6be6b7d3dfadca8944a7e69e3dfbd19cba7cf13546ea54e0df3769c6f993d7c2 | Triage™

Analysis

max time kernel
37s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
30/10/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DuoRemotes.apk
Size 5.6MB
Sample261030-peatyaed96
SHA256 6be6b7d3dfadca8944a7e69e3dfbd19cba7cf13546ea54e0df3769c6f993d7c2
MD5 d620a52937ff049663eab5436f9750e6
SHA1 62c6127db7a2ebf8b64a5ff319b58f148acf134c
SHA512 3a0950c9be6f34af1cf41807d5da173b0b9e064da128267c25e8335c67feffed97c33bc90049e0a1189b96d5872693af374e12f0f3380cada6e63ae09d1a5319
SSDEEP 98304:0eqNpOwkLSVzqP0fPIcuvtiuzfbnbb1lrTZ5LR:1CpbkFMfQcXuf/fZpR
TLSH
T15E56BF0AE5118E63C86C933A59B79395B3315C93AA87431B1405B5BCBF771F227CA3B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery evasion execution persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

Download New Code at Runtime

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4700	com.raniophir.duoremotes
/system_ext/framework/androidx.window.sidecar.jar	4700	com.raniophir.duoremotes

Queries information about active data network 1 TTPs 1 IoCs

System Network Connections Discovery

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.raniophir.duoremotes

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.raniophir.duoremotes

com.raniophir.duoremotes
1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4700

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Credential Access

Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.raniophir.duoremotes/databases/com.google.android.datatransport.events
Size 56KB
SHA256 d97dacc477546b6a9fdccd1e2120e16df3b2f2e6d9f6631652eb9d101811b41d
MD5 d54a519bfa16bb0b47d7f00b6a33bf64
SHA1 71b6e65aed333c99a22608fc8fad28b938b0ef7a
SHA512 aeb6f05a13830968d5cbf00c30f55d0029f35ff3f6ec3bede968f76a0dc1cd39ec595e9a5f33bf532515375d7620fcfbf2a82c6357f4a146b230684dde7a05f3
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSyzoyFv4F/:rAMEX0wIyNja9
TLSH
T15B43549D9B3C2210C5AD243ED3E143A35B3CD3DF971693623994ACF98DC20697825D79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.raniophir.duoremotes/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 6c20b52166b18519fec7a0f06330a6b525a5584c55685d09cfcfc6a664122cbb
MD5 0412389d268c4f9b04d907ec1b338a16
SHA1 b878d768b9f188d4c6e1d7bc5777f5378bdde3cb
SHA512 c66ec1d5623f5b393281f0287661bc2e6e9e7ad03960e2cf65d7b248eb77fe71819e9b98c96fb50263a15c469cf1d7dbaf2f56ac39a014ecaf71351f52e8b912
SSDEEP 48:7MrxFAqv3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPS+VwqtB3g59MENZBdUdnN:7ZEAMEX0wIyNjazUAMEX0wIyNjaR
TLSH
T13B92539D6A3C2211C5BE283ED3E24393593C93DF572391703E948DEECDC246AB0255A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.raniophir.duoremotes/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 8ce006532d5c7059de6106e8f27a460fa1afac0ed02e501b69a9badb65920f11
MD5 06bb51c20537c00a14864495c430d8d5
SHA1 cbd808009e9643464956e1fb165f41afabb66d27
SHA512 264f4ec5c6899d2987d108c1c63c6c848f25f966c7ec4d6c43b4484bafb9c8ce303ed8b368b9c1be6d8abfc547a0ad727dcbf2dd64c4a007d04ea3f0a465d025
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.raniophir.duoremotes/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 8a390c36f6c1a60f7e8523ee11baeae537e1328838461eb5ffb42dfdcd41897d
MD5 7dc789554031cfdb4a918da1766974f9
SHA1 2e63069ce16b87d3a035b20864adc0f5d2fc57ba
SHA512 4fcb66127f8874a3fd2c95a9fe86179f8788212bd61fc24ed5aecfc03bc2095796acb97a14599814aeb9eb9fd479373ecf14c15fb3e955821b5a3f2aa88169dd
SSDEEP 6:7+/l9Wn1Rg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKsP:7+tIqLiuWdYRmBEyPbd
TLSH
T14202C0AC67800813C82D577F90D583F00D40E728997DCB971AB008B47C4B4CCF4A0E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.raniophir.duoremotes/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 b6969ab1a0fb8e701bf6ef72a2878fe160f2228933f64eb05da0fbdc62a61471
MD5 3b368c2ff17582c2dd3512ad070e0e52
SHA1 5878bff7a3c92d4acfed100d4e32440f8f4e4c63
SHA512 6def4c0c669cf7bcd5556bb7b6a898b5971796a78d45f16d77d6000cf5b12556a8ebac0b5ead27397227190b92caf9f53dcf4762747ff61ef30a9de974bcd6ee
SSDEEP 6:7+/l9jGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK/6C/z:7+twqLJdeWRmBEyPbNSz
TLSH
T119022288A3420813C02D177BA0C8C3442E2CAB29A327CB0726E108542C466CCA890D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.raniophir.duoremotes/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 d2847f27703caf16a17be6b21297d31283b7f81fa6762760ee0c380b3a21d2f4
MD5 09c31187499fabd3a274a13a5325ea0c
SHA1 a00a569e6b67ecb369f04832e8b12e5b556338f0
SHA512 8b78f421937c2923135738485cacf8978776ceb19fa127829fe478894b3990df3afb113cf47baba86748c0eecd9f32457fed680670a687539ddde5bb57153939
SSDEEP 48:7McNRq/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSf:7pR0AMEX0wIyNjaf
TLSH
T1EAB2615D1D3C2221C5BE283EE7E10353593C53DF572391703EA4ACEACDC25AAB0354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.raniophir.duoremotes/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 dc377676fee8f908db3f96f2ac0d2f50e098127c2c2bc89f347b13d7ac0a8458
MD5 777fffb62f12ba1c860f00e3b7dbf353
SHA1 1c8293d3ec29c40e4708140a3d0b990385e3a5b8
SHA512 b26e93b42c0d7d55c0fda1bc5ba598c0e9527878995f86a5032e1ee352c3e0ab99fa2e28621f9505e35f5347a2f026c6a5637c5db61fedf27d32568b3980311a
SSDEEP 48:7MpB+3NW0YpZCw0v+W6QWUZqP3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSA:7oBuxYCbGpykAMEX0wIyNjaA
TLSH
T11372A45E6C3C2212C5BE693EEBD20253593C53DF5713A1343ED44DEA8CC2069B0354AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity.json.tmp

Path /data/data/com.raniophir.duoremotes/files/RemoteConnectViewer/identity.json.tmp
Size 162B
SHA256 428791a733e25a39d7406916e3c4ad4bce2402856dcd27605008204fac2c66ee
MD5 0e390821fee34dc8d249e6276090ea99
SHA1 4c7510a30a4458af8c5ef3ef46d037c77b60d22a
SHA512 cdaeb106c4fbf0c66012f288f5fbeac1f8369eebe5698dd8cf2742041aee9b10b23b2ca861824a511a7325e41645f806d5d0b4ebd8bb54fbbbb64ccc25a1f6cb
TLSH
T1D6C08C081B324BA882907B2A0828291A441FA1E5BEA12CA95F42D72CB58C52DA732011
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.raniophir.duoremotes/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 1ba0f892250f2aaf44407e59b1d65b159f9d96fa5d23db91d6a5d1152aa62389
MD5 192dc24030d761644f9861d706ba296c
SHA1 d4f66c9a7f4a3a912de2b3872b34d77cde63089b
SHA512 b4c5f14b621e74be3fe031ce45942b15be31dfd2702d3464b25df87d6cbfa33eee4bba027bab7e5762f0e778a60b2d188b68e1de2949e4bbd3cd2814be314e9a
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.raniophir.duoremotes/primary.prof
Size 7KB
SHA256 879aecdc847be933110a39534d65039bab257bd74ab31ebc0ec1d1d0732837b6
MD5 091a8efe5651f36fc14d71f8edf4c997
SHA1 1c53474b056c501cfc59e54b708750a4be96b651
SHA512 cd5c5532723ba8e07ef46b0f8cf4c0d8e1b5c16a52fd359d922203b30dbe41ae4b5f460988fce116857b29f4e4d802b720342b37515c404cfca47ca6a142df77
SSDEEP 192:uQywB6bNjJeXLHOZ3Ief4ctvxUYOylez11m0vQnrz:uQywv7OZ4eQctvQylsmQAz
TLSH
T1FFF1BF7F62B5415BD995B6C252982D97CA30B5230BC9136B4826EFF3F849223219BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download