Malware analysis __________________3_.apk Malicious activity

Add for printing

File name:	__________________3_.apk
Full analysis:	https://app.any.run/tasks/6a797c66-6a2d-4834-a0d0-a6eab7086ae2
Verdict:	Malicious activity
Analysis date:	January 28, 2026, 15:23:33
OS:	Android 14
MIME:	application/vnd.android.package-archive
File info:	Android package (APK), with AndroidManifest.xml, with APK Signing Block
MD5:	6BB9505CBA8D70E0AD3849210FC631D9
SHA1:	AEBE4F0552AE00447AD3C5473AD752F5108F6D5A
SHA256:	0457DBA208C33DE280253C12B398F6DF32F2D3FBD2BF8A776D3B9ADECC2F0944
SSDEEP:	49152:arSCT/luiz8aRNSvrlEs6BkKkgROalwy4OsfIAF2+NTDgSqnJW1tj7dIMbanb:I5TNuiz8eUrS5BkzgRhlwyxsfIAFHV7m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: off
Network:: on

Software preset

android (14)
android.cuttlefish.overlay (14)
android.cuttlefish.phone.overlay (14)
android.ext.services (2019-09)
android.ext.shared (1)
com.android.adservices.api (14)
com.android.apps.tag (1.1)
com.android.backupconfirm (14)
com.android.bips (14)
com.android.bluetoothmidiservice (14)
com.android.bookmarkprovider (14)
com.android.calendar (14)
com.android.calllogbackup (14)
com.android.camera2 (2.0.002)
com.android.cameraextensions (14)
com.android.captiveportallogin (14)
com.android.carrierconfig (1.0.0)
com.android.carrierdefaultapp (14)
com.android.cellbroadcastreceiver (R-initial)
com.android.cellbroadcastreceiver.module (R-initial)
com.android.cellbroadcastservice (R-initial)
com.android.certinstaller (14)
com.android.companiondevicemanager (14)
com.android.compos.payload (14)
com.android.connectivity.resources (S-initial)
com.android.connectivity.resources.cuttlefish.overlay (14)
com.android.contacts (1.7.34)
com.android.credentialmanager (14)
com.android.cts.ctsshim (14-10093150)
com.android.cts.priv.ctsshim (14-10093150)
com.android.deskclock (14)
com.android.devicelockcontroller (14)
com.android.dialer (23.0)
com.android.documentsui (14)
com.android.dreams.basic (14)
com.android.dreams.phototable (14)
com.android.dynsystem (14)
com.android.egg (1.0)
com.android.emergency (14)
com.android.ext.adservices.api (14)
com.android.externalstorage (14)
com.android.federatedcompute.services (T-initial)
com.android.gallery3d (1.1.40030)
com.android.google.gce.gceservice (14)
com.android.health.connect.backuprestore (14)
com.android.healthconnect.controller (14)
com.android.hotspot2.osulogin (14)
com.android.htmlviewer (14)
com.android.imsserviceentitlement (14)
com.android.inputdevices (14)
com.android.inputmethod.latin (14)
com.android.intentresolver (2021-11)
com.android.internal.display.cutout.emulation.corner (1.0)
com.android.internal.display.cutout.emulation.double (1.0)
com.android.internal.display.cutout.emulation.hole (1.0)
com.android.internal.display.cutout.emulation.tall (1.0)
com.android.internal.display.cutout.emulation.waterfall (1.0)
com.android.internal.systemui.navbar.gestural (1.0)
com.android.internal.systemui.navbar.gestural_extra_wide_back (1.0)
com.android.internal.systemui.navbar.gestural_narrow_back (1.0)
com.android.internal.systemui.navbar.gestural_wide_back (1.0)
com.android.internal.systemui.navbar.threebutton (1.0)
com.android.internal.systemui.navbar.transparent (1.0)
com.android.keychain (14)
com.android.launcher3 (14)
com.android.localtransport (14)
com.android.location.fused (14)
com.android.managedprovisioning (14)
com.android.messaging (1.0.001)
com.android.microdroid.empty_payload (14)
com.android.mms.service (14)
com.android.modulemetadata (14)
com.android.mtp (14)
com.android.music (14)
com.android.musicfx (1.4)
com.android.nearby.halfsheet (14)
com.android.networkstack (14)
com.android.networkstack.tethering (14)
com.android.networkstack.tethering.cuttlefishoverlay (1.0)
com.android.nfc (14)
com.android.ondevicepersonalization.services (T-initial)
com.android.ons (14)
com.android.packageinstaller (14)
com.android.pacprocessor (14)
com.android.permissioncontroller (33 system image)
com.android.phone (14)
com.android.printservice.recommendation (1.3.0)
com.android.printspooler (14)
com.android.providers.blockednumber (14)
com.android.providers.calendar (14)
com.android.providers.contacts (14)
com.android.providers.downloads (14)
com.android.providers.downloads.ui (14)
com.android.providers.media (14)
com.android.providers.media.module (14)
com.android.providers.partnerbookmarks (14)
com.android.providers.settings (14)
com.android.providers.settings.cuttlefish.overlay (14)
com.android.providers.telephony (14)
com.android.providers.userdictionary (14)
com.android.provision (14)
com.android.proxyhandler (14)
com.android.quicksearchbox (14)
com.android.rkpdapp (14)
com.android.role.notes.enabled (1.0)
com.android.safetycenter.resources (33 system image)
com.android.sdksandbox (T-initial)
com.android.se (14)
com.android.server.telecom (14)
com.android.settings (14)
com.android.settings.intelligence (14)
com.android.sharedstoragebackup (14)
com.android.shell (14)
com.android.simappdialog (14)
com.android.soundpicker (14)
com.android.statementservice (1.0)
com.android.stk (14)
com.android.storagemanager (14)
com.android.systemui (14)
com.android.systemui.accessibility.accessibilitymenu (14)
com.android.telephony.qns (14)
com.android.theme.font.notoserifsource (1.0)
com.android.traceur (1.0)
com.android.uwb.resources (T-initial)
com.android.virtualmachine.res (14)
com.android.vpndialogs (14)
com.android.wallpaper.livepicker (14)
com.android.wallpaperbackup (14)
com.android.wallpapercropper (14)
com.android.wallpaperpicker (1.0)
com.android.webview (137.0.7122.0)
com.android.wifi.dialog (14)
com.android.wifi.resources (R-initial)
com.android.wifi.resources.cf (1.0)
com.google.android.telephony.satellite (14)
org.chromium.chrome (137.0.7122.0)

Add for printing

MALICIOUS
- Sends SMS messages
  - app_process64 (PID: 4025)
SUSPICIOUS
- Collects data about the device's environment (JVM version)
  - app_process64 (PID: 4025)
- Creates a WakeLock to manage power state
  - app_process64 (PID: 4025)
- Updates data in the storage of application settings (SharedPreferences)
  - app_process64 (PID: 4025)
- Abuses foreground service for persistence
  - app_process64 (PID: 4025)
- Reads messages from SMS inbox
  - app_process64 (PID: 4025)
- Retrieves sent SMS messages
  - app_process64 (PID: 4025)
- Starts a service
  - app_process64 (PID: 4025)
- Acquires a wake lock to keep the device awake
  - app_process64 (PID: 4025)
- Connects to unusual port
  - app_process64 (PID: 4025)
INFO
- Verifies presence of SIM card
  - app_process64 (PID: 4025)
- Dynamically inspects or modifies classes, methods, and fields at runtime
  - app_process64 (PID: 4025)
- Retrieves data from storage of application settings (SharedPreferences)
  - app_process64 (PID: 4025)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion:	20
ZipBitFlag:	0x0001
ZipCompression:	Deflated
ZipModifyDate:	2026:01:27 23:56:20
ZipCRC:	0x0241b0b2
ZipCompressedSize:	3770
ZipUncompressedSize:	16384
ZipFileName:	AndroidManifest.xml

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

134

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
4025	ru.tiyoiw.pz4p8k	/system/bin/app_process64		app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
4042	com.android.traceur	/system/bin/app_process64	—	app_process64
User: u0_a54 Integrity Level: UNKNOWN Exit code: 512
4061	com.android.webview:webview_service	/system/bin/app_process32		app_process32
User: root Integrity Level: UNKNOWN Exit code: 0
4063	webview_zygote	/system/bin/app_process32	—	app_process32
User: webview_zygote Integrity Level: UNKNOWN Exit code: 0
4187	com.android.webview:webview_apk	/system/bin/app_process32		app_process32
User: root Integrity Level: UNKNOWN Exit code: 0

Add for printing

Total events

Read events

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
4025	app_process64	/data/data/ru.tiyoiw.pz4p8k/app_webview/last-exit-info		text
		MD5:—	SHA256:—
4025	app_process64	/data/data/ru.tiyoiw.pz4p8k/shared_prefs/WebViewChromiumPrefs.xml		xml
		MD5:—	SHA256:—
4025	app_process64	/data/data/ru.tiyoiw.pz4p8k/app_webview/Default/Web Data-journal		binary
		MD5:—	SHA256:—
4025	app_process64	/data/data/ru.tiyoiw.pz4p8k/app_webview/Default/Shared Dictionary/cache/index		binary
		MD5:—	SHA256:—
4025	app_process64	/data/data/ru.tiyoiw.pz4p8k/cache/WebView/Default/HTTP Cache/Code Cache/js/index		binary
		MD5:—	SHA256:—
4025	app_process64	/data/data/ru.tiyoiw.pz4p8k/app_webview/Default/DIPS-journal		binary
		MD5:—	SHA256:—
4025	app_process64	/data/data/ru.tiyoiw.pz4p8k/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index		binary
		MD5:—	SHA256:—
4025	app_process64	/data/data/ru.tiyoiw.pz4p8k/app_webview/Default/Local Storage/leveldb/MANIFEST-000001		binary
		MD5:—	SHA256:—
4025	app_process64	/data/data/ru.tiyoiw.pz4p8k/app_webview/Default/Local Storage/leveldb/000001.dbtmp		text
		MD5:—	SHA256:—
4025	app_process64	/data/data/ru.tiyoiw.pz4p8k/app_webview/Default/Local Storage/leveldb/CURRENT		text
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1921	app_process64	GET	204	142.251.156.119:443	https://www.google.com/generate_204	US	—	—	whitelisted
—	—	GET	204	142.251.153.119:80	http://www.google.com/gen_204	US	—	—	whitelisted
4025	app_process64	GET	200	45.38.134.71:63031	http://pteam.fensteadom.com:63031/api/v2/retry?team=pteam&key=Fnr_deec5ded157e6149d407fd88bf151301eec9a60f	GB	text	51 b	unknown
1921	app_process64	GET	204	216.58.206.67:80	http://connectivitycheck.gstatic.com/generate_204	US	—	—	whitelisted
4025	app_process64	GET	200	2.16.183.207:443	https://img.freepik.com/premium-vector/loading-icon_609277-1096.jpg	NL	image	4.91 Kb	unknown
4025	app_process64	GET	200	45.38.134.71:63031	http://pteam.fensteadom.com:63031/api/v2/cmd/zBC4N3nIkyD9P9UiFUVswq2Soi0XNPnk	GB	text	23 b	unknown
4025	app_process64	GET	404	2.16.183.207:443	https://img.freepik.com/favicon.ico	NL	text	10 b	unknown
2931	app_process64	POST	200	108.177.15.81:443	https://staging-remoteprovisioning.sandbox.googleapis.com/v1:fetchEekChain	US	binary	778 b	whitelisted
2931	app_process64	POST	200	108.177.15.81:443	https://staging-remoteprovisioning.sandbox.googleapis.com/v1:signCertificates?challenge=AAABnAU0HJkBILStYy33Bo9SCLwpvbSsPUMYKjg=&request_id=ee275094-0bbc-4052-ad90-9fc08ac806e8	US	binary	11.8 Kb	whitelisted
4025	app_process64	GET	200	45.38.134.71:63031	http://pteam.fensteadom.com:63031/api/v2/cmd/zBC4N3nIkyD9P9UiFUVswq2Soi0XNPnk	GB	text	23 b	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
452	mdnsd	224.0.0.251:5353	—	—	—	whitelisted
—	—	142.251.153.119:80	www.google.com	GOOGLE	US	whitelisted
—	—	216.58.206.67:80	connectivitycheck.gstatic.com	GOOGLE	US	whitelisted
—	—	142.251.153.119:443	www.google.com	GOOGLE	US	whitelisted
4025	app_process64	45.38.134.71:63031	—	IWIHOST	GB	unknown
4025	app_process64	2.16.183.207:443	img.freepik.com	AKAMAI-ASN1	NL	whitelisted
580	app_process64	216.239.35.12:123	time.android.com	GOOGLE	US	whitelisted
1921	app_process64	142.251.156.119:443	www.google.com	GOOGLE	US	whitelisted
1921	app_process64	216.58.206.67:80	connectivitycheck.gstatic.com	GOOGLE	US	whitelisted
4061	app_process32	192.178.170.94:443	clientservices.googleapis.com	GOOGLE	US	whitelisted

DNS requests

Domain	IP	Reputation
www.google.com	142.251.153.119 142.251.154.119 142.251.151.119 142.251.150.119 142.251.152.119 142.251.157.119 142.251.156.119 142.251.155.119	whitelisted
img.freepik.com	2.16.183.207 2.16.183.218	whitelisted
connectivitycheck.gstatic.com	216.58.206.67	whitelisted
time.android.com	216.239.35.12 216.239.35.0 216.239.35.4 216.239.35.8	whitelisted
staging-remoteprovisioning.sandbox.googleapis.com	108.177.15.81	whitelisted
clientservices.googleapis.com	192.178.170.94	whitelisted
update.googleapis.com	74.125.29.94	whitelisted

Threats

PID	Process	Class	Message
1921	app_process64	Misc activity	ET INFO Android Device Connectivity Check

Add for printing

No debug info

General Info

__________________3_.apk

6BB9505CBA8D70E0AD3849210FC631D9

AEBE4F0552AE00447AD3C5473AD752F5108F6D5A

0457DBA208C33DE280253C12B398F6DF32F2D3FBD2BF8A776D3B9ADECC2F0944

49152:arSCT/luiz8aRNSvrlEs6BkKkgROalwy4OsfIAF2+NTDgSqnJW1tj7dIMbanb:I5TNuiz8eUrS5BkzgRhlwyxsfIAFHV7m

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Sends SMS messages

SUSPICIOUS

Collects data about the device's environment (JVM version)

Creates a WakeLock to manage power state

Updates data in the storage of application settings (SharedPreferences)

Abuses foreground service for persistence

Reads messages from SMS inbox

Retrieves sent SMS messages

Starts a service

Acquires a wake lock to keep the device awake

Connects to unusual port

INFO

Verifies presence of SIM card

Dynamically inspects or modifies classes, methods, and fields at runtime

Retrieves data from storage of application settings (SharedPreferences)

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings