Analysis

  • max time kernel
    126s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    27/10/2026, 06:20

General

  • Target
    f1759188be14188092dffc38be84c8a1a2d8facd88c2ad6dd14df1739668aa78.apk
  • Size 92.9MB
  • Sample261027-g3rtcs1zes
  • SHA256 f1759188be14188092dffc38be84c8a1a2d8facd88c2ad6dd14df1739668aa78
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.pt.bark
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4715

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        environment.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/environment.json
        • Size 12B
        • SHA256 80be2eb0944c0453a6ad339a56e1c8f39f8cc57a4e627758246ccfd274176fd8
        • MD5 SHA1 SHA512

        release.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/release.json
        • Size 24B
        • SHA256 10b4c54e2ef923782efcc8369b8ab40e0a134607a71d151ac0995010ccb283ed
        • MD5 SHA1 SHA512

        sdk-version.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/sdk-version.json
        • Size 591B
        • SHA256 8d3e45cfc87a0bf4ea41861062f369eb45b3c8c665bc7dcafd466bd6a956d2b3
        • MD5 SHA1 SHA512 TLSH

        tags.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.options-cache/tags.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512

        breadcrumbs.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json
        • Size 4KB
        • SHA256 563e7b72bf015e625edb688249a7acc78041b30fa8f2a4b55470806880120101
        • MD5 SHA1 SHA512 TLSH

        breadcrumbs.json.tmp

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/breadcrumbs.json.tmp
        • Size 12B
        • SHA256 ae1afdb53fc94d62b6862659f839a20634382b65a7354f32b5e81cd29fb4270d
        • MD5 SHA1 SHA512

        contexts.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/contexts.json
        • Size 62B
        • SHA256 01870d5d7b208dcf75df9c13c2f8c636dd5b711abfd33f4f424fd3808d753cc1
        • MD5 SHA1 SHA512 TLSH

        contexts.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/contexts.json
        • Size 63B
        • SHA256 dda403ea3f2dc79793e354552c63edfb2be6a7676df6d0ecdd02a12055fcdad8
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 743cfe1fefcd4417dffaf289ab986e71c3f737e7aa1b75f0370c7ac42ffa195c
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 188B
        • SHA256 14f6c1c983a919087059dd2064310e77e0878debcf94b6bcecf27ec78c86c1db
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/trace.json
        • Size 168B
        • SHA256 bad59c8e98667b06263d611ea6c3f93942984c79ee04f97cfd6b3a3fb56280bb
        • MD5 SHA1 SHA512 TLSH

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 18B
        • SHA256 96f7a5db03a7c5ec7847b1ca053fa92d19552fe07cf22a21a004e4aabed4a95c
        • MD5 SHA1 SHA512

        transaction.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.scope-cache/transaction.json
        • Size 16B
        • SHA256 96c4b7db81f09c9990c9e856e2d350b49f8ca5e0657620be9a6632cc3d7aaf1c
        • MD5 SHA1 SHA512

        installation_id

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/.sentry-native/installation_id
        • Size 70B
        • SHA256 9f7e75828b51b4de4b93adfb3b1a84b9d9717fb212570164ad7be14a239adc36
        • MD5 SHA1 SHA512 TLSH

        3f2d6947523e46dbadb3428a7b936d9c.envelope

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/3f2d6947523e46dbadb3428a7b936d9c.envelope
        • Size 935B
        • SHA256 7ae9a05dd15f4aada49d85fa576ca3c37f6662b1a238ec9ee1d56470a32af744
        • MD5 SHA1 SHA512 TLSH

        session.json

        • Path /data/data/com.pt.bark/cache/sentry/5f918643f75665157cca0fd7138d9f8a468802da/session.json
        • Size 268B
        • SHA256 e5a9cf6cc74b17bfb5da6ead5809d62277d9ec8f6ee9aff5fdcafa5480c3ee88
        • MD5 SHA1 SHA512 TLSH

        OneSignal.db

        • Path /data/data/com.pt.bark/databases/OneSignal.db
        • Size 52KB
        • SHA256 491c9687657ca71661a5cf42a763249f88fa222edaef20eaf552c4599458f99e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 4bc224c6317c5f932dd9c200dbaa043642eef1e5a6d4ae164cb111964a0203d3
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 61206bf2ce879279a5c9c19b995172af6ece358c87ae12717a06c9a850883bdd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/com.pt.bark/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 ed3798ed09d84e435973cce2b490d5c7dce3577d33fb0eadb6d6ca776c6800de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 b5042d3324f23d34b2797985174e190f46aa0628a2be78f7c253e4aa13310ab1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 a57bae12d482dedaa86aaa6ed03e251f400841bc55b258ec11cc14e2435c2e4e
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 0b6b2f086a9d170c595cf1e26e33ae4f0fa6416d91a89358571c028bf729dca7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.pt.bark/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 a9f883e3db43d6b292b233f3de96cb5bb4c53bc04f66a29f7350973eef658e38
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INSTALLATION

        • Path /data/data/com.pt.bark/files/INSTALLATION
        • Size 32B
        • SHA256 e639b7e8fa537ba7832b64071ea67d897302390294324e496eaf8c7b4a9e56c0
        • MD5 SHA1 SHA512

        PersistedInstallation204895221946347393tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation204895221946347393tmp
        • Size 570B
        • SHA256 81d36344437d242190c37c4b1da09a028008f1a4bdee8fe05c0ce57ab40d7899
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation2914777419281286192tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation2914777419281286192tmp
        • Size 569B
        • SHA256 afd740d5259441e3496508e62eee413a4fa0c47670b93ebd828121721ca5dd2d
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation4653471480461691963tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation4653471480461691963tmp
        • Size 90B
        • SHA256 de46057351ed16e71e3e438cd5f7e89eec6b6fc61347571d91ab5918e523b544
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation5491953157189174596tmp

        • Path /data/data/com.pt.bark/files/PersistedInstallation5491953157189174596tmp
        • Size 90B
        • SHA256 73823d73423713778351895d936118a980dd6c653424d18719831dac4b47f026
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.pt.bark/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 f7fb7edb0b0d4b027c24c58569afbfbafa86681e3372566b6d703696efd8dbc6
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb
        • Size 100KB
        • SHA256 10400145fc4c70cfe6244ca348f6e4a30a5ef38c2564d03d4152b4191213917f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 cbc98920f0915b2781c706461f58869285b8512a60d48800e0b95d18998fe249
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 d87d6efa37e1eae9741c0df0bc04339f8b553c113c6ee0a6ebfeb6c383c0f28b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 76e03be18843dcd03f41525a982120f99d44b162a0ed393ae61db33181c5bf6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.pt.bark/no_backup/androidx.work.workdb-wal
        • Size 410KB
        • SHA256 624a7f9e54017a0c1a84590e0b99fcc091cba20d1bfa33e4433aef7e356293a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 1KB
        • SHA256 b23720c3c8def07f6118309eafeaf4491704a2d1160ea6cefc2e242d7f558c2a
        • MD5 SHA1 SHA512 TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.pt.bark/primary.prof
        • Size 14KB
        • SHA256 f8498bf7b230b28dc9350e3939fc1c9a532b2492ff91c0275c87635dbd6ff46e
        • MD5 SHA1 SHA512 SSDEEP TLSH