Analysis
- max time kernel
35s - max time network
131s - platform
android-15_x64 - resource
android-35-x64-arm64-20260325-en - resource tags
arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system - submitted
27/10/2026, 04:02
Static task
static1
Behavioral task
behavioral1
Sample
LiquidIsland-2.0.0.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral2
Sample
LiquidIsland-2.0.0.apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral3
Sample
LiquidIsland-2.0.0.apk
Resource
android-33-x64-arm64-20260708-en
Behavioral task
behavioral4
Sample
LiquidIsland-2.0.0.apk
Resource
android-34-x64-arm64-20260325.1-en
Behavioral task
behavioral5
Sample
LiquidIsland-2.0.0.apk
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral6
Sample
LiquidIsland-2.0.0.apk
Resource
android-x86-arm-20260325-en
General
- Target LiquidIsland-2.0.0.apk
- Size 4.7MB
- Sample261027-elwpwabs9m
- SHA256 3e459ddacb185e3f23302f86d525c7374d4ed3a5a805597badc4a05eb528d16b
- MD5 00dc95f0da618683603f186f48351805
- SHA1 3361cc57948292d7505eabe91e43362c23f4f0ed
- SHA512 22bee3737b957cfb0febe7acc2e9efcd025f3e9a3a35e2f7fda87aada5227642b7bca8570b14dbb4e5be043e7aee3a40c80dd09d9659a66f43459c767bd72a57
- SSDEEP 98304:KG7pE3ydPV4DYRb30uWOhTjEwrbnU4YVad9bT6iQSBVhaJ5lDGYe:T7yiXAufhbhY0VmiQSBVh6bxe
- TLSH T1C4361115BA897C6FC833C1369D46D665642ADC6A9F93C707B0243B3D24BB3E48F192E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /system/app/Superuser.apk com.example.liquidisland /system/xbin/su com.example.liquidisland - Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.example.liquidisland - Checks the presence of a debugger
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.example.liquidisland/cache/oat_primary/x86_64/base.3377.tmp
- Size 572KB
- SHA256 d373d7fd9fcf7a8157f42dba0e0ea7e69a61fd52c8860b32a3f5002a3066fee1
- MD5 79a294119993a3be6d84860b9420c994
- SHA1 bcd6784334e914526a4909adc37e41ba95b4ba3d
- SHA512 4fbd26caa87af2ee774f308dd3b56da8b56cc177a11faf905f3092413f4aeacde1d59b2c9dd5d54634e99757345c016d07c6b0fec98292ae5cf59c4ae233d4ce
- SSDEEP 12288:Cu8ZMjmo956MPBA4s79egnbNuKKWBScLTXQyh:Cul95Ba4sxQdQXgQ
- TLSH T1CAC46CAFAB62D015C1EFAEF79B8745F9F92A8011235629009462773EA427F14E770F70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events
- Size 56KB
- SHA256 8dc8c4bd3ade3e0fcf1e932f84c6ad626c7b64629d2aa7a3723e7224f2e773dc
- MD5 3043c465f423e091577e220cd85a9e94
- SHA1 7ccafd9b73c96a046aa3dcf867713b072407f549
- SHA512 e1715de3977bf7926629b1cb856943f64fb67b38779999adf4962db14e76da18f96d20adce197ff18340fe21387b4a62517a46c8d20836fc021aa2e9a18f2436
- SSDEEP 48:Tqg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSU:DMEX0wIyNjaU
- TLSH T19C43639D5E2C2221C57E283ED7E243A35B7C93DF572392623A908CF98DC206974354A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
- Size 512B
- SHA256 79fcfd3df4e1fd9c88d51c1d8461a36fbd07005d3ecd3f4038079588d082b56b
- MD5 894fbbc8aefbac7993e5c3eb7cf8eea5
- SHA1 fb473b247dbf2594a2dc24a997887b07006c7556
- SHA512 74c61e21e672b2425a906125a3cd8cfd4f1f456a887cd6724b40f1ace3d27059cae26b32206ddfacd795c7c3e42a7435f94e862f9c3126f673b63adfac22d578
- MD5 SHA1 SHA512
- Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 c03bb8a878685f83a11ac134725bf0f061eea2fc3e8613a0b06a9fe99e430469
- MD5 00fafaa3bf700a09352f6ea230a9c19f
- SHA1 827d9d81a23b474447bbc8977c1033d16db9c8c0
- SHA512 06736046b8b49d024f992eb58e4e19f5b40258e73295913077950e6beff37e22eb469c3b713a77b221cb0de637bc39df743874d8f337c948027ed7e68cbf43c3
- SSDEEP 6:7+/l9tn1qfg9bNFlEuWdkG4lWlOERX4PBX4ogLugMBX4suuKK6t:7+tMfqLiuWdQoRmBEyPbp6t
- TLSH T1FD02C0CC67800813C82F177790D4C3582D21FB2CC1B1CB2B059008943CC74CCECA0D18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 6e8108e74bb95e6af55173cd9c34744d56ab6fc3a88c0d5c7a4ad282dab04947
- MD5 106fcb2bd86ed6ac45e269d7a13749b1
- SHA1 6b906f0ad754a5372048c3a4f4deb5240cf735a9
- SHA512 9cf312862066871ca432f12075e7a97a2c82f18fb8924492beb8f780d8e7be2638ca7dba7a96dea4c46c82b8e14421c272d9fa12b2c38544bc764c9e5ec075cf
- SSDEEP 6:7+/l9oSFPg9bNFlLdvlWlOERX4PBX4ogLugMBX4suuKTPkl//w:7+tjBqLJdvloRmBEyPb2kXw
- TLSH T14202128967810913C96D67B790E983591E50AB19C263CB5B19602C6C6D466CCAC90D54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
- Size 16KB
- SHA256 4d50af04849c9e5704a49a6b3eac2d0b4942d612c53dba659646afb1ec8bef19
- MD5 1667d55bcbce8e856ce49b356f962ac3
- SHA1 f7e6f8edb5375fef7ead0663ef5668e1cdbce17d
- SHA512 59d7cdf7f302e53ad1983b70dd8aa5f47f2a254b44df0159b29d6310b0c00965616e8c9a86c9fd1305508e2d1c7f2f2855c5da1b8bfdbcd4b7d66bcbeefc0b18
- SSDEEP 12:TL1EuX9n9zmzrfRmBEyPbP/d30p/0RT/VM/QCc:TL3Xppmzr0GSP/d30SRT/a2
- TLSH T1587255CEFE209707E2774336A4CAD3D63C3071AA4773C9473E540A1C5E82605A8A2F58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
- Size 16KB
- SHA256 76a00a92536c1da0c62787802e53c7194304b993844eaf45ef9e8862b887bd83
- MD5 030e0a1f899e42252bb698abd793c54e
- SHA1 43fbe34b4a2955962a590c20fbd000fed763baa5
- SHA512 a4792919b7596e129ff94593f4bbd01eb60a808628de8bc6bb3bc5ab3d854ea1afd535131b21c86f4ea807a1692247c0e578672ce37c03c13f2b371d6ff87ed1
- SSDEEP 12:TLIET9n9zmzrfRmBEyPbP/hZt1kn+/0Fl6Bs4p/0RT/VM/QCc:TL3ppmzr0GSP/hZtunlF0SRT/a2
- TLSH T18F72598DBB10D70BE17B473264CBD7E33C34316A4723CA1639440B1C5D823829191F40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
- Size 16KB
- SHA256 1ebc90f8e26ebc575725d7475ee5f568580299ebde14b328558d87f8af6b941c
- MD5 49fa283850b6320e5f41993f3e6cf3a5
- SHA1 d7b1a5b10a30cb012fbd905a6b1146f6413fb69d
- SHA512 7a8762f36ef20e2d97e09e20ecac3c6500e4fb34119490151a9a7c534af7c6e22bc596dbff164631c2744cbef65d802457c3d59e711f8476ee878405bf88f808
- SSDEEP 24:TL6+/ppmzr0GSP/s499F61KnlF0SRT/a2:T2upArSP/F56Qn0iT
- TLSH T12C7244D9BA20D707F63B4736A0C7EBD23C3435A70B63CA1679091B1C5C8238285A1F01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
- Size 16KB
- SHA256 572c8fbb976543da8b590df85c5000358b2943285473a276524979bc38ec4635
- MD5 4c88d1d9e5bb7e7d83a400556892f50f
- SHA1 0809668889b75ab55353d9bd0c1224c8f8c47930
- SHA512 b6f913e70b28728c6ad6e752d957ed64429a3cf8b77323e7dde1a7b2fce17997420c1efab20b3ac5e2f98bc0e51b5099febc770397b417afd37662860e2f897a
- SSDEEP 24:TLXppmzr0GSP/ogKabCCb5X499F61KnlF0SRT/a2:T7pArSP/oFabCCb5I56Qn0iT
- TLSH T131726298F668D707F6BB4B3961C6EBD2383432A70B23C6127D061B1C6C8238285A1F02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
- Size 16KB
- SHA256 1af8f0163370ac04c5adfafede949cb502bbf78430f0033917648a96f663ed79
- MD5 a38c088c48d599f255fa6d9660b79e98
- SHA1 4410ff49e0476218a6c328321d4b15bfbe1a4622
- SHA512 44f96d6dbc50aa2acb1684b13188a93d83658cefecca439d0c47f7e93c2e698bfd369e63df500b1b61a07c305168490ba71b10e27e1393b17a29a17d8797ff33
- SSDEEP 6:l9bNFlgLOls1YG4l9nlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WA:TLuLKEc9n9zmzrfRmBEyPbP/WA
- TLSH T19872C28E9F102602DA6206B278CD9365BC14621D8336AA872B980460ED828499051F48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
- Size 16KB
- SHA256 dad938360bd2bdf859a85463fde106f864e8c65051eca3f3cf5eeccb62e3ed05
- MD5 8914bc73af0f9e2e1cb5a24bc1a5f6e6
- SHA1 8d64fce361fb5ee3449dd3e3a62e7b01b17eea8c
- SHA512 092e2491c6ae9ad385a929428ff8f441c3e155920d9f4670e4dcb8051b345adbdc1486b14a62920d34828869421d741ad383d1c7289aa5e9e8483e70c0883876
- SSDEEP 12:TLWuEU9n9zmzrfRmBEyPbBvOwhk/0RT/VM/QCc:TLHppmzr0GSNh/RT/a2
- TLSH T1FD72558DEF20E307E1674736E8CAE3D23D7431AA0363C60779940B5C5D8221558A1F54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db-journal
- Size 8KB
- SHA256 2ec844a0464a7c2f71b6f750925ad4a81ab2e03c35363bcd2c686b9ee8b9fb56
- MD5 a2cf280aa9fe322e83c0e873cfeeb0b5
- SHA1 2d464e973649c496ba5f627ee0e9e739007f79eb
- SHA512 55326dc9da2e0dd040b393f03c08e8ef1425b620f410a4c86b3d4e693f0d4bd0991d4b2ce981a658579b193c3434021b9f08faa787e401fc912a304a28bebaf4
- SSDEEP 24:7+tkKabCCb5X499F61KnlFvqLNlppmzr0GSa:7MhabCCb5I56QnvqbpArSa
- TLSH T1D7024798B669D712F6BB4B7960CBDAD1393976674B27EA137D460B0C7C423828062B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db-journal
- Size 512B
- SHA256 02db07644dd5afcd604961fd0ae14288de755578ab08077eeceee238bef96fe9
- MD5 cf4368dd3128e26f41a0f6d86a0107df
- SHA1 4279cedc9d49fb98af3fdc7da0b57a5205a9e9df
- SHA512 05d6e0b1b865e96f30dc9e74ee3c06194e9d016ec511c9c2615dac71d4af8c6356f83a6764b24c4ac24c26818e6d862de1251047f9369fca3e53bff78b294d48
- MD5 SHA1 SHA512
- Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db-journal
- Size 8KB
- SHA256 8bcb3238400f0b12a765672fb07c6b8a11fe6fb2ae79c904d7350f0ebe2868a9
- MD5 e32201834a1912e07b4cfa40c90b57b4
- SHA1 91ca4367f7ac251d7a3495685690219da7b60f74
- SHA512 43c22df35c7260478f053d26815d0849270b79badc5d2f93953e45b7e64aeb58d7ec869b46272270e7f58e7e248e0ac39c93804b6adee9c3a2c06be8817f8f62
- SSDEEP 6:7+/l9MFn1nZg9bNFlEuWdkG4lWlOERX4PBX4ogLugMBX4suuKy:7+tiZqLiuWdQoRmBEyPbN
- TLSH T12A02228867800C12C8293A7794D4839A4D10A718C171CBAB059008943C07ACCA8A4D08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db-journal
- Size 4KB
- SHA256 24eb9bb4734c84af3683d6ba2c32d0b16c54aa5bb00760df74062a75b1b6fc6e
- MD5 bf309c24adc8b105343f59212251a832
- SHA1 7efb586cc8448004c9bd2b62d2947efc150acce2
- SHA512 067d133667814a58cfc03446e45d3d69194a0879c1721588cb2f3565b24a05cd64743305610046bc4c33082106ef838a81a011273b6318d0daf30ad2b84f0142
- SSDEEP 6:7+/lsqFPg9bNFlLdvlWlOERX4PBX4ogLugMBX4suuKw:7+tvqLJdvloRmBEyPbb
- TLSH T17591C0CC67400803C0591B77D0C4836A3D2067188333CF07155008987C436CCEC90E04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db-journal
- Size 8KB
- SHA256 e8fc72c6494393320af32546f7d52e8e394049c481755462f32e1c373a9643f1
- MD5 0894e031360af5a4339afd1ffc407584
- SHA1 0f2cd12576dd83021d9d17f7ed9990f3f5f80e6a
- SHA512 4a21f1baac828218f4e5a8629eb92204edc07eca045c32a4cc9237365ad10ec141e4d86bd7b6a956e4506e48ee93380ff1db51ea3270de90b76caf5cb404d33c
- SSDEEP 6:7+/l9SSFPg9bNFlqhO1SllWlOERX4PBX4ogLugMBX4suuKRbkl//u:7+t8SBqLmqioRmBEyPbIbsXu
- TLSH T19502229877800C13C11916B790ECC3AB1E00E32DC162CF4709F008682C028CCAC90D44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db-journal
- Size 8KB
- SHA256 79e6cfc1cab3a5d7a0b5aa6b778d0cabe51d05b8c94749916c854be4d1be059e
- MD5 a0008d0b5ccbf6eaee7be0999efc95ab
- SHA1 960b2b40743860dc07f2fccbdb5c5c3b0727a311
- SHA512 a4347fa9397a17808a6d5d59e34a469d68fc78650aadc73aeea2ecd0cd77b91ebaa8028c5d0c157ddd0fe0fced29a5a86c21b7ee45f4fb193f57adecc2d0b825
- SSDEEP 6:7+/l9I9/pg9bNFluls1Oo9nlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuKx:7+te9RqL8Ef9n9zmzrfRmBEyPbG
- TLSH T1E002728C8F022207C22B4773B4CB83602C28A22D83779D1B2A940420AD830589051F98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.example.liquidisland/files/.com.google.firebase.crashlytics.files.v2:com.example.liquidisland/open-sessions/6AE0225A002000010D31E20A1A98075C/internal-keys
- Size 207B
- SHA256 f40634ec5202ec1d64ab55a2830766c7bbae5a7bafa8a557baffa471e4fdfb23
- MD5 42f7219de440724fba0d7ce29146ecc2
- SHA1 a6f6c9ccff4e12a1254dd1a5d235935a1b89c372
- SHA512 9c6483e3def7f4ea5f5bac4037b0562471f91659bc0e743793f50d662bc8429dddb2e0eebefad8a28e00a6d3a8ef6cbc304345078f7aa5ccbd102e0a7e9ebeeb
- TLSH T1C4D0232DF092315516F1050D5B1076541113634516B1E4DC142BCA4DFD1716D0417D18
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.example.liquidisland/files/.com.google.firebase.crashlytics.files.v2:com.example.liquidisland/open-sessions/6AE0225A002000010D31E20A1A98075C/keys
- Size 23B
- SHA256 3a9728f38aebe2363f58bb73662593a046011429c3468a0171b003e5bf3dd16d
- MD5 134a99ee5e42862e8bf923ad8e32d65b
- SHA1 43bfd168ca342a7d5e6d6dcc7cfe462cc49db10c
- SHA512 f49636d5da158df8e5a84101ea8232bfc295647181606af9b32093424aac35b0dc29a223049ed4b7d06740a6a7b3b2076e8e3b48ed5ff30a66cdebd415b0f5ac
- MD5 SHA1 SHA512
- Path /data/data/com.example.liquidisland/files/.com.google.firebase.crashlytics.files.v2:com.example.liquidisland/open-sessions/6AE0225A002000010D31E20A1A98075C/report
- Size 800B
- SHA256 6544e98348f03a4b17f492ca6c477deae7021d793a70e43f62c08904b8b1fa97
- MD5 3ed8580a89468f3fe81c1b5adfca9be4
- SHA1 2b98a065bd1657d6548157d047969a4d432616b7
- SHA512 456c9d4cd71fd12bd00d1a49921195d2007bb075d0063c17a8e7268cc85ad1f9345fc9d72f65cc3b594fa2ea6a48b9b8ba97115019eaf6681d17ad02604e14c3
- TLSH T19E01F1794ABAA67D0309C3C7C5459EB292B923649763514C68C704113ADB8ACB3063FB
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.example.liquidisland/files/PersistedInstallation6773082538801654738tmp
- Size 90B
- SHA256 45a4a64a465f0c070496e1a6f678d65c3a22363e372245e7f7137f5efb4efada
- MD5 5028f7f6aa5578d2f567ed9fe982a12e
- SHA1 7d55593ae8f79de5d96a79f974daff05f74f66fb
- SHA512 0a8cdf7e4e830e604e4cd31dd9deec75299ef6c38519cd83e28a1e55d4222113d061a0bd077d3123eb379a760694561797d1a5d102b88c637ae3060251a1691d
- TLSH T144B012644A30C1868589B2032D4DF3601D5464400989CA040A09D0E041D11E9A303A94
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.example.liquidisland/files/datastore/firebase_session_Y29tLmV4YW1wbGUubGlxdWlkaXNsYW5k_data.preferences_pb.tmp
- Size 50B
- SHA256 cb9f983df2386130ef8be4494263cbc2367e3619031fb6e80ae574b2ecca4d58
- MD5 31750b8481dee1fb216fddccb627524e
- SHA1 0d60cb30818b4752528266f389eae466b18aba6c
- SHA512 32500ecbe52df7c46f2fa4a35f43bf150e865cb10cb7cb0401c1ad67ba775757a450592a25c5be767a939be94a2197405b19151323e054822cd5ec414628293e
- TLSH T11990025126A405634686801105505005516027647A09081B5292020536429DF2015D16
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.example.liquidisland/files/profileInstalled
- Size 24B
- SHA256 419eaa494ccc97de44cab99b90d5aa36907572630f16a7e0acb45755800cf06f
- MD5 59bff57714f1743bbd3f8b27d64dddd3
- SHA1 87228c26aac38f334f49df3fb033c96905626840
- SHA512 4edc096ea373c03b4178eefb0391dd7b5483d6816e7e06b29f96ac71e919c9a8031b91fdc3f24e89672a974fe7e8b38f5acf026c8b997a303932faad5aca81c0
- MD5 SHA1 SHA512
- Path /data/data/com.example.liquidisland/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 2bde511c7e316e988bf7ef169d622564ef7a027270b8ebbf79f281fa12047f38
- MD5 533040295d8bf86032e2c1a0aed7d662
- SHA1 7dc2a8e114c705a5b377ce9071b613a8859a5042
- SHA512 5532af7993882977f048b325bf83d6c35bbb4465e41717f64f5953d2e5cd95a8429196f9e57ff3fd79142248fab9ae764d274f3fcf99c88fefe81d2c18a43e69
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.example.liquidisland/primary.prof
- Size 5KB
- SHA256 8517c38aa8a775d4f4bcf0d7ef30412aa02becf452bbc5db96603679c5412a5f
- MD5 cb25dc6dc12840d5a2a27d873787bc99
- SHA1 502395be4423c1a82b4d404071d208a9fd1e17ab
- SHA512 e70f574f1c80df325bd5916cd6809c47163b880bafe98072d8d07099f928b89e418e8f7a6cad99362d17258473f11dec7c21828a19cbafff9c9ec449d5ab6fdf
- SSDEEP 96:c1KaE3ovcfqoB7AyT1hIW4+P2qk3+yley4TBJziG99dKXkMJUEFaldE4XltsHJ1Y:haYhqy6KPiX+JvCUEw/vtspa
- TLSH T1BDB17C3E30651626EDB5DF39A2253A1F0848EF5504AE6244380FFBB7107096B24D1ACF
- MD5 SHA1 SHA512 SSDEEP TLSH