Malware analysis https://github.com/rav3421/Eas/blob/main/mParivahan.apk Malicious activity

Add for printing

URL:	https://github.com/rav3421/Eas/blob/main/mParivahan.apk
Full analysis:	https://app.any.run/tasks/d7974104-9ea9-41c2-8c7c-293bab959887
Verdict:	Malicious activity
Threats:	Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Malware Trends Tracker >>>
Analysis date:	June 23, 2025, 11:23:29
OS:	Android 14
Tags:	github tanglebot rat
Indicators:
MD5:	EAB79B8EAC4F2EA1D9E3B1154C739464
SHA1:	6F35E50228646909AD2E3B4198A72DC834D19563
SHA256:	18A0BDC95304012E52965557F1C0C68EA68C298BD93AD97D7A6D445433B2E6B8
SSDEEP:	3:N8tEdn93MERCTkiwk:2uIsQkiwk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- Initiates background APK installation
  - app_process64 (PID: 2580)
- TANGLEBOT has been detected
  - app_process64 (PID: 2580)
- Hides app icon from display
  - app_process64 (PID: 2684)
SUSPICIOUS
- Collects data about the device's environment (JVM version)
  - app_process64 (PID: 2580)
  - app_process64 (PID: 2684)
- Accesses external device storage files
  - app_process64 (PID: 2580)
  - app_process64 (PID: 2684)
- Uses encryption API functions
  - app_process64 (PID: 2580)
  - app_process64 (PID: 2684)
- Launches a new activity
  - app_process64 (PID: 2580)
- Creates a WakeLock to manage power state
  - app_process64 (PID: 2684)
- Establishing a connection
  - app_process64 (PID: 2684)
- Starts a service
  - app_process64 (PID: 2684)
- Retrieves a list of running services
  - app_process64 (PID: 2684)
- Acquires a wake lock to keep the device awake
  - app_process64 (PID: 2684)
- Connects to unusual port
  - app_process64 (PID: 2684)
- Abuses foreground service for persistence
  - app_process64 (PID: 2684)
- Detects when screen powers off
  - app_process64 (PID: 2684)
INFO
- Dynamically inspects or modifies classes, methods, and fields at runtime
  - app_process64 (PID: 2580)
  - app_process64 (PID: 2684)
- Gets the display metrics associated with the device's screen
  - app_process64 (PID: 2580)
  - app_process64 (PID: 2684)
- Gets file name without full path
  - app_process64 (PID: 2580)
  - app_process64 (PID: 2684)
- Loads a native library into the application
  - app_process64 (PID: 2580)
  - app_process64 (PID: 2684)
- Stores data using SQLite database
  - app_process64 (PID: 2684)
- Retrieves the value of a secure system setting
  - app_process64 (PID: 2684)
- Dynamically registers broadcast event listeners
  - app_process64 (PID: 2684)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

140

Monitored processes

17

Malicious processes

2

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
2223	<pre-initialized>	/system/bin/app_process64		app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2264	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2279	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a73 Integrity Level: UNKNOWN Exit code: 0
2314	org.chromium.chrome:privileged_process0	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2337	com.android.adservices.api	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2388	com.android.traceur	/system/bin/app_process64	—	app_process64
User: u0_a54 Integrity Level: UNKNOWN Exit code: 512
2410	com.android.providers.partnerbookmarks	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2433	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a73 Integrity Level: UNKNOWN Exit code: 0
2456	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a73 Integrity Level: UNKNOWN Exit code: 0
2549	/system/bin/dmesgd	/system/bin/dmesgd	—	init
User: dmesgd Integrity Level: UNKNOWN Exit code: 0

Add for printing

Total events

0

Read events

0

Write events

0

Delete events

0

Modification events

No data

Add for printing

Executable files

0

Suspicious files

9

Text files

0

Unknown types

2

Dropped files

PID	Process	Filename		Type
2580	app_process64	/data/data/com.cristal.bristral.tristal.mistral/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫.		mpg
		MD5:—	SHA256:—
2580	app_process64	/data/data/com.cristal.bristral.tristal.mistral/cache/oat_primary/arm64/base.2580.tmp		binary
		MD5:—	SHA256:—
2580	app_process64	/data/data/com.cristal.bristral.tristal.mistral/files/profileInstalled		binary
		MD5:—	SHA256:—
2684	app_process64	/data/user/0/com.androidmodulling.autocad.studio/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫.		mpg
		MD5:—	SHA256:—
2684	app_process64	/data/user/0/com.androidmodulling.autocad.studio/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫		compressed
		MD5:—	SHA256:—
2684	app_process64	/data/user/0/com.androidmodulling.autocad.studio/app_mph_dex/apk.crazy-v1.security.jar		dex
		MD5:—	SHA256:—
2684	app_process64	/data/user/0/com.androidmodulling.autocad.studio/no_backup/androidx.work.workdb-journal		binary
		MD5:—	SHA256:—
2684	app_process64	/data/user/0/com.androidmodulling.autocad.studio/no_backup/androidx.work.workdb-wal		binary
		MD5:—	SHA256:—
2684	app_process64	/data/user/0/com.androidmodulling.autocad.studio/cache/oat_primary/arm64/base.2684.tmp		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

2

TCP/UDP connections

31

DNS requests

33

Threats

11

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	172.217.16.195:80	http://connectivitycheck.gstatic.com/generate_204	US	—	—	whitelisted
2223	app_process64	GET	200	142.250.184.238:80	http://clients2.google.com/time/1/current?cup2key=9:nPyh4US1tkRltqN0VpBdhLMMrGs0Ygx5Jq2H7BwuDss&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	US	text	106 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
451	mdnsd	224.0.0.251:5353	—	—	—	unknown
—	—	172.217.16.196:443	www.google.com	GOOGLE	US	whitelisted
—	—	216.239.35.0:123	time.android.com	—	—	whitelisted
—	—	172.217.16.195:80	connectivitycheck.gstatic.com	GOOGLE	US	whitelisted
—	—	108.177.15.81:443	staging-remoteprovisioning.sandbox.googleapis.com	GOOGLE	US	whitelisted
2223	app_process64	142.250.184.238:80	clients2.google.com	GOOGLE	US	whitelisted
2223	app_process64	74.125.133.84:443	accounts.google.com	GOOGLE	US	whitelisted
2223	app_process64	140.82.121.4:443	github.com	GITHUB	US	whitelisted
2223	app_process64	172.217.16.196:443	www.google.com	GOOGLE	US	whitelisted
2223	app_process64	185.199.109.154:443	github.githubassets.com	FASTLY	US	whitelisted

DNS requests

Domain	IP	Reputation
www.google.com	172.217.16.196	whitelisted
connectivitycheck.gstatic.com	172.217.16.195	whitelisted
google.com	216.58.206.46	whitelisted
time.android.com	216.239.35.0 216.239.35.12 216.239.35.8 216.239.35.4	whitelisted
staging-remoteprovisioning.sandbox.googleapis.com	108.177.15.81	whitelisted
clients2.google.com	142.250.184.238	whitelisted
accounts.google.com	74.125.133.84	whitelisted
github.com	140.82.121.4	whitelisted
github.githubassets.com	185.199.109.154 185.199.108.154 185.199.111.154 185.199.110.154	whitelisted
avatars.githubusercontent.com	185.199.110.133 185.199.109.133 185.199.111.133 185.199.108.133	whitelisted

Threats

PID	Process	Class	Message
—	—	Misc activity	ET INFO Android Device Connectivity Check
2223	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2223	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2223	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2223	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2223	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2223	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2223	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2223	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2223	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access raw user content on GitHub

Add for printing

No debug info

General Info

https://github.com/rav3421/Eas/blob/main/mParivahan.apk

EAB79B8EAC4F2EA1D9E3B1154C739464

6F35E50228646909AD2E3B4198A72DC834D19563

18A0BDC95304012E52965557F1C0C68EA68C298BD93AD97D7A6D445433B2E6B8

3:N8tEdn93MERCTkiwk:2uIsQkiwk

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Initiates background APK installation

TANGLEBOT has been detected

Hides app icon from display

SUSPICIOUS

Collects data about the device's environment (JVM version)

Accesses external device storage files

Uses encryption API functions

Launches a new activity

Creates a WakeLock to manage power state

Establishing a connection

Starts a service

Retrieves a list of running services

Acquires a wake lock to keep the device awake

Connects to unusual port

Abuses foreground service for persistence

Detects when screen powers off

INFO

Dynamically inspects or modifies classes, methods, and fields at runtime

Gets the display metrics associated with the device's screen

Gets file name without full path

Loads a native library into the application

Stores data using SQLite database

Retrieves the value of a secure system setting

Dynamically registers broadcast event listeners

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings