Malware analysis https://liteapks.com/radarbot-speed-camera-detector.html Malicious activity

Add for printing

URL:	https://liteapks.com/radarbot-speed-camera-detector.html
Full analysis:	https://app.any.run/tasks/1c7a4f5f-810a-4540-bfc0-5dac37fe78fb
Verdict:	Malicious activity
Analysis date:	January 16, 2026, 17:12:59
OS:	Android 14
Tags:	fingerprinting websocket
Indicators:
MD5:	294DD1D6F029530A5C466C905D75FA30
SHA1:	28F2C81FDD6369A4C076FFF28DD496AA2E510ED0
SHA256:	82E940BCD9F6593C64BEE4A08032AD3E81EEA689CCF68D869D8D8E0EAAA5BE0F
SSDEEP:	3:N8MRgTKXZaIgEMM5uJ:2MWTdmMx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: off
Network:: on

Software preset

android (14)
android.cuttlefish.overlay (14)
android.cuttlefish.phone.overlay (14)
android.ext.services (2019-09)
android.ext.shared (1)
com.android.adservices.api (14)
com.android.apps.tag (1.1)
com.android.backupconfirm (14)
com.android.bips (14)
com.android.bluetoothmidiservice (14)
com.android.bookmarkprovider (14)
com.android.calendar (14)
com.android.calllogbackup (14)
com.android.camera2 (2.0.002)
com.android.cameraextensions (14)
com.android.captiveportallogin (14)
com.android.carrierconfig (1.0.0)
com.android.carrierdefaultapp (14)
com.android.cellbroadcastreceiver (R-initial)
com.android.cellbroadcastreceiver.module (R-initial)
com.android.cellbroadcastservice (R-initial)
com.android.certinstaller (14)
com.android.companiondevicemanager (14)
com.android.compos.payload (14)
com.android.connectivity.resources (S-initial)
com.android.connectivity.resources.cuttlefish.overlay (14)
com.android.contacts (1.7.34)
com.android.credentialmanager (14)
com.android.cts.ctsshim (14-10093150)
com.android.cts.priv.ctsshim (14-10093150)
com.android.deskclock (14)
com.android.devicelockcontroller (14)
com.android.dialer (23.0)
com.android.documentsui (14)
com.android.dreams.basic (14)
com.android.dreams.phototable (14)
com.android.dynsystem (14)
com.android.egg (1.0)
com.android.emergency (14)
com.android.ext.adservices.api (14)
com.android.externalstorage (14)
com.android.federatedcompute.services (T-initial)
com.android.gallery3d (1.1.40030)
com.android.google.gce.gceservice (14)
com.android.health.connect.backuprestore (14)
com.android.healthconnect.controller (14)
com.android.hotspot2.osulogin (14)
com.android.htmlviewer (14)
com.android.imsserviceentitlement (14)
com.android.inputdevices (14)
com.android.inputmethod.latin (14)
com.android.intentresolver (2021-11)
com.android.internal.display.cutout.emulation.corner (1.0)
com.android.internal.display.cutout.emulation.double (1.0)
com.android.internal.display.cutout.emulation.hole (1.0)
com.android.internal.display.cutout.emulation.tall (1.0)
com.android.internal.display.cutout.emulation.waterfall (1.0)
com.android.internal.systemui.navbar.gestural (1.0)
com.android.internal.systemui.navbar.gestural_extra_wide_back (1.0)
com.android.internal.systemui.navbar.gestural_narrow_back (1.0)
com.android.internal.systemui.navbar.gestural_wide_back (1.0)
com.android.internal.systemui.navbar.threebutton (1.0)
com.android.internal.systemui.navbar.transparent (1.0)
com.android.keychain (14)
com.android.launcher3 (14)
com.android.localtransport (14)
com.android.location.fused (14)
com.android.managedprovisioning (14)
com.android.messaging (1.0.001)
com.android.microdroid.empty_payload (14)
com.android.mms.service (14)
com.android.modulemetadata (14)
com.android.mtp (14)
com.android.music (14)
com.android.musicfx (1.4)
com.android.nearby.halfsheet (14)
com.android.networkstack (14)
com.android.networkstack.tethering (14)
com.android.networkstack.tethering.cuttlefishoverlay (1.0)
com.android.nfc (14)
com.android.ondevicepersonalization.services (T-initial)
com.android.ons (14)
com.android.packageinstaller (14)
com.android.pacprocessor (14)
com.android.permissioncontroller (33 system image)
com.android.phone (14)
com.android.printservice.recommendation (1.3.0)
com.android.printspooler (14)
com.android.providers.blockednumber (14)
com.android.providers.calendar (14)
com.android.providers.contacts (14)
com.android.providers.downloads (14)
com.android.providers.downloads.ui (14)
com.android.providers.media (14)
com.android.providers.media.module (14)
com.android.providers.partnerbookmarks (14)
com.android.providers.settings (14)
com.android.providers.settings.cuttlefish.overlay (14)
com.android.providers.telephony (14)
com.android.providers.userdictionary (14)
com.android.provision (14)
com.android.proxyhandler (14)
com.android.quicksearchbox (14)
com.android.rkpdapp (14)
com.android.role.notes.enabled (1.0)
com.android.safetycenter.resources (33 system image)
com.android.sdksandbox (T-initial)
com.android.se (14)
com.android.server.telecom (14)
com.android.settings (14)
com.android.settings.intelligence (14)
com.android.sharedstoragebackup (14)
com.android.shell (14)
com.android.simappdialog (14)
com.android.soundpicker (14)
com.android.statementservice (1.0)
com.android.stk (14)
com.android.storagemanager (14)
com.android.systemui (14)
com.android.systemui.accessibility.accessibilitymenu (14)
com.android.telephony.qns (14)
com.android.theme.font.notoserifsource (1.0)
com.android.traceur (1.0)
com.android.uwb.resources (T-initial)
com.android.virtualmachine.res (14)
com.android.vpndialogs (14)
com.android.wallpaper.livepicker (14)
com.android.wallpaperbackup (14)
com.android.wallpapercropper (14)
com.android.wallpaperpicker (1.0)
com.android.webview (137.0.7122.0)
com.android.wifi.dialog (14)
com.android.wifi.resources (R-initial)
com.android.wifi.resources.cf (1.0)
com.google.android.telephony.satellite (14)
org.chromium.chrome (137.0.7122.0)

Add for printing

MALICIOUS
- Executes system commands or scripts
  - app_process64 (PID: 4449)
- Checks whether the screen is currently on
  - app_process64 (PID: 4449)
SUSPICIOUS
- Accesses system-level resources
  - app_process64 (PID: 4449)
- Collects data about the device's environment (JVM version)
  - app_process64 (PID: 4449)
- Retrieves Android OS build information
  - app_process64 (PID: 4449)
- Establishing a connection
  - app_process64 (PID: 4449)
- Updates data in the storage of application settings (SharedPreferences)
  - app_process64 (PID: 4449)
- Overlays content on other applications
  - app_process64 (PID: 4449)
- Checks if the device's lock screen is showing
  - app_process64 (PID: 4449)
- Retrieves the MCC and MNC of the SIM card operator
  - app_process64 (PID: 4449)
- Accesses external device storage files
  - app_process64 (PID: 4449)
- Accesses memory information
  - app_process64 (PID: 4449)
- Returns the name of the current network operator
  - app_process64 (PID: 4449)
- Queries device location using GPS
  - app_process64 (PID: 4449)
- Retrieves installed applications on device
  - app_process64 (PID: 4449)
- Acquires a wake lock to keep the device awake
  - app_process64 (PID: 4449)
- Creates a WakeLock to manage power state
  - app_process64 (PID: 4449)
- Checks exemption from battery optimization
  - app_process64 (PID: 4449)
- Retrieves a list of running application processes
  - app_process64 (PID: 4449)
INFO
- Dynamically inspects or modifies classes, methods, and fields at runtime
  - app_process64 (PID: 4449)
- Stores data using SQLite database
  - app_process64 (PID: 4449)
- Gets the display metrics associated with the device's screen
  - app_process64 (PID: 4449)
- Loads a native library into the application
  - app_process64 (PID: 4449)
- Returns elapsed time since boot
  - app_process64 (PID: 4449)
- Retrieves data from storage of application settings (SharedPreferences)
  - app_process64 (PID: 4449)
- Gets file name without full path
  - app_process64 (PID: 4449)
- Verifies whether the device is connected to the internet
  - app_process64 (PID: 4449)
- Retrieves the value of a system setting
  - app_process64 (PID: 4449)
- Creates and writes local files
  - app_process64 (PID: 4449)
- Handles throwable exceptions in the app
  - app_process64 (PID: 4449)
- Retrieves the value of a secure system setting
  - app_process64 (PID: 4449)
- Dynamically registers broadcast event listeners
  - app_process64 (PID: 4449)
- Retrieves CPU core information
  - app_process64 (PID: 4449)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

148

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
3963	org.chromium.chrome	/system/bin/app_process64		app_process64
User: root Integrity Level: UNKNOWN
4015	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN
4026	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN
4042	com.android.traceur	/system/bin/app_process64	—	app_process64
User: u0_a54 Integrity Level: UNKNOWN Exit code: 512
4063	org.chromium.chrome:privileged_process0	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN
4066	com.android.adservices.api	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN
4145	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN
4167	com.android.providers.partnerbookmarks	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN
4254	/system/bin/dmesgd	/system/bin/dmesgd	—	init
User: dmesgd Integrity Level: UNKNOWN Exit code: 0
4255	dmesg	/system/bin/toybox	—	dmesgd
User: dmesgd Integrity Level: UNKNOWN Exit code: 0

Add for printing

Total events

Read events

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

650

Text files

253

Unknown types

Dropped files

PID	Process	Filename		Type
4449	app_process64	/data/data/com.vialsoft.radarbot_free/files/PersistedInstallation5369464910507495276tmp		text
		MD5:—	SHA256:—
4449	app_process64	/data/data/com.vialsoft.radarbot_free/files/PersistedInstallation.W0RFRkFVTFRd+MToxMDc4NzIxMjY1NzIwOmFuZHJvaWQ6OGVkODg0YmVjOWY4OTdkNw.json		text
		MD5:—	SHA256:—
4449	app_process64	/data/data/com.vialsoft.radarbot_free/shared_prefs/com.google.firebase.inappmessaging.xml		xml
		MD5:—	SHA256:—
4449	app_process64	/data/data/com.vialsoft.radarbot_free/files/datastore/aqs/sessionConfigsDataStore.data.version		binary
		MD5:—	SHA256:—
4449	app_process64	/data/data/com.vialsoft.radarbot_free/files/datastore/aqs/sessionDataStore.data.version		binary
		MD5:—	SHA256:—
4449	app_process64	/data/data/com.vialsoft.radarbot_free/files/.crashlytics.v3/com.vialsoft.radarbot_free/open-sessions/696A7223010700011161D1854F7E2554/report		text
		MD5:—	SHA256:—
4449	app_process64	/data/data/com.vialsoft.radarbot_free/files/.crashlytics.v3/com.vialsoft.radarbot_free/open-sessions/696A7223010700011161D1854F7E2554/internal-keys		text
		MD5:—	SHA256:—
4449	app_process64	/data/data/com.vialsoft.radarbot_free/shared_prefs/com.google.firebase.messaging.xml		xml
		MD5:—	SHA256:—
4449	app_process64	/data/data/com.vialsoft.radarbot_free/shared_prefs/com.google.firebase.crashlytics.xml		xml
		MD5:—	SHA256:—
4449	app_process64	/data/data/com.vialsoft.radarbot_free/no_backup/androidx.work.workdb-journal		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

259

TCP/UDP connections

114

DNS requests

141

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3963	app_process64	GET	200	104.26.14.148:443	https://liteapks.com/radarbot-speed-camera-detector.html	US	html	97.1 Kb	unknown
3963	app_process64	GET	200	142.250.185.78:80	http://clients2.google.com/time/1/current?cup2key=9:cfmUihVDyt8VHtLwq2rKkPstzCyP3MG2fgdu3Cz9hoM&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	US	text	106 b	whitelisted
3963	app_process64	GET	200	104.26.14.148:443	https://liteapks.com/wp-includes/css/dist/block-library/style.min.css?ver=b526d999fd5b2e6cc0839ec6c0c94a8f	US	text	116 Kb	unknown
1921	app_process64	GET	204	142.251.208.3:80	http://connectivitycheck.gstatic.com/generate_204	US	—	—	whitelisted
3963	app_process64	GET	200	104.26.14.148:443	https://liteapks.com/wp-content/themes/new-theme-k/css/bootstrap.min.css?ver=2	US	text	128 Kb	unknown
3963	app_process64	GET	200	104.26.14.148:443	https://liteapks.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1	US	text	13.2 Kb	unknown
3963	app_process64	GET	200	104.26.14.148:443	https://liteapks.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	US	text	85.5 Kb	unknown
3963	app_process64	GET	200	104.26.14.148:443	https://liteapks.com/wp-content/themes/new-theme-k/images/google-play.png	US	image	1.09 Kb	unknown
1921	app_process64	GET	204	172.217.20.132:80	http://www.google.com/gen_204	US	—	—	whitelisted
3963	app_process64	GET	200	104.26.14.148:443	https://liteapks.com/wp-content/themes/new-theme-k/style.css?ver=2.0.1	US	text	17.1 Kb	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
452	mdnsd	224.0.0.251:5353	—	—	—	whitelisted
—	—	142.251.208.3:80	connectivitycheck.gstatic.com	GOOGLE	US	whitelisted
—	—	172.217.20.132:443	www.google.com	GOOGLE	US	whitelisted
1921	app_process64	172.217.20.132:80	www.google.com	GOOGLE	US	whitelisted
3963	app_process64	142.250.185.78:80	clients2.google.com	GOOGLE	US	whitelisted
3963	app_process64	104.26.14.148:443	liteapks.com	CLOUDFLARENET	US	whitelisted
3963	app_process64	172.217.20.132:443	www.google.com	GOOGLE	US	whitelisted
3963	app_process64	108.177.15.84:443	accounts.google.com	GOOGLE	US	whitelisted
3963	app_process64	192.0.76.3:443	stats.wp.com	AUTOMATTIC	US	whitelisted
3963	app_process64	142.250.184.232:443	www.googletagmanager.com	GOOGLE	US	whitelisted

DNS requests

Domain	IP	Reputation
google.com	142.250.184.206	whitelisted
www.google.com	172.217.20.132	whitelisted
clients2.google.com	142.250.185.78	whitelisted
liteapks.com	104.26.14.148 172.67.73.174 104.26.15.148	whitelisted
accounts.google.com	108.177.15.84	whitelisted
stats.wp.com	192.0.76.3	whitelisted
www.googletagmanager.com	142.250.184.232	whitelisted
static.cloudflareinsights.com	104.16.79.73 104.16.80.73	whitelisted
pixel.wp.com	192.0.76.3	whitelisted
content-autofill.googleapis.com	172.217.20.138 142.250.185.202 142.251.140.170 216.58.206.74 142.251.208.10 142.250.184.202 142.250.184.234 142.251.141.138 172.217.23.106 142.250.185.170 142.250.185.138 142.250.186.138 172.217.18.10 142.251.141.106 142.251.141.74 142.250.186.170	whitelisted

Threats

PID	Process	Class	Message
3963	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3963	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
1921	app_process64	Misc activity	ET INFO Android Device Connectivity Check
3963	app_process64	Potentially Bad Traffic	SUSPICIOUS [ANY.RUN] Possible Domain Associated with Malware Distribution (ukankingwithea .com)
3963	app_process64	Potentially Bad Traffic	SUSPICIOUS [ANY.RUN] Possible Domain Associated with Malware Distribution (ghabovethec .info)
—	—	Attempted Information Leak	SUSPICIOUS [ANY.RUN] FingerprintJS Usage Observed in HTTP response
3963	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
—	—	Attempted Information Leak	SUSPICIOUS [ANY.RUN] FingerprintJS Usage Observed in HTTP response
3963	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
3963	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)

Add for printing

No debug info

General Info

https://liteapks.com/radarbot-speed-camera-detector.html

294DD1D6F029530A5C466C905D75FA30

28F2C81FDD6369A4C076FFF28DD496AA2E510ED0

82E940BCD9F6593C64BEE4A08032AD3E81EEA689CCF68D869D8D8E0EAAA5BE0F

3:N8MRgTKXZaIgEMM5uJ:2MWTdmMx

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Executes system commands or scripts

Checks whether the screen is currently on

SUSPICIOUS

Accesses system-level resources

Collects data about the device's environment (JVM version)

Retrieves Android OS build information

Establishing a connection

Updates data in the storage of application settings (SharedPreferences)

Overlays content on other applications

Checks if the device's lock screen is showing

Retrieves the MCC and MNC of the SIM card operator

Accesses external device storage files

Accesses memory information

Returns the name of the current network operator

Queries device location using GPS

Retrieves installed applications on device

Acquires a wake lock to keep the device awake

Creates a WakeLock to manage power state

Checks exemption from battery optimization

Retrieves a list of running application processes

INFO

Dynamically inspects or modifies classes, methods, and fields at runtime

Stores data using SQLite database

Gets the display metrics associated with the device's screen

Loads a native library into the application

Returns elapsed time since boot

Retrieves data from storage of application settings (SharedPreferences)

Gets file name without full path

Verifies whether the device is connected to the internet

Retrieves the value of a system setting

Creates and writes local files

Handles throwable exceptions in the app

Retrieves the value of a secure system setting

Dynamically registers broadcast event listeners

Retrieves CPU core information

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings