Analysis
- user interaction
yes - max time kernel
149s - max time network
154s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
- submitted
02/11/2026, 23:20
General
- Target 7d44e0009d251ae4983f5bf29f7d8aa9af668df88dba05a17a7a314f6780ceff.apk
- Size 47.8MB
- Sample261102-3bkfvsfz5k
- SHA256 7d44e0009d251ae4983f5bf29f7d8aa9af668df88dba05a17a7a314f6780ceff
Score
7/10
Malware Config
Signatures
- Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
- Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Reads the contacts stored on the device. 1 TTPs 2 IoCs
- Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
Processes
-
org.telegram.messenger1⤵
- Checks known Qemu pipes.
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
PersistedInstallation2829886281003450004tmp
PersistedInstallation474102934299354700tmp
stats2.dat
stats2.dat
stats2.dat
bluebubbles.attheme
profileinstaller_profileWrittenFor_lastUpdateTime.dat
remote_en.xml
stats2.dat
mainconfig.xml
mainconfig1.xml
primary.prof
primary.prof
000000000_999999_temp.f
anon_inode:[eventfd]