Analysis

  • max time kernel
    179s
  • max time network
    180s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    24-05-2024 13:01

General

  • Target

    Root_Checker_5.9.4.apk

  • Size

    6.8MB

  • MD5

    9e2eae5051f3834834a0346712bda07a

  • SHA1

    2dc4aa2b57ce8ce580dbf642a0ed0cbefa015277

  • SHA256

    771e05a0caa0822e6cda930d66447d00772c2ba36fe83e62154b6a0d76413b0e

  • SHA512

    20e902044289f1bf11b6304dd91df1a0deb07955b1c7c6ab75fb2e89e4b0e81594f92585279c3acd7d790c37b72e92c512535ee48fda0eef0c69d1f0498542f7

  • SSDEEP

    98304:s8ALShhdccY2qtJFUhK7W59Ddua60PNITWBnnY+qFsHYA2HKraYCpyV+5:ASfqd7t7UN5buaXNqG4pqrah

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Checks the presence of a debugger
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.joeykrim.rootcheck
    1⤵
    • Checks if the Android device is rooted.
    • Checks Android system properties for emulator presence.
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4250

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.joeykrim.rootcheck/app_0de7788050864972a25d2d9c40c503e0515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFile
    Filesize

    567B

    MD5

    5785fb32456f0934c19c0793a85e4a0e

    SHA1

    0937800c80b5eedd08d8dfc20895a20dec9964bb

    SHA256

    a72ae188b483b0c54c9e4c8c62ae76f3efbd62b439ccecafcf9dde81e84c48d4

    SHA512

    18c6aa95df81e49b228ad9fc339d44a2adc10376c4aa098644d8cdcaf9560a3099606df637744d37f180e3a6ea2a0fa6b7bd1dfd9e84e9c87c8b9925348f6334

  • /data/data/com.joeykrim.rootcheck/app_0de7788050864972a25d2d9c40c503e0515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFile
    Filesize

    596B

    MD5

    14290eefd01d0514754561359edec9c8

    SHA1

    d7fe7ed88781aabd8773f1a38ff316c8d2144401

    SHA256

    7d2404d5baee11410fce3b43733ba017e180a0c1b320b95e4d5604f9baeb72ea

    SHA512

    1e86e07a718d50b8500c3ed1714439ad162a59518f0bd58f081d9696671fa094b51e87ca709d492719a1f4a03b2d2ec75d84f332f11385cb4af530e37dc59458

  • /data/data/com.joeykrim.rootcheck/app_0de7788050864972a25d2d9c40c503e0515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFile
    Filesize

    576B

    MD5

    e0c0051f8eb658987f01828a8d612054

    SHA1

    5009bb7f48d63edc67100d5e64421f49906f7a63

    SHA256

    7f1f14e200eb9cc555f9c90ccc93b76561bef9bed768d9773a1048394b18b463

    SHA512

    c570446fcf2580cea3b1d13534848726f7b187af031474b1722953152648c58d1e89c8251901e3e5d08351e2cb44eb43a48c58d22ab2d343345fd1da4b6f4ff7

  • /data/data/com.joeykrim.rootcheck/app_0de7788050864972a25d2d9c40c503e0515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFile
    Filesize

    571B

    MD5

    be20f3e7f074233d6389663cf1feb30d

    SHA1

    594f245d9723d03165d2dd8c76b2d66bd71b3feb

    SHA256

    2b6b7446f9b330a918d5f7851fd413ab924df694c31e535abc75ba0e124af4d3

    SHA512

    2dba796759c067e9532388c21a849994db6e6469cfdce147409777aa7d7af6f2e03e3193014a174f33ce36e10d3dd46f40f2727e00ba1e9e3b86af4ce1c00fa5

  • /data/data/com.joeykrim.rootcheck/app_0de7788050864972a25d2d9c40c503e0515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFile
    Filesize

    537B

    MD5

    c9c4c4fe3c62515c444b902f14e4ba7e

    SHA1

    7f9e094e10a8c0ab5c738541d0d196f4a8921b30

    SHA256

    4dc36c200c51a9d4978f7666f8391fa1e693b7410d24b7aa21127cb9a70427d2

    SHA512

    c11945162f4e99046b42da32ee465bc505200388732a8fed4266c1dea483dac232b20014c50b1e70a41d4b901856d51549064e14d2f55362a37f992cc66b6dc7

  • /data/data/com.joeykrim.rootcheck/app_febcf37b1b614b9dbd822fb2f448801e/events/eventsFile
    Filesize

    493B

    MD5

    83031358d6ce444c2446af8a1d12aeda

    SHA1

    4ab486f41a894ec62432dd485a42d14ba18c9843

    SHA256

    93b7df80c3433b5dfddcf2bc257f94f3f689a5e1eae45f939b858a7a382ea834

    SHA512

    b9dc7f9e60f2c5b704975dcb119910dc00f709d9841ab4e8e96d39c4d6f75b395fdcc8bb2d258ca4f1b07af5f832b8712a7e0790a93ea6dcf0763f2136f61c72

  • /data/data/com.joeykrim.rootcheck/app_febcf37b1b614b9dbd822fb2f448801e/events/eventsFile
    Filesize

    493B

    MD5

    fbc60604aa357541d6cbb17a8f0834c8

    SHA1

    3865098b14c7e865e1d3a86eb2666b9162d9f850

    SHA256

    32187a2095fd917a6930e26dd61a162104f105f99a52679594376ba2a441b976

    SHA512

    877861c727a17e2bad92c4da8125ac39a5f398df82a2cf032d66575efcda6dae73977b1a9e1946abcbe8740c5505d3d783b215056ce3334fbd5fd86e20081498

  • /data/data/com.joeykrim.rootcheck/app_febcf37b1b614b9dbd822fb2f448801e/events/eventsFile
    Filesize

    601B

    MD5

    5fe86e5912516e52ccc52cc5294cbd04

    SHA1

    fa29358ee06dda6842dc8db6d30831afe8291068

    SHA256

    bc5cdc9933472675c6dec975944c9229d9c29e8de777e983a7a1f4b48c9ee81c

    SHA512

    2b41c777814d67dad253f6d994fcc8d246bd464191a7f60af4ebeca80caf6b74a4091f7e77b4dced18d4a7d411ffe5be731a8c3bc91883e213aea36deece1f0f

  • /data/data/com.joeykrim.rootcheck/app_febcf37b1b614b9dbd822fb2f448801e/events/eventsFile
    Filesize

    601B

    MD5

    63bc8b9866cc1fc4a35cbb36fcfbc267

    SHA1

    8ba60626e6972d97cd1575488b013f8f35edef3f

    SHA256

    f3ea831af71abc30f3727b34cddda14a1a399004794ba2b5572df2d65392d44a

    SHA512

    ebfc72378196d88798f59bfeec67533a74a3a721d5520bf19d6c5859283ac2ed972a3e20d1ae7e86b99d43bafd686eb616401f8b11cd65e7d0bb7e7b549daaac

  • /data/data/com.joeykrim.rootcheck/cache/1582435991586.jar
    Filesize

    9KB

    MD5

    e8e0527a01aefdb89afd2c508f131da1

    SHA1

    f1103e6b260c657ceb3d95f1b023af3fda8b133a

    SHA256

    f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

    SHA512

    fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

  • /data/data/com.joeykrim.rootcheck/cache/oat/1582435991586.jar.cur.prof
    Filesize

    148B

    MD5

    a3b78d197d786c13687c3f0f89703bd8

    SHA1

    9967f0726b6b1ed3f198904547b81920f8329621

    SHA256

    c5e6754556dbe01b055066f23c28ddaaf5fe67cee4baed00d59dc993335b3d97

    SHA512

    9a47c9bb977edec9d29d22f280e0078ca931a722eaecc2b085c6b5aaf6246d17a6ad07c9faca45070bb5b89a3ee6cf896f5e2c7e73fb033e3ac57471df70a8b1

  • /data/data/com.joeykrim.rootcheck/databases/google_analytics_v4.db
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.joeykrim.rootcheck/databases/google_analytics_v4.db-journal
    Filesize

    512B

    MD5

    ae43e2835d41478740ff6ab3acbf72c3

    SHA1

    546338ac7e7a20f286b17c16634512df9f4e2bd7

    SHA256

    ab111a8c850197fdef9fb07943594a3667be0e349d3595ea05c7ec6382ac2f0e

    SHA512

    9d16b6d39339e9afb97ee665098b1f12672791c815fcf00b9bff0c94b731f4b96d4f013da119da7ce65b5a3ad81fbf14f4a40f5952f9c187451c2b70c65d5417

  • /data/data/com.joeykrim.rootcheck/databases/google_analytics_v4.db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.joeykrim.rootcheck/databases/google_analytics_v4.db-wal
    Filesize

    245KB

    MD5

    de86ff82eff92c41dec113657c848c7c

    SHA1

    e6f785b25709bf91cf42b728e4dd0ea01c5fbab5

    SHA256

    ca3c568a466ff23a359bb602633fdbb640972cc1b3793d04cb564a5be4d44ea7

    SHA512

    4ac42eab79e8bc8a6ddd0f381a0b009cb0a96c338691b699d1845ff73aa1c9af006cbb59da7e07d4a20e110574865aa50f25f2ae0a6b6fd8faf174a9ef6cfda4

  • /data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/665093D80022-0001-109A-E06C5FECBA9EBeginSession.cls_temp
    Filesize

    77B

    MD5

    ffc55c8117ca5df8485b4cc6ddb8f31d

    SHA1

    e60e6b0eebccd2df4a167332b2f33db08cee04ab

    SHA256

    b51205c595435512d00fceb0e6410d6fb4b49135179698d5971a928b2355ca56

    SHA512

    529d2d64ce89d4de540db696ce44720490fe0d7df5d4265c550e1dd250a58ab867ddfd3e48f48c6d349437ca9b7d1e7747b38c67e78e58d4b22db18a3e30f3ce

  • /data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/665093D80022-0001-109A-E06C5FECBA9ESessionApp.cls_temp
    Filesize

    118B

    MD5

    1be83e818fc60bc099757048f1557d40

    SHA1

    2448836919f173bf498511b1d66e6900e4736670

    SHA256

    8b94597914911191b29b885d73705eacfd9df014d26aff9b1aa50459fd6b0862

    SHA512

    2413000822a9e1bc03c46efb06a64d86542ac3b783f8f4d2ce99504a560663416fa9650ea5bfac99867c0152acf9880273c43c7fc64de214915436e2e84420f0

  • /data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/665093D80022-0001-109A-E06C5FECBA9ESessionDevice.cls_temp
    Filesize

    131B

    MD5

    6e555fa12d9b147f9e0620c6d6a616fe

    SHA1

    dc5280d0e934d169e815dba8d8fc40d578278672

    SHA256

    bb9b3daf81addd99b28148a221d0e4c85fd424003deb45e2954677be661af363

    SHA512

    be37740342412d3e9c59689c92ca8cba5b7bce8b27e6c14fd497dc2a3f188a7e02af6aa5bbda9be188383346209897142e0dbfdc80c39a8d5d6bc1a22baa18cd

  • /data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/665093D80022-0001-109A-E06C5FECBA9ESessionOS.cls_temp
    Filesize

    14B

    MD5

    9b3d4522944ce6396563812bfdb92fa9

    SHA1

    6d2a6133c8f01938a48ccc77ef86ad8ca335c020

    SHA256

    d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9

    SHA512

    091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727

  • /data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
    Filesize

    540B

    MD5

    69ebe37f94c771c6a1c850ebcd25c218

    SHA1

    6601db32201f682432dcca8b9d6e727f2e06d95d

    SHA256

    ec813abed77457f6e77db103d1bbd74a8ee028263c1c628226005865bf76590d

    SHA512

    f64b90343c5bd09f2839f95e93afa7f23080302270e598aeebbb375961ecfff4278a0bdaa7f37d6f79ba6eac84ddf363a44d95fabb5b162189dd1c386b6c4f0a

  • /data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
    Filesize

    1KB

    MD5

    28a6e674f18d462d43e4cf8a9ca38678

    SHA1

    606a31f85d8bbec0f76488fd74080a0cec32dde2

    SHA256

    58db2a7246492142cdcb5cd20f8daa9e0dd9dfcbbe72fb4465615789685e3b48

    SHA512

    76c2e17a69abf57224cb5e2c08d0f614fda8ec9f9900e363017fb64f6d5ff817652d64b54a97806f00c02dca7f9ebb0880ee6967f4894a0d527c84cb4611499f

  • /data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
    Filesize

    16B

    MD5

    c33583fae4e0b61cde1c5b9227963237

    SHA1

    fe2ebe4d27469af1460f7e852031a04208ef629b

    SHA256

    35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

    SHA512

    fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

  • /data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_15dc3c91-8d7c-43c4-86e1-eeacc67c9a38_1716556766517.tap
    Filesize

    412B

    MD5

    affa1b0c725757f8af04aaf93e23701f

    SHA1

    b0d93335b62049378e1ed363d92061a0835e3705

    SHA256

    e008509c849c2974814a5667915485a752009d836a686d0b849e397383c3c31a

    SHA512

    fcae13209b1606bf1188eeb771083506a5c562995dafd12428a8a039f401f98f96dda4044300959b016affd56f0faa2261e844ba29925aaf4ecfe5633e27e1c0

  • /data/data/com.joeykrim.rootcheck/files/.YFlurrySenderIndex.info.AnalyticsData_RG6P5WWKVXRC8CPTJZJT_211
    Filesize

    88B

    MD5

    4f6cc70618f526b37c83d8ac84bac85f

    SHA1

    b8ee9f3be1642cb7e49e6dbab1f98b5c4d98cdf6

    SHA256

    ddbd3d180cf41cd713cd6d14e1aedcfe37fbd8835d6ae9dec90d255734bcda6a

    SHA512

    80a983459c44292ca45c08a7a328b74e594a04ce0e74318f224eac072ab7265f7b54530d672aa076bc13fb66748e3e2f10df38478f2bd7b6fc08fafb7fe9a8ef

  • /data/data/com.joeykrim.rootcheck/files/.YFlurrySenderIndex.info.AnalyticsMain
    Filesize

    72B

    MD5

    9d52b65d0631d3dfff877c5bf56a8440

    SHA1

    9d66929722fd30153a57e30f0f68f17380e2b0e1

    SHA256

    36936bb994843fbb0b91fad190471623a66ccd059f85ccbeed8d755d4fb3c98f

    SHA512

    170cfdd8ac8959e0fbe9a261cef3c5c7a0848b426c9cb6eb2fe0dd296d1d71bc6e1c8348d5c887c69ef1c312f711df4cee402ab9ffd3da0f88801d018a3444e7

  • /data/data/com.joeykrim.rootcheck/files/.yflurrydatasenderblock.905d4418-8ab7-4d04-b5fa-eface9dd3ca2
    Filesize

    305B

    MD5

    4fa68e8151d9556ffd388852209e8fa1

    SHA1

    3c55c0d8c44c492ecaba96943f766d98ae0d9f3c

    SHA256

    44ad4770180d0a455aef6f53cb5023a11903a1d93007071a41f44ed07d9cee38

    SHA512

    a9b2cbe9bdafb3cef017f3f44c2095412f45ec0fc6f545d13377d52615fbda43505d65cb9fe8326627af1b2912e2d8ddc9afcfca45bd6fe74e6e5f9cbeff7abf

  • /data/data/com.joeykrim.rootcheck/files/AppEventsLogger.persistedsessioninfo
    Filesize

    495B

    MD5

    468bc467366255679b5ce89d5cb49828

    SHA1

    045fe23b67672062fd379013cf0cc4b51a449ef6

    SHA256

    9ac0a3b209c61c4a1915a147df683c979a0b31246d5e5bd93902b2283ba2b81e

    SHA512

    7a486384e7146d400b863f33e5a43822b13bb59eadce8a27f7b80e9be7b4de16fca9912b4ab95ddb7c5b886928a33fd9fa29ec9565e5587db37534081dc4311c

  • /data/data/com.joeykrim.rootcheck/files/gaClientId
    Filesize

    36B

    MD5

    3f84e966873ddb90e9daa19b66309b1b

    SHA1

    f727a100918bfa5b5952426b90d0b0f7ef9c792d

    SHA256

    ee04da23ec2a3c7c7cb7edd7fb9552e039b93687e807dce5f02eec866cfad187

    SHA512

    a544b5b122d412ca5483c586709735d4713f070fb86bd3aefc34f82a895fa7679115e55ede7abef5a8e47f3c1ea8d4dd317222c4a89e1dbba6c352acabbc4c7a

  • /data/data/com.joeykrim.rootcheck/files/gaClientIdData
    Filesize

    32B

    MD5

    7f1d287be16ccc75119345f7f4144945

    SHA1

    1d97d21328a9aee1db2baf6005bc3ac2741efd56

    SHA256

    cf34204eb55423bdcfc24203af891c6d4ec010e5d691d15b45b64a848ad4ae12

    SHA512

    a2ac8728cd65d2ff36c42f1144ca03edf36dd5313e7d64f7be7e7997a70f2121c254cd2b5f714b18b7ebcb3d3c2050a63171a3d906b593dfad5aa9e3c2ba777a

  • /data/user/0/com.joeykrim.rootcheck/cache/1582435991586.jar
    Filesize

    20KB

    MD5

    fde2ee00cbd121cfab5290b078aa3ceb

    SHA1

    e2b77d5320e155e413d040a8c20020962065b2f8

    SHA256

    2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

    SHA512

    a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56