Analysis
- max time kernel
7s - max time network
152s - platform
android-13_x64 - resource
android-33-x64-arm64-20260708-en - resource tags
arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system - submitted
27/10/2026, 19:49
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
zapretdroid-experimental-1-arm64-v8a.apk
Resource
android-33-x64-arm64-20260708-en
2 signatures
150 seconds
General
- Target zapretdroid-experimental-1-arm64-v8a.apk
- Size 7.6MB
- Sample261027-yj5dsafw61
- SHA256 330c8fba6ce6594b8eaa00b521d824b6450ab685a3f9727a405a72baef73de8f
- MD5 ca475c590a83bb167490478b71ce7721
- SHA1 1cf411b73ad1c1fca3f8fa6bbc5c8c90d2ee7667
- SHA512 08856c25679b397e9443f899ebc038cf8bc4dd2f816e4bb65fee62347d4f8e1263bddfa7296f3c81fa2df6c67a23cc420f9814aed7cc252fad00185a7ff86354
- SSDEEP 196608:aS4X3NtsxT2+gZfF54JHx27+3fE/sAfEU9:F4YlFgZfF54C7iGsA8i
- TLSH T197860146F31C982FC873607ACD6943B2611A1C564F4297A37918730C69F7AD88F6EBD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /system_ext/framework/androidx.window.extensions.jar 4068 io.github.zapretdroid.debug /system_ext/framework/androidx.window.extensions.jar 4068 io.github.zapretdroid.debug /system_ext/framework/androidx.window.sidecar.jar 4068 io.github.zapretdroid.debug /system_ext/framework/androidx.window.sidecar.jar 4068 io.github.zapretdroid.debug - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 6 raw.githubusercontent.com 7 raw.githubusercontent.com
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/io.github.zapretdroid.debug/files/builtin/lists_exclude.txt.tmp
- Size 276B
- SHA256 c41d1564df33530bb6b38d70dedf760aee3503285d558ca8bda31b84db66a299
- MD5 b7d9b924ae7202f0efcef6e51b36edc9
- SHA1 3b4a21063540ed46839a664f972ba2fd5d34665c
- SHA512 ad8af25a2433b46259002063dbb5e17201ec39070d53c42c3c274b53d51be7d9fe717ebef511ae9025af46ffe09ecc230c4b4e1992bd263fbe37a79a7e375ec0
- TLSH T17DD02BBAEFB13A0222E94C31712AFF5450349618D61855D45EFC6360256754CD31687F
- MD5 SHA1 SHA512 TLSH
- Path /data/data/io.github.zapretdroid.debug/files/builtin/lists_proxy.txt.tmp
- Size 564B
- SHA256 cfbbc6fadf03ebab0fe91b47e108dd2470a96e11cc98846429a29933e2bdc8ff
- MD5 62ddc8f7b1f9e709d1c4cca67b366e51
- SHA1 e74f42ea34835e59759a7e8b3d72fbdfcda1ba20
- SHA512 2a17c59507e84aee6450c009af1f754ecc5cfdd76ab231c3cb86c799b1da03ee71d7421ec1a1f9ba91fa8736f0cc161d7403468f61c1364ecb5d9233618b6de2
- TLSH T1C7F08B87760B53B3AB90D5306C6AD47E7610932A8129F1E1EAA8706590E17A48AC73F4
- MD5 SHA1 SHA512 TLSH
- Path /data/data/io.github.zapretdroid.debug/files/builtin/lists_telegram.txt.tmp
- Size 176B
- SHA256 68b3295eed275dc14ad67853095c8636d26d01740c22f5446d326207d6ea1313
- MD5 8c65d8d2c732083c70b9fd1625b44d0a
- SHA1 da7d2cde3fe26dbba1bd339d96a705b4e5a55c60
- SHA512 9074cda931f0f57d128c7b59bc8479ce8479f26f59e822ad517f734ed2c58d833700f28235eb22f48f64e53175a2ef0147f598a0483f7be760a21812b0e7a34b
- TLSH T1F1C012046B2A0A823342987B2B59F0D5C304FA08A53CF08888A808F3C120E84D276A7B
- MD5 SHA1 SHA512 TLSH
- Path /data/data/io.github.zapretdroid.debug/files/logs/app.log
- Size 125B
- SHA256 aedf8384bd0c19c028780603d3a512e0460129484d414397b365f54ddee51667
- MD5 3f9b98e1f5c7714c735cbc93e23c99f8
- SHA1 b5bcc65b0a4ad84888987ceae596370e26f9d711
- SHA512 02d1cb9e5e498a6d7b0639ee899adb0c4b9301629a3864133c6f0cf471f4e99c371347f9d31bd6729897c203948cd9ac013bb443c265a78217f26751ca945498
- TLSH T1D0B02B108313720F37E69217B159431F09444C38504852108811D0641F1102244D0E90
- MD5 SHA1 SHA512 TLSH
- Path /data/data/io.github.zapretdroid.debug/files/logs/app.log
- Size 35B
- SHA256 87500cc19583a81a0094379b8c39b1448dfc7530217777519337c0a329272101
- MD5 22bd9459117b636dd573c3eb50d3eb51
- SHA1 38498f36566439e476fb18afc0735348f3e5dd38
- SHA512 89251ea969a183a614a33bd4f7a5330b8b4ef0eaea8e186716b3da695a4048f6253359e08652335d471560bfb1f9cb14e0fbf1dcc5a9a3d346766bebf7dc2cfe
- MD5 SHA1 SHA512
- Path /data/data/io.github.zapretdroid.debug/files/logs/app.log
- Size 37B
- SHA256 42258d9163e5f5c27ae9381098408ceb1b2e260b900902044daf0e9498758d95
- MD5 d7dff64357965601feb5f30ade0200ca
- SHA1 a64534d05ef8046de579be6e2021a53e9ae6a8d1
- SHA512 e61eee56185fbb5f63b856cb1b348e4d43382f8402a8d766342940b9473004f39ea170d3ba06b8d226479f066fdb1e02b84e49628ce469dfd6a1f3f6c2a321a6
- MD5 SHA1 SHA512
- Path /data/data/io.github.zapretdroid.debug/files/logs/app.log
- Size 354B
- SHA256 17f0a46b54fa7d98923fc5a7b00449a7d4921c9d2bcd26e0ff028fae8be3965c
- MD5 76f99b5d00be9381e651a5ddc7fa37d2
- SHA1 00eb9b7ae2614dcca7998962615b1bf3b7a484cc
- SHA512 994280113db5c6c0354972260a0c802dd2da9761fbd6d9af0dea9b61c982cdd82989c41d3e8b567e25cb1aa880160a10042ed38bfe3b6c154bcf25769a7f1b07
- TLSH T133E0481DDE95456D51C81C725B64F453FB2BE83E2024557236BE23C34D0647B216D1D2
- MD5 SHA1 SHA512 TLSH
- Path /data/data/io.github.zapretdroid.debug/files/profileInstalled
- Size 24B
- SHA256 4ecb9d98a87caefeb19e876531e4d9a4bd6d898e99f2193cafae7591b82007d6
- MD5 8d9533f75f4b531bd398b9f5f891688e
- SHA1 702c2c42a4d91ac5d39b379de7659742d4d32898
- SHA512 8dd44f2ad9740019f181af950fc6e34bdcef6acc5e4ab5766afe11b305119e65dde26b5661c6ba8142df8adca8d1cbbf72543d6373cfb5d80ef40d5363657f8e
- MD5 SHA1 SHA512
- Path /system_ext/framework/androidx.window.extensions.jar
- Size 123KB
- SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
- MD5 3056e1bdb7d4e19789d0319eff484bd0
- SHA1 6791ae47aa9466fe0bca27ad6643f846853bbee4
- SHA512 c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658
- SSDEEP 3072:8Pmsa8v0v8FYNMhpjLXZ/pziNQdysk4p26PQ:Qmsa8vXhRLXXOQGJ
- TLSH T19DC31951FA4159A1DEAE933B959B1301AB30A648AB2383137654D0BCFCD73C39F87AD4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /system_ext/framework/androidx.window.sidecar.jar
- Size 25KB
- SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
- MD5 29469324e59dfcc052f24b5af4e7b2c4
- SHA1 10c1e17ac6f598037bb51baa07945663645de4eb
- SHA512 5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2
- SSDEEP 768:bjydnTmp8WNAupUuvkg5NrtsESOMXIpc3dRwQA0:bjydCpF0uhtsxOQIqdSj0
- TLSH T1A5C2F716E7400C63E9FF9A3B6A5B13009F35E3A4AA43471B640585A4BDC63D3D9EE7C8
- MD5 SHA1 SHA512 SSDEEP TLSH