2a46a2565d4f50facb1f9bbceb6ea5941324e9316c61e8a125f6f012d0de7e57 | Triage™

Analysis

max time kernel
1s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
06/11/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a46a2565d4f50facb1f9bbceb6ea5941324e9316c61e8a125f6f012d0de7e57.apk
Size 5.1MB
Sample261106-b4yqeahw5k
SHA256 2a46a2565d4f50facb1f9bbceb6ea5941324e9316c61e8a125f6f012d0de7e57
MD5 85b3264ec789c0e8b6d12ddc248fed23
SHA1 5d7e52104343a9d0fe601d2214f47457b2f8f103
SHA512 aaac91a0c824042ef568b94d2cfb8ffe07c2d6e960c96518d9ba12c5ead48e11f4b9b7e8dc2c83b312bbadfed96178bc92884414832820a9c245ba1a816b238f
SSDEEP 98304:T+MyIpnZSsA8FimIA4H9Imksw2AfYo0iE/w4OvCRaCbSddSn3jxpJrCrT:Tx//aHH9ecrlDSbAFporT
TLSH
T11C362341FA479E95C8F6C33050B80F2961371D65C347A38B6B75B3B938BB6D84B8B189
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.elgfus.app

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.elgfus.app

Queries information about active data network 1 TTPs 1 IoCs

System Network Connections Discovery

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.elgfus.app

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Broadcast Receivers

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.elgfus.app

com.elgfus.app
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5081

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Credential Access

Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db
Size 16KB
SHA256 60c0ccd987453f89ea3bc04d13e34c99f1fc4bcc4aee97c34e524d22f319b182
MD5 d5d65a0b4c6e6db83f30d16e24a0d306
SHA1 a768e9b3d93efae0ef42a9bdb203be9f2ee824d4
SHA512 b94841e2c87dfc2383e0adfe8bac6a5813a9faad61edbe953f4e953828cdeeba631ed0dc45e698dd680ccefc3fa6930f53483dcbc26149a3a6f26f9badcd1ef5
SSDEEP 6:l9bNFleLIls19P0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOwVQ:TLDE97LzmzsRmBEyPbBvOwVQ
TLSH
T1BC72D8CD8F10A716C5170337608AD3955F78951E83679647266408646E52198B051E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db-journal
Size 4KB
SHA256 267dd211f24e74fb29577fd00aea4e99404a887beba4a274cf6083f24d51bb6b
MD5 aa3e6c2657346482e81ff57434c45d65
SHA1 e9320dc544fcb0f6801f77a3125eeea284d4d906
SHA512 3c0c8a7381ecabf83b12f68b73eba69b3b3103b641251a41225a56b0d9b064b95e2b2f83630efe4845d2db498cb8c7ecd6bc99e6dcadb5caeb98cb8e9ef40b96
SSDEEP 6:7+/lkg9bNFluls1EhlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuKkR:7+tkqL8EEh9zmzrfRmBEyPb7R
TLSH
T15F91C28E9F112602C1AB4A77B4CB93506D28A219837B9E573AA804A4AD425899051F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 1247f335b7a72f0292b961cb7731648b161f0f78ff29a0a111097a1a1d63acbb
MD5 a97b9e0ab09e6cef6dbd94e518511cdb
SHA1 ed5176602e0110aa3548f854a30b9bfbc936ded6
SHA512 c69e542bccdb92a60ca9b6b927c1ba16914ae31995714b2054af1a83d58029ffcb3495e127187cde2b643ee7773b3d5519eb32f0533d90d298527121218e54f3
SSDEEP 6:7+/l9czhxvg9bNFlqls1IP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suus:7+t+RqLwEI7LzmzsRmBEyPbC
TLSH
T1AF02208D8E206127C15703BBF4C753591F28551E83B7595317B408746D532D8B061F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 3d06bb49468a430bc12b5ff7db299fa615cab1f8345887acb4cada4dfcfb5917
MD5 6f8fb651ba0662b9d1a26cf388060cae
SHA1 baa783624a955b4767dca358a8506e2c6fd34f57
SHA512 4b09663d26004a17a42f2d5b5af6de610544a5d6020567f159ba7b0cdab03b40f2583b63b4ab5fb392e793d48d49197792a444f42e4a5cea13bf5584858b8c15
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 edbd168dd83e3a984359374fc61c8ac9e678f31d3b07edc8b4f36b1319460dea
MD5 ac247f4d5d9a62d4ff0dd1814a4500ed
SHA1 74c5c05289d6479a4d7028523329c9e7626530aa
SHA512 4d3c2ff9c2253e59ecde9a9ba5269c1a4d137870031d27e64a170796a6a6d35a88cc93e3d7ace4efb5539033e9034f35a27abce15ab2cbf95cf00c25b6ea2257
SSDEEP 6:7+/l9Yn1Pvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKc:7+tkvqLiuWdwRmBEyPbH
TLSH
T1DE02C08D6B800823C91D16B7D0D5A3440D00F71DC376CB0B2D7008D8FC038CCE4A0D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db-journal
Size 4KB
SHA256 e5172b54335a81285f691fc483858f5e0693b4e19bc3090f5780659d1315d5d5
MD5 dd18e369392cfbc95156457aa4e7c223
SHA1 131e9d99f812f3ac45f25255ed6a9cb21f06f663
SHA512 e58075bde615080c466821fc7629f87fb55e8cf63779af7a4beff110e7187b8c08d10c060534ef17495e5575058a22889cc2a7676022f07ac25b13b545a95421
SSDEEP 6:7+/lbPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKaBn:7+tTqLJdTRmBEyPbdBn
TLSH
T1B991809A67410913C5295BF7D0D583551D60E71DC373CB5715A408987C476DCE4A4F45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.elgfus.app/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 272cc167bb2181df3126d2245e2aeedd8d508be10d530914d004142a91ce74cc
MD5 92a0a938a235a2ef29f5504e25a270fe
SHA1 4ee286a0401d1fd994af2637ec28c83425d62649
SHA512 8e5c7b065ed6affd13ba5e98d9cf0c847c6b4f2d5e595d7820eadee2f5b6e59a3a146e89a96620c645a27c316f7b5177e321e2151d673f5a82829b01085a914d
SSDEEP 6:7+/l9nkGPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuK8vUvM/c:7+tFPqLmqCRmBEyPbmvsc
TLSH
T17D02128D67C11D13D52D56B7E0D983541E19EB15C162CB57156108EC7C465CCE8D1EA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation1124038927728399439tmp

Path /data/data/com.elgfus.app/files/PersistedInstallation1124038927728399439tmp
Size 90B
SHA256 c491e4ab0e1412b70286466b5bd55043f34384ab49f362fead7469f9bd106dcf
MD5 132589574461bef46ea25819eaea0299
SHA1 77ca3ebe3ff2ac5ead9fa6c5b812c28a11bf5dd4
SHA512 894b5f6cd58523bc61bcde6b54e2c1218c11fcd49ba149f5a616a9bfc287be81a4d79fd8718991237e7eb80603f27518448dfd4c93cac39a90ca6ebc28fbdf44
TLSH
T17AB01241CB3095418889B2071C9FA1041E6018C0290D8B054A08D06084815D49203D94
MD5 SHA1 SHA512 TLSH

Submit Download

offline_key.txt

Path /data/data/com.elgfus.app/files/offline_key.txt
Size 10B
SHA256 75a8fc242caffc6b952f9499890fa64493231ea01fab112b659c9d9e8692b545
MD5 cfff027fed2723daa64c135ad67a7832
SHA1 ad6649931d2da6e3afe687cc79aed5ae903a3610
SHA512 78657bfcb5dd068f8cdb6aa1706ff8d0bde1ca1b09b8c19f803592221cb5aae33aded2c02a4d699e9b0a970c3030f4d8ca6725f1fd726a131a338e3bca4984c5
MD5 SHA1 SHA512

Submit Download