225e290b21e862f97b3c1bbd41cc75723f7696e7929cbbcd9bbe7dd123a1151d

Analysis

max time kernel
68s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
07/11/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XiTing-6.1.0.apk
Size 1.3MB
Sample261107-mx9d4sef56
SHA256 225e290b21e862f97b3c1bbd41cc75723f7696e7929cbbcd9bbe7dd123a1151d
MD5 cb80539463ce71e4a46576cce185407c
SHA1 5696cf24f0be9d9c34c3241430fde4803b9baaf3
SHA512 7b78d1ab4f3e68d335fe0f04c5a4a106a7eec1ba9c9386de8219c78172e46b228e41ed0eb895576565d0d27b4668f483539fc2b3ca23b14cd0745532fe20f145
SSDEEP 24576:XXEjp4fqetvWWJf4+oOM+X8yvYlSI8HBiz0uman2fGaGW0YB:XUtYVJf4C/nW58xlGWB
TLSH
T15555BE16F6866657C872C1768D02DAA12669FC6DAF0343136449BB3D38BB3E4CF163E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

execution persistence

Malware Config

Signatures

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.lujinyu.xiting

com.lujinyu.xiting
1⤵
- Schedules tasks to execute at a specified time
PID:4936

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

listening.db

Path /data/data/com.lujinyu.xiting/databases/listening.db
Size 56KB
SHA256 80cd27d7d3abbe631866d892a3bf5a04e8908f86763238362abdf683d12f9a4c
MD5 612de679920f5624f31f04ab7880eb92
SHA1 ea629f38ebfba17e12a0ea0a56af8fe94547285d
SHA512 e300b24750f76de60ba4aa9ffeafc3ba2d7dc8ff9137f26b6286367a0be47f91ee84252c0ac993ad10619eee0b063c276ab3ddb807a85114ebbf16d8c8374663
SSDEEP 24:TLx15wKXfNQaWeAVNcw8m59aZBLLVk8JzeuUFmpm1IGSrIw:TVcSTQcw8m/iLGkampavS
TLSH
T11F43BDDD0F247316C1E96233D9D12F631B3C566D8FA20B932A9820B59CD2522DD299F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

listening.db-journal

Path /data/data/com.lujinyu.xiting/databases/listening.db-journal
Size 512B
SHA256 c0d2689b8eb70b693fe16fc78b8a810da4594ff5ac8d5abea9b6cc3baf5483bf
MD5 1d4303e3a5e54bc92cd5dd7ca7806aa9
SHA1 d707bd0d745a20590c44ac942ec3598b145b1a29
SHA512 a1a1c8925799c8f5e65ebd68ed823fa609df25484fbd52d36071dcfadfd63bee63c9d6fe1254b11f4aa426a97eb31bd50e8e713286cea6a020a424386c09decb
MD5 SHA1 SHA512

Submit Download

listening.db-journal

Path /data/data/com.lujinyu.xiting/databases/listening.db-journal
Size 8KB
SHA256 a459502aea9c98056f47ecc1876ad28e848c0deeb381784ba8497bee6773dae7
MD5 85811981660e058b1151a7edf673d79c
SHA1 0eb466adcaf84af693e689e76b00d8058003b289
SHA512 3216ad0e0f0fbe9ab2238239a89f7f25f906674cc5c2c074035808e792a0ed1b2050cae4fbbc2892b282c033f514f5ecf2e85206528fa5bb4cce9563290ad145
SSDEEP 6:7+/l9IOn1AlXvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK0dKn:7+tSZlfqLiuWdYRmBEyPbnKn
TLSH
T12302C09C7B800813C83D1A7790D4C3400D00E72C9571CB27169008D43C074CCF4A0DBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

listening.db-journal

Path /data/data/com.lujinyu.xiting/databases/listening.db-journal
Size 8KB
SHA256 d95b693bc8b67f8bc8d1a01264ffb7821994f68b39584092c8743732dc99e310
MD5 34eadb13f935399f1a67b3ebda11a0b0
SHA1 fde1c0106737c2be02bd478e2e531aa948f625c3
SHA512 a304ddb95c9215fd5c830a5a24a5be671764b336e161a758d177ff5d9a378ca61897d2fc43392a1e219ecafd1c5f66dd55a334a06d6c12c647d8d7a5df993f12
SSDEEP 6:7+/l9NPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKi/+:7+tzqLJdeWRmBEyPbd+
TLSH
T1DE02228B67400803C0392B7BA0C883A02E52AF2A9363CB4716A108592C06ACCAC90E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads