| File name: | Wedding invition.apk |
| Full analysis: | https://app.any.run/tasks/98ebbf9a-2f71-402f-9a66-4d5953d1271c |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | June 24, 2025, 13:06:39 |
| OS: | Android 14 |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.android.package-archive |
| File info: | Android package (APK), with AndroidManifest.xml, with APK Signing Block |
| MD5: | FB0DD8934CB66EA107F605EA25E9450A |
| SHA1: | 9B5F384B7B4D7086FF6E4990637C6DA810918851 |
| SHA256: | 6B9B6289BF29482400973E100B12494FCE3048B45E10D64BFF09A3DA812C0D50 |
| SSDEEP: | 98304:gbtlCThN9sbe9pSZG1HcmERelI+yDtvY96DlmzRMJXu85ySmrcY+hCQrLiRAckFg:gbmgSEHQjz0Ny |
MALICIOUS
Determines whether a component is an active device admin
- app_process64 (PID: 2381)
TANGLEBOT has been detected
- app_process64 (PID: 2381)
SPYNOTE has been detected
- app_process64 (PID: 2381)
SUSPICIOUS
Launches a new activity
- app_process64 (PID: 2255)
- app_process64 (PID: 2381)
Collects data about the device's environment (JVM version)
- app_process64 (PID: 2255)
Scans for popular installed apps
- app_process64 (PID: 2255)
Uses encryption API functions
- app_process64 (PID: 2381)
Accesses external device storage files
- app_process64 (PID: 2381)
Abuses foreground service for persistence
- app_process64 (PID: 2381)
Checks exemption from battery optimization
- app_process64 (PID: 2381)
Updates data in the storage of application settings (SharedPreferences)
- app_process64 (PID: 2381)
Prevents its uninstallation by user
- app_process64 (PID: 2381)
Overlays content on other applications
- app_process64 (PID: 2381)
Performs UI accessibility actions without user input
- app_process64 (PID: 2381)
Retrieves a list of running services
- app_process64 (PID: 2381)
Establishing a connection
- app_process64 (PID: 2381)
Creates a WakeLock to manage power state
- app_process64 (PID: 2381)
Acquires a wake lock to keep the device awake
- app_process64 (PID: 2381)
Requests access to accessibility settings
- app_process64 (PID: 2381)
Starts a service
- app_process64 (PID: 2381)
Detects when screen powers off
- app_process64 (PID: 2381)
Intercepts events for accessibility services
- app_process64 (PID: 2381)
Connects to unusual port
- app_process64 (PID: 2381)
INFO
Gets file name without full path
- app_process64 (PID: 2255)
- app_process64 (PID: 2381)
Dynamically inspects or modifies classes, methods, and fields at runtime
- app_process64 (PID: 2381)
Loads a native library into the application
- app_process64 (PID: 2381)
Gets the display metrics associated with the device's screen
- app_process64 (PID: 2381)
Retrieves data from storage of application settings (SharedPreferences)
- app_process64 (PID: 2381)
Retrieves the value of a secure system setting
- app_process64 (PID: 2381)
Dynamically registers broadcast event listeners
- app_process64 (PID: 2381)
Returns elapsed time since boot
- app_process64 (PID: 2381)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | 0x0800 |
| ZipCompression: | Unknown (17364) |
| ZipModifyDate: | 2025:06:23 21:30:22 |
| ZipCRC: | 0xf36030f0 |
| ZipCompressedSize: | 3549 |
| ZipUncompressedSize: | 10140 |
| ZipFileName: | AndroidManifest.xml |
Total processes
130
Monitored processes
5
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2255 | com.cristal.bristral.tristal.mistral | /system/bin/app_process64 | — | app_process64 |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2360 | /apex/com.android.art/bin/artd | /apex/com.android.art/bin/artd | — | init |
User: artd Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2371 | /apex/com.android.art/bin/dex2oat32 --zip-fd=6 --zip-location=/data/app/~~YhdOLNcrO0q47uIBRvF9KA==/com.android.pictach-sWiNl---RSyOanSHSZTftQ==/base.apk --oat-fd=7 --oat-location=/data/app/~~YhdOLNcrO0q47uIBRvF9KA==/com.android.pictach-sWiNl---RSyOanSHSZTftQ==/oat/arm64/base.odex --output-vdex-fd=8 --swap-fd=9 --class-loader-context=PCL[] --classpath-dir=/data/app/~~YhdOLNcrO0q47uIBRvF9KA==/com.android.pictach-sWiNl---RSyOanSHSZTftQ== --instruction-set=arm64 --instruction-set-features=default --instruction-set-variant=cortex-a53 --compiler-filter=verify --compilation-reason=install --compact-dex-level=none --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --runtime-arg -Xtarget-sdk-version:33 --runtime-arg -Xhidden-api-policy:enabled --runtime-arg -Xms64m --runtime-arg -Xmx512m --comments=app-version-name:1.0,app-version-code:1,art-version:340090000 | /apex/com.android.art/bin/dex2oat32 | — | artd |
User: artd Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2381 | <pre-initialized> | /system/bin/app_process64 | app_process64 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2450 | <pre-initialized> | /system/bin/app_process64 | — | app_process64 |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
4
Text files
5
Unknown types
15
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2255 | app_process64 | /data/data/com.cristal.bristral.tristal.mistral/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫. | mpg | |
MD5:— | SHA256:— | |||
| 2255 | app_process64 | /data/data/com.cristal.bristral.tristal.mistral/cache/oat_primary/arm64/base.2255.tmp | binary | |
MD5:— | SHA256:— | |||
| 2255 | app_process64 | /data/data/com.cristal.bristral.tristal.mistral/files/profileInstalled | binary | |
MD5:— | SHA256:— | |||
| 2381 | app_process64 | /data/data/com.android.pictach/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫. | mpg | |
MD5:— | SHA256:— | |||
| 2381 | app_process64 | /data/data/com.android.pictach/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫ | compressed | |
MD5:— | SHA256:— | |||
| 2381 | app_process64 | /data/data/com.android.pictach/files/arm/classes.dex | dex | |
MD5:— | SHA256:— | |||
| 2381 | app_process64 | /data/data/com.android.pictach/files/arm/classes10.dex | dex | |
MD5:— | SHA256:— | |||
| 2381 | app_process64 | /data/data/com.android.pictach/files/arm/classes11.dex | dex | |
MD5:— | SHA256:— | |||
| 2381 | app_process64 | /data/data/com.android.pictach/files/arm/classes12.dex | dex | |
MD5:— | SHA256:— | |||
| 2381 | app_process64 | /data/data/com.android.pictach/files/arm/classes2.dex | dex | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
152
DNS requests
5
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 172.217.16.195:80 | http://connectivitycheck.gstatic.com/generate_204 | US | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
446 | mdnsd | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 142.250.186.164:443 | www.google.com | GOOGLE | US | whitelisted |
— | — | 172.217.16.195:80 | connectivitycheck.gstatic.com | GOOGLE | US | whitelisted |
— | — | 216.239.35.0:123 | time.android.com | — | — | whitelisted |
— | — | 142.250.27.81:443 | staging-remoteprovisioning.sandbox.googleapis.com | GOOGLE | US | whitelisted |
2381 | app_process64 | 103.167.151.50:9997 | — | HOSTHATCH | SG | unknown |
2381 | app_process64 | 154.61.80.131:1200 | — | COGENT-174 | NL | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
connectivitycheck.gstatic.com |
| whitelisted |
www.google.com |
| whitelisted |
time.android.com |
| whitelisted |
google.com |
| whitelisted |
staging-remoteprovisioning.sandbox.googleapis.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET INFO Android Device Connectivity Check |