238400f0b12a765672fb07c6b8a11fe6fb2ae79c904d7350f0ebe2868a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 24eb9bb4734c84af3683d6ba2c32d0b16c54aa5bb00760df74062a75b1b6fc6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 e8fc72c6494393320af32546f7d52e8e394049c481755462f32e1c373a9643f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 79e6cfc1cab3a5d7a0b5aa6b778d0cabe51d05b8c94749916c854be4d1be059e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        internal-keys

        • Path /data/data/com.example.liquidisland/files/.com.google.firebase.crashlytics.files.v2:com.example.liquidisland/open-sessions/6AE0225A002000010D31E20A1A98075C/internal-keys
        • Size 207B
        • SHA256 f40634ec5202ec1d64ab55a2830766c7bbae5a7bafa8a557baffa471e4fdfb23
        • MD5 SHA1 SHA512 TLSH

        keys

        • Path /data/data/com.example.liquidisland/files/.com.google.firebase.crashlytics.files.v2:com.example.liquidisland/open-sessions/6AE0225A002000010D31E20A1A98075C/keys
        • Size 23B
        • SHA256 3a9728f38aebe2363f58bb73662593a046011429c3468a0171b003e5bf3dd16d
        • MD5 SHA1 SHA512

        report

        • Path /data/data/com.example.liquidisland/files/.com.google.firebase.crashlytics.files.v2:com.example.liquidisland/open-sessions/6AE0225A002000010D31E20A1A98075C/report
        • Size 800B
        • SHA256 6544e98348f03a4b17f492ca6c477deae7021d793a70e43f62c08904b8b1fa97
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation6773082538801654738tmp

        • Path /data/data/com.example.liquidisland/files/PersistedInstallation6773082538801654738tmp
        • Size 90B
        • SHA256 45a4a64a465f0c070496e1a6f678d65c3a22363e372245e7f7137f5efb4efada
        • MD5 SHA1 SHA512 TLSH

        firebase_session_Y29tLmV4YW1wbGUubGlxdWlkaXNsYW5k_data.preferences_pb.tmp

        • Path /data/data/com.example.liquidisland/files/datastore/firebase_session_Y29tLmV4YW1wbGUubGlxdWlkaXNsYW5k_data.preferences_pb.tmp
        • Size 50B
        • SHA256 cb9f983df2386130ef8be4494263cbc2367e3619031fb6e80ae574b2ecca4d58
        • MD5 SHA1 SHA512 TLSH

        profileInstalled

        • Path /data/data/com.example.liquidisland/files/profileInstalled
        • Size 24B
        • SHA256 419eaa494ccc97de44cab99b90d5aa36907572630f16a7e0acb45755800cf06f
        • MD5 SHA1 SHA512

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.example.liquidisland/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 2bde511c7e316e988bf7ef169d622564ef7a027270b8ebbf79f281fa12047f38
        • MD5 SHA1 SHA512

        primary.prof

        • Path /data/misc/profiles/cur/0/com.example.liquidisland/primary.prof
        • Size 5KB
        • SHA256 8517c38aa8a775d4f4bcf0d7ef30412aa02becf452bbc5db96603679c5412a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH