URL:

https://www.lvcha.org/download/lvcha_101001.apk

Full analysis: https://app.any.run/tasks/3df3bbcb-4140-4b01-8e13-91173456863f
Verdict: Malicious activity
Analysis date: February 13, 2026, 07:18:32
OS: Android 14
Tags:
evasion
obfuscated-js
Indicators:
MD5:

B856B32AC16D7675C5826CF687510B3F

SHA1:

43E27E032F3555C288B8198C76A6B003392439D7

SHA256:

2184C3BA05EFD3FACD6EC99F0B871E849041407D1C660126E9B17432A2A17A0C

SSDEEP:

3:N8DSLkiKAN/uU:2OL0BU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Detects root access on device

      • app_process64 (PID: 4316)

    • Executes system commands or scripts

      • app_process64 (PID: 4316)

  • SUSPICIOUS

    • Accesses system-level resources

      • app_process64 (PID: 4316)

    • Retrieves Android OS build information

      • app_process64 (PID: 4316)

    • Collects data about the device's environment (JVM version)

      • app_process64 (PID: 4316)

    • Retrieves a list of running application processes

      • app_process64 (PID: 4316)

    • Retrieves the MCC and MNC of the SIM card operator

      • app_process64 (PID: 4316)

    • Updates data in the storage of application settings (SharedPreferences)

      • app_process64 (PID: 4316)

    • Establishing a connection

      • app_process64 (PID: 4316)

    • Detects Xposed framework for modifications

      • app_process64 (PID: 4316)

    • Uses encryption API functions

      • app_process64 (PID: 4316)

    • Launches a new activity

      • app_process64 (PID: 4316)

    • Abuses foreground service for persistence

      • app_process64 (PID: 4316)

    • Checks for external IP

      • app_process64 (PID: 4316)
      • app_process64 (PID: 3957)

    • Starts a service

      • app_process64 (PID: 4316)

    • Retrieves the file path to the APK

      • app_process64 (PID: 4316)

    • Scans for popular installed apps

      • app_process64 (PID: 4316)

  • INFO

    • Detects if debugger is connected

      • app_process64 (PID: 4316)

    • Dynamically inspects or modifies classes, methods, and fields at runtime

      • app_process64 (PID: 4316)

    • Returns elapsed time since boot

      • app_process64 (PID: 4316)

    • Retrieves data from storage of application settings (SharedPreferences)

      • app_process64 (PID: 4316)

    • Creates and writes local files

      • app_process64 (PID: 4316)

    • Gets file name without full path

      • app_process64 (PID: 4316)

    • Stores data using SQLite database

      • app_process64 (PID: 4316)

    • Loads a native library into the application

      • app_process64 (PID: 4316)

    • Gets the display metrics associated with the device's screen

      • app_process64 (PID: 4316)

    • Retrieves the value of a secure system setting

      • app_process64 (PID: 4316)

    • Verifies presence of SIM card

      • app_process64 (PID: 4316)

    • Dynamically loads a class in Java

      • app_process64 (PID: 4316)

    • Dynamically registers broadcast event listeners

      • app_process64 (PID: 4316)

    • Verifies whether the device is connected to the internet

      • app_process64 (PID: 4316)

    • Handles throwable exceptions in the app

      • app_process64 (PID: 4316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
187
Monitored processes
59
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start app_process64 app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs dex2oat32 no specs app_process64 app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs toybox no specs toolbox no specs toybox no specs toolbox no specs app_process32 app_process32 no specs app_process32 app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs dmesgd no specs toybox no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs

Process information

PID
CMD
Path
Indicators
Parent process
3957org.chromium.chrome /system/bin/app_process64
app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
4008org.chromium.chrome_zygote /system/bin/app_process64—app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
4019com.android.traceur /system/bin/app_process64—app_process64
User:
u0_a54
Integrity Level:
UNKNOWN
Exit code:
512
4026org.chromium.chrome_zygote /system/bin/app_process64—app_process64
User:
u0_a72
Integrity Level:
UNKNOWN
Exit code:
0
4060<pre-initialized> /system/bin/app_process64—app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
4090<pre-initialized> /system/bin/app_process64—app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
4131org.chromium.chrome_zygote /system/bin/app_process64—app_process64
User:
u0_a72
Integrity Level:
UNKNOWN
Exit code:
9
4153org.chromium.chrome_zygote /system/bin/app_process64—app_process64
User:
u0_a72
Integrity Level:
UNKNOWN
Exit code:
0
4303/apex/com.android.art/bin/dex2oat32 --zip-fd=6 --zip-location=/data/app/~~shQyWFkab-NOfyv_WDy71g==/com.abjlvcha.main-hGVRi1wDiwgF7KZlqUzqTg==/base.apk --oat-fd=7 --oat-location=/data/app/~~shQyWFkab-NOfyv_WDy71g==/com.abjlvcha.main-hGVRi1wDiwgF7KZlqUzqTg==/oat/arm64/base.odex --output-vdex-fd=8 --swap-fd=9 --class-loader-context=PCL[] --classpath-dir=/data/app/~~shQyWFkab-NOfyv_WDy71g==/com.abjlvcha.main-hGVRi1wDiwgF7KZlqUzqTg== --instruction-set=arm64 --instruction-set-features=default --instruction-set-variant=cortex-a53 --compiler-filter=verify --compilation-reason=install --compact-dex-level=none --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --runtime-arg -Xtarget-sdk-version:35 --runtime-arg -Xhidden-api-policy:enabled --runtime-arg -Xms64m --runtime-arg -Xmx512m --comments=app-version-name:2.6.7,app-version-code:47,art-version:340090000/apex/com.android.art/bin/dex2oat32—artd
User:
artd
Integrity Level:
UNKNOWN
Exit code:
0
4316<pre-initialized> /system/bin/app_process64
app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
195
Text files
289
Unknown types
5

Dropped files

PID
Process
Filename
Type
4316app_process64/data/data/com.abjlvcha.main/files/PersistedInstallation4999371002618853589tmptext
MD5:—
SHA256:—
4316app_process64/data/data/com.abjlvcha.main/files/PersistedInstallation.W0RFRkFVTFRd+MTo5MDczOTE1Nzg1NDQ6YW5kcm9pZDphZGM0ODc0NjdkMDM1NDk0OWZlNjc1.jsontext
MD5:—
SHA256:—
4316app_process64/data/data/com.abjlvcha.main/shared_prefs/com.google.firebase.crashlytics.xmlxml
MD5:—
SHA256:—
4316app_process64/data/data/com.abjlvcha.main/shared_prefs/com.google.android.gms.measurement.prefs.xmlxml
MD5:—
SHA256:—
4316app_process64/data/data/com.abjlvcha.main/shared_prefs/FirebaseHeartBeatW0RFRkFVTFRd+MTo5MDczOTE1Nzg1NDQ6YW5kcm9pZDphZGM0ODc0NjdkMDM1NDk0OWZlNjc1.xmlxml
MD5:—
SHA256:—
4316app_process64/data/data/com.abjlvcha.main/files/.com.google.firebase.crashlytics.files.v2:com.abjlvcha.main/com.crashlytics.settings.jsontext
MD5:—
SHA256:—
4316app_process64/data/data/com.abjlvcha.main/files/.com.google.firebase.crashlytics.files.v2:com.abjlvcha.main/open-sessions/698ED0660065000110DCBDB94B4976C4/reporttext
MD5:—
SHA256:—
4316app_process64/data/data/com.abjlvcha.main/files/.com.google.firebase.crashlytics.files.v2:com.abjlvcha.main/open-sessions/698ED0660065000110DCBDB94B4976C4/internal-keystext
MD5:—
SHA256:—
4316app_process64/data/data/com.abjlvcha.main/shared_prefs/com.lvcha.main.SharedPreferences.xmlxml
MD5:—
SHA256:—
4368app_process64/data/data/com.abjlvcha.main/databases/com.google.android.datatransport.eventsbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
289
TCP/UDP connections
825
DNS requests
649
Threats
32

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3957
app_process64
GET
—
194.147.100.243:443
https://www.lvcha.org/download/lvcha_101001.apk
GB
—
—
unknown
3957
app_process64
GET
—
194.147.100.243:443
https://www.lvcha.org/download/lvcha_101001.apk
GB
—
—
unknown
1921
app_process64
GET
204
142.250.187.196:443
https://www.google.com/generate_204
US
—
—
whitelisted
3957
app_process64
GET
200
142.251.141.78:80
http://clients2.google.com/time/1/current?cup2key=9:wk7QyuheiCXAQhhhuXsSbt0_9BvXDA_ZodgU8TuvsGI&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
US
text
107 b
whitelisted
3957
app_process64
POST
200
142.251.127.84:443
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&laf=b64bin&json=standard
US
—
—
whitelisted
—
—
GET
204
142.250.187.196:80
http://www.google.com/gen_204
US
—
—
whitelisted
1921
app_process64
GET
204
142.251.141.99:80
http://connectivitycheck.gstatic.com/generate_204
US
—
—
whitelisted
3957
app_process64
GET
206
194.147.100.243:443
https://www.lvcha.org/download/lvcha_101001.apk
GB
compressed
1.85 Mb
unknown
2931
app_process64
POST
200
64.233.166.81:443
https://staging-remoteprovisioning.sandbox.googleapis.com/v1:fetchEekChain
US
—
778 b
whitelisted
2931
app_process64
POST
200
64.233.166.81:443
https://staging-remoteprovisioning.sandbox.googleapis.com/v1:signCertificates?challenge=AAABnFXd4WQBILStY-DidJKjBdJ8Z-7wl5mGG7k=&request_id=67806582-81b6-4bda-b296-15b25f07c3e8
US
—
11.8 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
452
mdnsd
224.0.0.251:5353
—
—
—
whitelisted
—
—
142.250.187.196:80
www.google.com
GOOGLE
US
whitelisted
—
—
142.251.141.99:80
connectivitycheck.gstatic.com
GOOGLE
US
whitelisted
—
—
142.250.187.196:443
www.google.com
GOOGLE
US
whitelisted
3957
app_process64
142.251.141.78:80
clients2.google.com
GOOGLE
US
whitelisted
3957
app_process64
142.251.127.84:443
accounts.google.com
GOOGLE
US
whitelisted
3957
app_process64
194.147.100.243:443
www.lvcha.org
SPARTANHOST
GB
unknown
3957
app_process64
142.250.187.196:443
www.google.com
GOOGLE
US
whitelisted
580
app_process64
216.239.35.0:123
time.android.com
GOOGLE
US
whitelisted
1921
app_process64
142.251.141.99:80
connectivitycheck.gstatic.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.174
whitelisted
www.google.com
  • 142.250.187.196
  • 142.251.155.119
  • 142.251.153.119
  • 142.251.152.119
  • 142.251.150.119
  • 142.251.157.119
  • 142.251.156.119
  • 142.251.151.119
  • 142.251.154.119
  • 142.251.143.100
whitelisted
clients2.google.com
  • 142.251.141.78
whitelisted
www.lvcha.org
  • 194.147.100.243
  • 194.147.100.241
  • 194.147.100.240
  • 194.147.100.239
  • 194.147.100.237
  • 194.147.100.248
  • 194.147.100.246
  • 194.147.100.244
unknown
accounts.google.com
  • 142.251.127.84
whitelisted
connectivitycheck.gstatic.com
  • 142.251.141.99
whitelisted
time.android.com
  • 216.239.35.0
  • 216.239.35.4
  • 216.239.35.8
  • 216.239.35.12
whitelisted
staging-remoteprovisioning.sandbox.googleapis.com
  • 64.233.166.81
whitelisted
androidchromeprotect.pa.googleapis.com
  • 142.251.143.106
whitelisted
firebase-settings.crashlytics.com
  • 216.58.206.35
whitelisted

Threats

PID
Process
Class
Message
3957
app_process64
Misc activity
ET INFO LVCHA VPN Domain (lvcha .org) in DNS Lookup
3957
app_process64
Misc activity
ET INFO LVCHA VPN Domain (lvcha .org) in DNS Lookup
1921
app_process64
Misc activity
ET INFO Android Device Connectivity Check
347
netd
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (checkip .amazonaws .com)
4316
app_process64
Device Retrieving External IP Address Detected
ET INFO External IP Check (checkip .amazonaws .com)
4316
app_process64
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request
4316
app_process64
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com)
4316
app_process64
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com)
4316
app_process64
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
4316
app_process64
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.lvcha.org/download/lvcha_101001.apk