Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
- submitted
27/10/2026, 09:24
General
- Target 01227a8b5dca01ecac7177051e6d2a3cf5e12ce7ca9cbb06040d8bcb9cfcc6a2.apk
- Size 4.8MB
- Sample261027-lda7jaby9v
- SHA256 01227a8b5dca01ecac7177051e6d2a3cf5e12ce7ca9cbb06040d8bcb9cfcc6a2
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 9 IoCs
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
- Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
- Reads the content of outgoing SMS messages. 1 TTPs 1 IoCs
- Reads the content of the call log. 1 TTPs 1 IoCs
- Acquires the wake lock 1 IoCs
- Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Reads device software version 1 TTPs 1 IoCs
Uses Android APIs to read software version number for the device (IMEI/SV for GSM devices).
- Reads information about phone network operator. 1 TTPs
- Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.batch.android.runtime1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the content of SMS inbox messages.
- Reads the content of outgoing SMS messages.
- Reads the content of the call log.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Reads device software version
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
-
com.batch.android.runtime:watchdog1⤵
- Makes use of the framework's foreground persistence service
-
com.batch.android.runtime:watchdog1⤵
Network
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Discovery
System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
PersistedInstallation6713019355834778950tmp
PersistedInstallation7298143696462952082tmp
frc_1:651390976306:android:75b2e2d669a5b3936f972b_firebase_defaults.json
frc_1:651390976306:android:75b2e2d669a5b3936f972b_firebase_fetch.json
frc_1:651390976306:android:75b2e2d669a5b3936f972b_firebase_fetch.json
profileInstalled
profileinstaller_profileWrittenFor_lastUpdateTime.dat
androidx.work.workdb
androidx.work.workdb-journal
androidx.work.workdb-shm
androidx.work.workdb-wal
androidx.work.workdb-wal
androidx.work.workdb-wal
primary.prof
primary.prof