File name:

Unknown-8663.apk

Full analysis: https://app.any.run/tasks/14b772f1-b7d6-4682-a401-eebb70571717
Verdict: Malicious activity
Analysis date: December 26, 2025, 19:01:19
OS: Android 14
Indicators:
MIME: application/vnd.android.package-archive
File info: Android package (APK), with AndroidManifest.xml, with APK Signing Block
MD5:

F38BD03970EF1CC319254D0343CDF129

SHA1:

5C012FD543CE3437B67975E9E40C73CE04BF3C20

SHA256:

5E3D77E81A5457A437F4E14DFD11D393C42871EE364D5570FB84C931BC57261D

SSDEEP:

98304:ThIMVmbZAPt0AdjGso1SVNHpmXc0LTxwfGmEBaVvwCODf/iCtwmlU8jC5tl7uhJj:8rbnH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Hides app icon from display

      • app_process64 (PID: 2832)

  • SUSPICIOUS

    • Collects data about the device's environment (JVM version)

      • app_process64 (PID: 2832)

    • Retrieves a list of running application processes

      • app_process64 (PID: 2832)

    • Establishing a connection

      • app_process64 (PID: 2832)

    • Accesses system-level resources

      • app_process64 (PID: 2832)

    • Updates data in the storage of application settings (SharedPreferences)

      • app_process64 (PID: 2832)

    • Creates a WakeLock to manage power state

      • app_process64 (PID: 2832)

    • Acquires a wake lock to keep the device awake

      • app_process64 (PID: 2832)

    • Retrieves Android OS build information

      • app_process64 (PID: 2832)

    • Launches a new activity

      • app_process64 (PID: 2832)

    • Abuses foreground service for persistence

      • app_process64 (PID: 2832)

    • Starts a service

      • app_process64 (PID: 2832)

    • Retrieves the MCC and MNC of the SIM card operator

      • app_process64 (PID: 2832)

    • Retrieves installed applications on device

      • app_process64 (PID: 2832)

    • Checks exemption from battery optimization

      • app_process64 (PID: 2832)

    • Reads messages from SMS inbox

      • app_process64 (PID: 2832)

    • Uses encryption API functions

      • app_process64 (PID: 2832)

  • INFO

    • Returns elapsed time since boot

      • app_process64 (PID: 2832)

    • Loads a native library into the application

      • app_process64 (PID: 2832)

    • Dynamically inspects or modifies classes, methods, and fields at runtime

      • app_process64 (PID: 2832)

    • Detects if debugger is connected

      • app_process64 (PID: 2832)

    • Retrieves data from storage of application settings (SharedPreferences)

      • app_process64 (PID: 2832)

    • Handles throwable exceptions in the app

      • app_process64 (PID: 2832)

    • Retrieves the value of a secure system setting

      • app_process64 (PID: 2832)

    • Gets file name without full path

      • app_process64 (PID: 2832)

    • Verifies whether the device is connected to the internet

      • app_process64 (PID: 2832)

    • Dynamically loads a class in Java

      • app_process64 (PID: 2832)

    • Creates and writes local files

      • app_process64 (PID: 2832)

    • Stores data using SQLite database

      • app_process64 (PID: 2832)

    • Gets the display metrics associated with the device's screen

      • app_process64 (PID: 2832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.apk | Android Package (62.8)
.jar | Java Archive (17.3)
.vym | VYM Mind Map (14.9)
.zip | ZIP compressed archive (4.7)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0801
ZipCompression: Deflated
ZipModifyDate: 2025:12:21 10:43:48
ZipCRC: 0xd0567dae
ZipCompressedSize: 4460
ZipUncompressedSize: 19096
ZipFileName: AndroidManifest.xml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
2832com.chvi.pool /system/bin/app_process64
app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2860com.chvi.pool /system/bin/app_process64—app_process64
User:
u0_a108
Integrity Level:
UNKNOWN
Exit code:
0
3005<pre-initialized> /system/bin/app_process32
app_process32
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
3006webview_zygote /system/bin/app_process32—app_process32
User:
webview_zygote
Integrity Level:
UNKNOWN
Exit code:
9
3038com.android.webview:webview_apk /system/bin/app_process32
app_process32
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
39
Text files
57
Unknown types
0

Dropped files

PID
Process
Filename
Type
2832app_process64/data/data/com.chvi.pool/files/datastore/firebaseSessions/sessionDataStore.data.versionbinary
MD5:F1D3FF8443297732862DF21DC4E57262
SHA256:DF3F619804A92FDB4057192DC43DD748EA778ADC52BC498CE80524C014B81119
2832app_process64/data/data/com.chvi.pool/files/PersistedInstallation8226548393452936306tmptext
MD5:62DD595E2946F1C18AFF8E7990008AD1
SHA256:DAC1C926BC4A8E9CBAD16702611AF25D43913CD5FB841034FDFAE07368B9EE1A
2832app_process64/data/data/com.chvi.pool/shared_prefs/com.google.firebase.crashlytics.xmlxml
MD5:806E9035B743730D7A9F7FC22570F848
SHA256:B6DD0B17726AD913081D48FBEECBE37D441A0ADFFC6272F32DD1356AB3CF7816
2832app_process64/data/data/com.chvi.pool/files/.crashlytics.v3/com.chvi.pool/open-sessions/694EDB8701F200010B103F16F5AB6432/reporttext
MD5:4EBA2A06F9B56B1506AD6054AB216745
SHA256:4FD45FEAE5AD11940047805BBEE451959C0738D47502AE6B5BFA13E1496ED73A
2832app_process64/data/data/com.chvi.pool/files/PersistedInstallation.W0RFRkFVTFRd+MToxMDUyODIxMDY0ODczOmFuZHJvaWQ6ZTViZTBhMDE3ZmM1YzQ4YWQyNmRiOA.jsontext
MD5:62DD595E2946F1C18AFF8E7990008AD1
SHA256:DAC1C926BC4A8E9CBAD16702611AF25D43913CD5FB841034FDFAE07368B9EE1A
2832app_process64/data/data/com.chvi.pool/no_backup/androidx.work.workdb-walbinary
MD5:9FF10108E8DAFDB27E7E06FB4EA105E0
SHA256:97179E4A82C32B5E35007A61B7FAE6F2ACD4F97677517970BFC41ECAFD051E88
2832app_process64/data/data/com.chvi.pool/shared_prefs/com.google.firebase.messaging.xmlxml
MD5:D6B32B6F7842C43A69D96E6BBC0F951E
SHA256:5D262A249D4523AA6285643F3E7D110697E3AA653BF68909D3A56F4FAD151A75
2832app_process64/data/data/com.chvi.pool/no_backup/androidx.work.workdb-journalbinary
MD5:78AED436FCE7A2423B5BF1E979F85238
SHA256:0108D7B3EEDE78A4328D7FC82F5F21E82DEDEE112C40E93EF92B17114493BB04
2832app_process64/data/data/com.chvi.pool/shared_prefs/secure_app_prefs.xmlxml
MD5:49E4C30344D35DDC5DF1C907A5ECB510
SHA256:3FFA2DA356E69931C9A7F016F16FC63985F7F0259BED13817E7247C693587688
2832app_process64/data/data/com.chvi.pool/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDUyODIxMDY0ODczOmFuZHJvaWQ6ZTViZTBhMDE3ZmM1YzQ4YWQyNmRiOA.preferences_pb.tmpbinary
MD5:3DB30698A949E70267255D9DEBC9F623
SHA256:B0F2B6D9A127E655207F36C0C3ADD8762D70B16914C13BD3C17E4521D0B80C13
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
19
DNS requests
15
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
822
app_process64
GET
204
142.250.184.228:443
https://www.google.com/generate_204
US
—
—
whitelisted
—
—
GET
204
142.250.184.228:80
http://www.google.com/gen_204
US
—
—
whitelisted
2832
app_process64
GET
200
172.217.18.3:443
https://firebase-settings.crashlytics.com/spi/v2/platforms/android/gmp/1:1052821064873:android:e5be0a017fc5c48ad26db8/settings?instance=4b40235ec5847ca4cd9a7fff997432ca267a9b2f&build_version=322&display_version=3.2.2&source=1
US
text
739 b
unknown
2832
app_process64
GET
200
172.217.18.3:443
https://firebase-settings.crashlytics.com/spi/v2/platforms/android/gmp/1%3A1052821064873%3Aandroid%3Ae5be0a017fc5c48ad26db8/settings?build_version=322&display_version=3.2.2
US
text
739 b
unknown
822
app_process64
GET
204
142.250.186.131:80
http://connectivitycheck.gstatic.com/generate_204
US
—
—
whitelisted
2832
app_process64
POST
200
142.251.141.74:443
https://firebaseinstallations.googleapis.com/v1/projects/vnisi-feec9/installations
US
text
633 b
whitelisted
1756
app_process64
POST
200
66.102.1.81:443
https://staging-remoteprovisioning.sandbox.googleapis.com/v1:fetchEekChain
US
binary
778 b
whitelisted
1756
app_process64
POST
200
66.102.1.81:443
https://staging-remoteprovisioning.sandbox.googleapis.com/v1:signCertificates?challenge=AAABm1wJpRwBILStYx4ukhlmnG6sJGALVYU4iYA=&request_id=ad4e5718-5db8-423a-bad5-fec4a2be58ca
US
binary
11.8 Kb
whitelisted
3005
app_process32
GET
200
216.58.212.131:443
https://clientservices.googleapis.com/chrome-variations/seed?osname=android_webview&milestone=137
US
compressed
12.4 Kb
whitelisted
3038
app_process32
POST
200
142.250.185.99:443
https://update.googleapis.com/service/update2/json?cup2key=15:LwXzBi4BZkxqIS5C-lar_f5_ISLzFCjLeHkGMu62cJs&cup2hreq=6b52981f6b9e609394e786fbd8c1dbc84661f43374607c80207828e0fd43c53f
US
text
482 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
443
mdnsd
224.0.0.251:5353
—
—
—
whitelisted
—
—
142.250.184.228:443
www.google.com
GOOGLE
US
whitelisted
—
—
142.250.186.131:80
connectivitycheck.gstatic.com
GOOGLE
US
whitelisted
—
—
142.250.184.228:80
www.google.com
GOOGLE
US
whitelisted
2832
app_process64
172.217.18.3:443
firebase-settings.crashlytics.com
GOOGLE
US
whitelisted
2832
app_process64
142.251.141.74:443
firebaseinstallations.googleapis.com
GOOGLE
US
whitelisted
822
app_process64
142.250.184.228:443
www.google.com
GOOGLE
US
whitelisted
571
app_process64
216.239.35.4:123
time.android.com
GOOGLE
US
whitelisted
822
app_process64
142.250.186.131:80
connectivitycheck.gstatic.com
GOOGLE
US
whitelisted
1756
app_process64
66.102.1.81:443
staging-remoteprovisioning.sandbox.googleapis.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
www.google.com
  • 142.250.184.228
whitelisted
firebase-settings.crashlytics.com
  • 172.217.18.3
whitelisted
firebaseinstallations.googleapis.com
  • 142.251.141.74
  • 172.217.23.106
  • 142.251.140.170
  • 142.251.141.106
  • 142.251.208.10
  • 216.58.206.74
  • 216.58.206.42
  • 216.58.212.138
  • 142.250.186.170
  • 142.250.185.202
  • 172.217.18.10
  • 142.250.184.202
  • 142.250.185.138
  • 142.250.186.138
  • 142.250.74.202
  • 142.250.186.106
whitelisted
connectivitycheck.gstatic.com
  • 142.250.186.131
whitelisted
time.android.com
  • 216.239.35.4
  • 216.239.35.12
  • 216.239.35.8
  • 216.239.35.0
whitelisted
staging-remoteprovisioning.sandbox.googleapis.com
  • 66.102.1.81
whitelisted
update.googleapis.com
  • 142.250.185.99
whitelisted
clientservices.googleapis.com
  • 216.58.212.131
whitelisted
c978e75f17.adislran.info
  • 188.114.97.3
  • 188.114.96.3
whitelisted

Threats

PID
Process
Class
Message
822
app_process64
Misc activity
ET INFO Android Device Connectivity Check
339
netd
Misc activity
ET INFO Observed DNS Query to .cfd TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Unknown-8663.apk