Analysis

  • max time kernel
    7s
  • max time network
    152s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260708-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
  • submitted
    27/10/2026, 19:49

General

  • Target
    zapretdroid-experimental-1-arm64-v8a.apk
  • Size 7.6MB
  • Sample261027-yj5dsafw61
  • SHA256 330c8fba6ce6594b8eaa00b521d824b6450ab685a3f9727a405a72baef73de8f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Processes

  • io.github.zapretdroid.debug
    1⤵
    • Loads dropped Dex/Jar
    PID:4068

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        lists_exclude.txt.tmp

        • Path /data/data/io.github.zapretdroid.debug/files/builtin/lists_exclude.txt.tmp
        • Size 276B
        • SHA256 c41d1564df33530bb6b38d70dedf760aee3503285d558ca8bda31b84db66a299
        • MD5 SHA1 SHA512 TLSH

        lists_proxy.txt.tmp

        • Path /data/data/io.github.zapretdroid.debug/files/builtin/lists_proxy.txt.tmp
        • Size 564B
        • SHA256 cfbbc6fadf03ebab0fe91b47e108dd2470a96e11cc98846429a29933e2bdc8ff
        • MD5 SHA1 SHA512 TLSH

        lists_telegram.txt.tmp

        • Path /data/data/io.github.zapretdroid.debug/files/builtin/lists_telegram.txt.tmp
        • Size 176B
        • SHA256 68b3295eed275dc14ad67853095c8636d26d01740c22f5446d326207d6ea1313
        • MD5 SHA1 SHA512 TLSH

        app.log

        • Path /data/data/io.github.zapretdroid.debug/files/logs/app.log
        • Size 125B
        • SHA256 aedf8384bd0c19c028780603d3a512e0460129484d414397b365f54ddee51667
        • MD5 SHA1 SHA512 TLSH

        app.log

        • Path /data/data/io.github.zapretdroid.debug/files/logs/app.log
        • Size 35B
        • SHA256 87500cc19583a81a0094379b8c39b1448dfc7530217777519337c0a329272101
        • MD5 SHA1 SHA512

        app.log

        • Path /data/data/io.github.zapretdroid.debug/files/logs/app.log
        • Size 37B
        • SHA256 42258d9163e5f5c27ae9381098408ceb1b2e260b900902044daf0e9498758d95
        • MD5 SHA1 SHA512

        app.log

        • Path /data/data/io.github.zapretdroid.debug/files/logs/app.log
        • Size 354B
        • SHA256 17f0a46b54fa7d98923fc5a7b00449a7d4921c9d2bcd26e0ff028fae8be3965c
        • MD5 SHA1 SHA512 TLSH

        profileInstalled

        • Path /data/data/io.github.zapretdroid.debug/files/profileInstalled
        • Size 24B
        • SHA256 4ecb9d98a87caefeb19e876531e4d9a4bd6d898e99f2193cafae7591b82007d6
        • MD5 SHA1 SHA512

        androidx.window.extensions.jar

        • Path /system_ext/framework/androidx.window.extensions.jar
        • Size 123KB
        • SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.window.sidecar.jar

        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 25KB
        • SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH