Analysis
-
max time kernel
1933225s -
max time network
136s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
12/04/2023, 02:07
Static task
static1
Behavioral task
behavioral1
Sample
Padorus_Stuffed_XXXmas_v.1.0_h-game18.apk
Resource
android-x86-arm-20220823-en
3 signatures
150 seconds
General
-
Target
Padorus_Stuffed_XXXmas_v.1.0_h-game18.apk
-
Size
121.5MB
-
MD5
56234c13adcb6da61b3a543e3c341f03
-
SHA1
439822094f6a2e39168eed2b81123bb478e659a5
-
SHA256
8ca5a40339ab47126c2870b36761f20621e12af9c8546daf02865bffa8c4ab1c
-
SHA512
07ed993bbc772553ee27ec84a5752d766f41a04c7914d6b756e706effc213d9e47aa9992de5a9862b2185f5d9d5b2e62516a731adabf5af0a40131764d031045
-
SSDEEP
3145728:sSvDbLVN/bsmc2Qc6SPeem+YnIzcoWlbKsBoXlhgoTL+t:sS7Nq2RReUd8bKsB0lKoH+t
Score
7/10
Malware Config
Signatures
-
Checks Android system properties for emulator presence. 6 IoCs
description ioc Process Accessed system property key: ro.hardware com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: ro.product.name com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: ro.product.model com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: ro.product.device com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: ro.bootmode com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: ro.bootloader com.NowaJoestarStudios.PadorusStuffedXXXmas -
Checks Qemu related system properties. 10 IoCs
Checks for Android system properties related to Qemu for Emulator detection.
description ioc Process Accessed system property key: qemu.hw.mainkeys com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: qemu.sf.fake_camera com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: qemu.logcat com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: ro.kernel.qemu com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: ro.kernel.qemu.gles com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: ro.kernel.qemu.vsync com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: vendor.qemu.dev.bootcomplete com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: ro.kernel.android.qemud com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: init.svc.qemu-props com.NowaJoestarStudios.PadorusStuffedXXXmas Accessed system property key: qemu.gles com.NowaJoestarStudios.PadorusStuffedXXXmas -
Reads information about phone network operator.