Analysis

  • max time kernel
    127s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    02/11/2026, 16:49

General

  • Target
    NovaTune-1.2.9-foss-debug.apk
  • Size 21.8MB
  • Sample261102-vb22xabw21
  • SHA256 972be5e2de5f99765cc2433a907a9f7bbaa9a1dd6149095544618fd00f71ed1a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs

Processes

  • com.agastyatomar.aaditune.debug
    1⤵
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    PID:4772

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        05ef7f8fbf56e1a1a0e1317c92718faa932800098e3df24efc2c9981dbb20b54.0.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/05ef7f8fbf56e1a1a0e1317c92718faa932800098e3df24efc2c9981dbb20b54.0.tmp
        • Size 555B
        • SHA256 3f05f37a6de971d9f4acdba8c0217dc43b55c2ea731d535886ca9e539eef5142
        • MD5 SHA1 SHA512 TLSH

        05ef7f8fbf56e1a1a0e1317c92718faa932800098e3df24efc2c9981dbb20b54.1.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/05ef7f8fbf56e1a1a0e1317c92718faa932800098e3df24efc2c9981dbb20b54.1.tmp
        • Size 64KB
        • SHA256 4eab269f717ea9e290df0522a8d4598ba8dc918aee372e7a28301aabbc275c96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        11232e7ca4c7744b5d272bf7e7d4e1db8195ca9390cadb223b1071a974b384c7.0.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/11232e7ca4c7744b5d272bf7e7d4e1db8195ca9390cadb223b1071a974b384c7.0.tmp
        • Size 555B
        • SHA256 b93a04317c34a574bcca60fc8c4d8ed5856fcd0ba27ad27ef44f0bf53e67c377
        • MD5 SHA1 SHA512 TLSH

        11232e7ca4c7744b5d272bf7e7d4e1db8195ca9390cadb223b1071a974b384c7.1.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/11232e7ca4c7744b5d272bf7e7d4e1db8195ca9390cadb223b1071a974b384c7.1.tmp
        • Size 65KB
        • SHA256 3cbe44353de3c2c38972119ad5c4f873f97d74c7e75a3f2fa1790fab3d03da58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2ae5e8916e1d7f0190227dfd988ab8c49cf4809a3e229164052725564378b33b.0.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/2ae5e8916e1d7f0190227dfd988ab8c49cf4809a3e229164052725564378b33b.0.tmp
        • Size 555B
        • SHA256 f19124567363db8209146f496618c55a38928bb4df5fe17ba6bc47ce2edf50fc
        • MD5 SHA1 SHA512 TLSH

        2ae5e8916e1d7f0190227dfd988ab8c49cf4809a3e229164052725564378b33b.1.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/2ae5e8916e1d7f0190227dfd988ab8c49cf4809a3e229164052725564378b33b.1.tmp
        • Size 44KB
        • SHA256 b6d90f9ae2340168cf9b877222703a6fb5356349cf6fdbb282a94c3f3daea15e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7149caf188546a131ef9e2bd2eb8d7c2d66021e43716f14f19d3bbc075e5dd7d.0.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/7149caf188546a131ef9e2bd2eb8d7c2d66021e43716f14f19d3bbc075e5dd7d.0.tmp
        • Size 556B
        • SHA256 9a393d36c926ca2fc01bc14bfaf2a1a59e747080fac4001384cdc8cd6dfd7036
        • MD5 SHA1 SHA512 TLSH

        7149caf188546a131ef9e2bd2eb8d7c2d66021e43716f14f19d3bbc075e5dd7d.1.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/7149caf188546a131ef9e2bd2eb8d7c2d66021e43716f14f19d3bbc075e5dd7d.1.tmp
        • Size 76KB
        • SHA256 1ef22d834b26a1ef8dd46d2a0c4c1988324b94c54ebc4645bcc7dea81b66b3d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        b3f7d928fd651eaac87361eb7971179fa24f2dc574ddeee37af4e8367bb431b9.0.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/b3f7d928fd651eaac87361eb7971179fa24f2dc574ddeee37af4e8367bb431b9.0.tmp
        • Size 555B
        • SHA256 9b43963669f33a8afd90bd5ebc4d161c478908ab8d8b93aab1f84e444b8d5b14
        • MD5 SHA1 SHA512 TLSH

        b3f7d928fd651eaac87361eb7971179fa24f2dc574ddeee37af4e8367bb431b9.1.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/b3f7d928fd651eaac87361eb7971179fa24f2dc574ddeee37af4e8367bb431b9.1.tmp
        • Size 92KB
        • SHA256 65494219f2c99e34e9955263dab2feac2eb04816fabbc2998a949c8a98b3572d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cdd7ea40ce14a9a9dd07ecf670ad3dcb9536b31040faadbc87ed76aacacc1eb7.0.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/cdd7ea40ce14a9a9dd07ecf670ad3dcb9536b31040faadbc87ed76aacacc1eb7.0.tmp
        • Size 556B
        • SHA256 71e6c08187cb2b5c4241e8a6965f40dc0962922cbe96821e377fc10343e654d2
        • MD5 SHA1 SHA512 TLSH

        cdd7ea40ce14a9a9dd07ecf670ad3dcb9536b31040faadbc87ed76aacacc1eb7.1.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/cdd7ea40ce14a9a9dd07ecf670ad3dcb9536b31040faadbc87ed76aacacc1eb7.1.tmp
        • Size 101KB
        • SHA256 2622ca878d61b6036a34d13035d3e8111a989957ef4350679f52a7012aa3a9a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        journal

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/journal
        • Size 1KB
        • SHA256 4895ddd9c6e34fd03a05f0351da5df64dac0f56053ae1bfe518af825a4bf0590
        • MD5 SHA1 SHA512 TLSH

        journal.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/cache/coil/journal.tmp
        • Size 31B
        • SHA256 8f22a32cd8de58916041d1097976f2b9c80f7e9a18593d5a6b058bcaed17e22a
        • MD5 SHA1 SHA512

        exoplayer_internal.db

        • Path /data/data/com.agastyatomar.aaditune.debug/databases/exoplayer_internal.db
        • Size 52KB
        • SHA256 6ed67deae7f366184a8f4052716c88cfa683dc316bd56d5decd772abd4d671a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        exoplayer_internal.db-journal

        • Path /data/data/com.agastyatomar.aaditune.debug/databases/exoplayer_internal.db-journal
        • Size 512B
        • SHA256 5d8b223cc6e3a8ef19747fde3773047df81536092a4415f63d5a38139ad4186b
        • MD5 SHA1 SHA512

        exoplayer_internal.db-journal

        • Path /data/data/com.agastyatomar.aaditune.debug/databases/exoplayer_internal.db-journal
        • Size 8KB
        • SHA256 ce85c3df6d8f2bd4e774f7744fae3b14f63e5a5e18ee02ecd3cc71f03775563e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        exoplayer_internal.db-journal

        • Path /data/data/com.agastyatomar.aaditune.debug/databases/exoplayer_internal.db-journal
        • Size 4KB
        • SHA256 52a777cb2e67b5102ba1dc166a8148e1544f7bcc389b6d48eb6f37e5132b44bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        exoplayer_internal.db-journal

        • Path /data/data/com.agastyatomar.aaditune.debug/databases/exoplayer_internal.db-journal
        • Size 8KB
        • SHA256 becc933d0181dc99d70a526ad0d946e2ba0e22468f38391b5d55d567971f7960
        • MD5 SHA1 SHA512 SSDEEP TLSH

        exoplayer_internal.db-journal

        • Path /data/data/com.agastyatomar.aaditune.debug/databases/exoplayer_internal.db-journal
        • Size 16KB
        • SHA256 bbca4d952938dd5cf5a75ff7b61c374e30ee170271b243841082ad2c1caa8149
        • MD5 SHA1 SHA512 SSDEEP TLSH

        exoplayer_internal.db-journal

        • Path /data/data/com.agastyatomar.aaditune.debug/databases/exoplayer_internal.db-journal
        • Size 16KB
        • SHA256 6160d493a49de1dae1fca7054b6f7e43ddf5977fe0f0bc116bf6c407f49fadd1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        song.db

        • Path /data/data/com.agastyatomar.aaditune.debug/databases/song.db
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        song.db-journal

        • Path /data/data/com.agastyatomar.aaditune.debug/databases/song.db-journal
        • Size 512B
        • SHA256 c45be73e220e0ca7bf78620a2a04da58a0e1e6a22b3f6cfbe5e182c724bfc902
        • MD5 SHA1 SHA512

        song.db-shm

        • Path /data/data/com.agastyatomar.aaditune.debug/databases/song.db-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        song.db-wal

        • Path /data/data/com.agastyatomar.aaditune.debug/databases/song.db-wal
        • Size 16KB
        • SHA256 be9cba2966185f83e360cc72cf0fb2cc1d925374997e3828694e101bb089975f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        song.db-wal

        • Path /data/data/com.agastyatomar.aaditune.debug/databases/song.db-wal
        • Size 181KB
        • SHA256 fe4a161b8ddaf76308b1181d190339bc65b178efb858e16ba42e1f0769788947
        • MD5 SHA1 SHA512 SSDEEP TLSH

        settings.preferences_pb.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/files/datastore/settings.preferences_pb.tmp
        • Size 482B
        • SHA256 b7c5685f378d9e0842c9d969643c8c1cf09ba68962a24932373bfbc2efcb5274
        • MD5 SHA1 SHA512 TLSH

        settings.preferences_pb.tmp

        • Path /data/data/com.agastyatomar.aaditune.debug/files/datastore/settings.preferences_pb.tmp
        • Size 505B
        • SHA256 755055a1cad568006ae9a2c7eeab03036b0329dbf725e22a93f18b7c6583e05c
        • MD5 SHA1 SHA512 TLSH