Overview

overview

8

Static

static

6

01227a8b5d...a2.apk

android-9-x86

7

01227a8b5d...a2.apk

android-10-x64

8

01227a8b5d...a2.apk

android-11-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    153s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    27/10/2026, 09:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    01227a8b5dca01ecac7177051e6d2a3cf5e12ce7ca9cbb06040d8bcb9cfcc6a2.apk
  • Size 4.8MB
  • Sample261027-lda7jaby9v
  • SHA256 01227a8b5dca01ecac7177051e6d2a3cf5e12ce7ca9cbb06040d8bcb9cfcc6a2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
collectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
    defense_evasion
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
    collection
  • Reads the content of outgoing SMS messages. 1 TTPs 1 IoCs
    collection
  • Reads the content of the call log. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads device software version 1 TTPs 1 IoCs

    Uses Android APIs to read software version number for the device (IMEI/SV for GSM devices).

    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Checks the presence of a debugger
    defense_evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.batch.android.runtime
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Reads the content of SMS inbox messages.
    • Reads the content of outgoing SMS messages.
    • Reads the content of the call log.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Reads device software version
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4801
  • com.batch.android.runtime:watchdog
    1⤵
    • Makes use of the framework's foreground persistence service
    PID:4886

Network

        MITRE ATT&CK Mobile v16

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1603

        Persistence

        Foreground Persistence

        1
        T1541

        Scheduled Task/Job

        1
        T1603

        Privilege Escalation

        Defense Evasion

        Download New Code at Runtime

        1
        T1407

        Foreground Persistence

        1
        T1541

        Hide Artifacts

        1
        T1628

        User Evasion

        1
        T1628.002

        Input Injection

        1
        T1516

        Credential Access

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Discovery

        System Information Discovery

        2
        T1426

        System Network Configuration Discovery

        3
        T1422

        System Network Connections Discovery

        1
        T1421

        Lateral Movement

        Collection

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Protected User Data

        3
        T1636

        Call Log

        1
        T1636.002

        SMS Messages

        2
        T1636.004

        Screen Capture

        1
        T1513

        Command and Control

        Exfiltration

        Impact

        Data Encrypted for Impact

        1
        T1471

        Input Injection

        1
        T1516

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        primary.prof
        • Path /data/misc/profiles/cur/0/com.batch.android.runtime/primary.prof
        • Size 6KB
        • SHA256 26fc2834832256be17feb472ef427b83aa8e608aa70ddcca4e9ce787b220b6d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        primary.prof
        • Path /data/misc/profiles/cur/0/com.batch.android.runtime/primary.prof
        • Size 15KB
        • SHA256 f105e708a2b1c4adf06059dd89109f4936ee3f43402376e96ac39c4108550664
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        [email protected]
        • Path /data/user/0/com.batch.android.runtime/[email protected]
        • Size 88KB
        • SHA256 915539838cf16d91332e5b61337645ca0c9dc012c5bca1fdc2a92892b4a1ceaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        google_app_measurement_local.db
        • Path /data/user/0/com.batch.android.runtime/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 103b847d86d5e1f4dc7d867f9c41d25390dbdf39425fa0fe9ecf2c98f4205ebc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/user/0/com.batch.android.runtime/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 ecbafada84be29c1672c13152a88556a0379a21516b5299c0122eded470bb193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/user/0/com.batch.android.runtime/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 9f635e06037cb62a29d30ec73de7814c8878b169df224f3093be534a284f2b98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/user/0/com.batch.android.runtime/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 c37c24e5e89662c8894a32d71a17ceeff07d6f5fc23aade6bfe35ebfec67ff9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/user/0/com.batch.android.runtime/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 6408d6a5c31f5b54b2da93c25e8cfba3a8116c5b664476f5ebc9db7602e4632c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/user/0/com.batch.android.runtime/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 c72de32d8750fd5c64a052fa142eb9dff5bbd67268c766919404cad0b3cef9d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/user/0/com.batch.android.runtime/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 9840879077ff07af748d4502ca94f40c3402f995c3ad51aa64e5f5fa4280e591
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/user/0/com.batch.android.runtime/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 43295a21b398935b588fb3262097d9b164c96bec03ae014508bde3eb771ff6fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/user/0/com.batch.android.runtime/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 0fe4c75082ce3c4cd704ee07c3afa71a613278f4e3ce680b45b86e42c4dcb945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/user/0/com.batch.android.runtime/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 0d457215789f0878c425c1efa17f7eeb8aa9a7e1ec231a7ead903b8557bfca8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/user/0/com.batch.android.runtime/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 65e1fcbac50792bf8ef23f6b9742e2181ae19eb8a65cd9b265249e98ddf8d1d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/user/0/com.batch.android.runtime/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 740a17f61263b5123a3599403a23e3dc6cd4e5fe09d82e19b42c0a85a98698bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PersistedInstallation5866947575230350641tmp
        • Path /data/user/0/com.batch.android.runtime/files/PersistedInstallation5866947575230350641tmp
        • Size 90B
        • SHA256 3e3f021af82c0b1ed131584d72814ecd08285fe2525419ddb34e92d8f5f6dbd8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        frc_1:651390976306:android:75b2e2d669a5b3936f972b_firebase_defaults.json
        • Path /data/user/0/com.batch.android.runtime/files/frc_1:651390976306:android:75b2e2d669a5b3936f972b_firebase_defaults.json
        • Size 2KB
        • SHA256 53b37c9bb39e0177583cc4dce2a05f0ed368334a4eb07db4bab1764459f6e77b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Path /data/user/0/com.batch.android.runtime/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 d533949fb6bf6c190cbf9c269ab8984fd5476a294ae1ef3ef82da417aa31abbf
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb
        • Path /data/user/0/com.batch.android.runtime/no_backup/androidx.work.workdb
        • Size 104KB
        • SHA256 578c5c0a95719bf9588fea9820b135a4a0293183ae9190484b46e0ac1ad58d2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-journal
        • Path /data/user/0/com.batch.android.runtime/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 6751065726383c926c1ef0de8d123fb41656c2515cf324f00f21c43a24146acb
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/user/0/com.batch.android.runtime/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/user/0/com.batch.android.runtime/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 ba082f9e613c59e1c9d1ab39578a766883e896f42919c6ce2941da852ffe1ca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/user/0/com.batch.android.runtime/no_backup/androidx.work.workdb-wal
        • Size 426KB
        • SHA256 8b4d04d4942372af3ec15e90fc313899e39bf357ef1f0f68a9884d62c42ea2ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/user/0/com.batch.android.runtime/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 e142ae976055344b34ec0490a72766eb810d488f9d615b7e95f41cf3ae7e862b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        [email protected]
        • Path /data/user/0/com.batch.android.runtime/oat/x86_64/[email protected]
        • Size 406B
        • SHA256 cc4704f31824829046971b67d3387fffb7220cfd77a8f5c6766a2d23bb161346
        • MD5 SHA1 SHA512 TLSH
        Submit Download