Analysis
-
max time kernel
179s -
max time network
180s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
24-05-2024 13:01
Static task
static1
Behavioral task
behavioral1
Sample
Root_Checker_5.9.4.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
Root_Checker_5.9.4.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
Root_Checker_5.9.4.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
Root_Checker_5.9.4.apk
-
Size
6.8MB
-
MD5
9e2eae5051f3834834a0346712bda07a
-
SHA1
2dc4aa2b57ce8ce580dbf642a0ed0cbefa015277
-
SHA256
771e05a0caa0822e6cda930d66447d00772c2ba36fe83e62154b6a0d76413b0e
-
SHA512
20e902044289f1bf11b6304dd91df1a0deb07955b1c7c6ab75fb2e89e4b0e81594f92585279c3acd7d790c37b72e92c512535ee48fda0eef0c69d1f0498542f7
-
SSDEEP
98304:s8ALShhdccY2qtJFUhK7W59Ddua60PNITWBnnY+qFsHYA2HKraYCpyV+5:ASfqd7t7UN5buaXNqG4pqrah
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
com.joeykrim.rootcheckioc process /system/xbin/su com.joeykrim.rootcheck /system/app/Superuser.apk com.joeykrim.rootcheck -
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
Processes:
com.joeykrim.rootcheckdescription ioc process Accessed system property key: ro.product.model com.joeykrim.rootcheck -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.joeykrim.rootcheckioc pid process /data/user/0/com.joeykrim.rootcheck/cache/1582435991586.jar 4250 com.joeykrim.rootcheck -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.joeykrim.rootcheckdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.joeykrim.rootcheck -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.joeykrim.rootcheckdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.joeykrim.rootcheck -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.joeykrim.rootcheckdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.joeykrim.rootcheck -
Acquires the wake lock 1 IoCs
Processes:
com.joeykrim.rootcheckdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.joeykrim.rootcheck -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.joeykrim.rootcheckdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.joeykrim.rootcheck -
Reads information about phone network operator. 1 TTPs
-
Checks the presence of a debugger
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.joeykrim.rootcheckdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.joeykrim.rootcheck
Processes
-
com.joeykrim.rootcheck1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.joeykrim.rootcheck/app_0de7788050864972a25d2d9c40c503e0515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFileFilesize
567B
MD55785fb32456f0934c19c0793a85e4a0e
SHA10937800c80b5eedd08d8dfc20895a20dec9964bb
SHA256a72ae188b483b0c54c9e4c8c62ae76f3efbd62b439ccecafcf9dde81e84c48d4
SHA51218c6aa95df81e49b228ad9fc339d44a2adc10376c4aa098644d8cdcaf9560a3099606df637744d37f180e3a6ea2a0fa6b7bd1dfd9e84e9c87c8b9925348f6334
-
/data/data/com.joeykrim.rootcheck/app_0de7788050864972a25d2d9c40c503e0515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFileFilesize
596B
MD514290eefd01d0514754561359edec9c8
SHA1d7fe7ed88781aabd8773f1a38ff316c8d2144401
SHA2567d2404d5baee11410fce3b43733ba017e180a0c1b320b95e4d5604f9baeb72ea
SHA5121e86e07a718d50b8500c3ed1714439ad162a59518f0bd58f081d9696671fa094b51e87ca709d492719a1f4a03b2d2ec75d84f332f11385cb4af530e37dc59458
-
/data/data/com.joeykrim.rootcheck/app_0de7788050864972a25d2d9c40c503e0515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFileFilesize
576B
MD5e0c0051f8eb658987f01828a8d612054
SHA15009bb7f48d63edc67100d5e64421f49906f7a63
SHA2567f1f14e200eb9cc555f9c90ccc93b76561bef9bed768d9773a1048394b18b463
SHA512c570446fcf2580cea3b1d13534848726f7b187af031474b1722953152648c58d1e89c8251901e3e5d08351e2cb44eb43a48c58d22ab2d343345fd1da4b6f4ff7
-
/data/data/com.joeykrim.rootcheck/app_0de7788050864972a25d2d9c40c503e0515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFileFilesize
571B
MD5be20f3e7f074233d6389663cf1feb30d
SHA1594f245d9723d03165d2dd8c76b2d66bd71b3feb
SHA2562b6b7446f9b330a918d5f7851fd413ab924df694c31e535abc75ba0e124af4d3
SHA5122dba796759c067e9532388c21a849994db6e6469cfdce147409777aa7d7af6f2e03e3193014a174f33ce36e10d3dd46f40f2727e00ba1e9e3b86af4ce1c00fa5
-
/data/data/com.joeykrim.rootcheck/app_0de7788050864972a25d2d9c40c503e0515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFileFilesize
537B
MD5c9c4c4fe3c62515c444b902f14e4ba7e
SHA17f9e094e10a8c0ab5c738541d0d196f4a8921b30
SHA2564dc36c200c51a9d4978f7666f8391fa1e693b7410d24b7aa21127cb9a70427d2
SHA512c11945162f4e99046b42da32ee465bc505200388732a8fed4266c1dea483dac232b20014c50b1e70a41d4b901856d51549064e14d2f55362a37f992cc66b6dc7
-
/data/data/com.joeykrim.rootcheck/app_febcf37b1b614b9dbd822fb2f448801e/events/eventsFileFilesize
493B
MD583031358d6ce444c2446af8a1d12aeda
SHA14ab486f41a894ec62432dd485a42d14ba18c9843
SHA25693b7df80c3433b5dfddcf2bc257f94f3f689a5e1eae45f939b858a7a382ea834
SHA512b9dc7f9e60f2c5b704975dcb119910dc00f709d9841ab4e8e96d39c4d6f75b395fdcc8bb2d258ca4f1b07af5f832b8712a7e0790a93ea6dcf0763f2136f61c72
-
/data/data/com.joeykrim.rootcheck/app_febcf37b1b614b9dbd822fb2f448801e/events/eventsFileFilesize
493B
MD5fbc60604aa357541d6cbb17a8f0834c8
SHA13865098b14c7e865e1d3a86eb2666b9162d9f850
SHA25632187a2095fd917a6930e26dd61a162104f105f99a52679594376ba2a441b976
SHA512877861c727a17e2bad92c4da8125ac39a5f398df82a2cf032d66575efcda6dae73977b1a9e1946abcbe8740c5505d3d783b215056ce3334fbd5fd86e20081498
-
/data/data/com.joeykrim.rootcheck/app_febcf37b1b614b9dbd822fb2f448801e/events/eventsFileFilesize
601B
MD55fe86e5912516e52ccc52cc5294cbd04
SHA1fa29358ee06dda6842dc8db6d30831afe8291068
SHA256bc5cdc9933472675c6dec975944c9229d9c29e8de777e983a7a1f4b48c9ee81c
SHA5122b41c777814d67dad253f6d994fcc8d246bd464191a7f60af4ebeca80caf6b74a4091f7e77b4dced18d4a7d411ffe5be731a8c3bc91883e213aea36deece1f0f
-
/data/data/com.joeykrim.rootcheck/app_febcf37b1b614b9dbd822fb2f448801e/events/eventsFileFilesize
601B
MD563bc8b9866cc1fc4a35cbb36fcfbc267
SHA18ba60626e6972d97cd1575488b013f8f35edef3f
SHA256f3ea831af71abc30f3727b34cddda14a1a399004794ba2b5572df2d65392d44a
SHA512ebfc72378196d88798f59bfeec67533a74a3a721d5520bf19d6c5859283ac2ed972a3e20d1ae7e86b99d43bafd686eb616401f8b11cd65e7d0bb7e7b549daaac
-
/data/data/com.joeykrim.rootcheck/cache/1582435991586.jarFilesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
/data/data/com.joeykrim.rootcheck/cache/oat/1582435991586.jar.cur.profFilesize
148B
MD5a3b78d197d786c13687c3f0f89703bd8
SHA19967f0726b6b1ed3f198904547b81920f8329621
SHA256c5e6754556dbe01b055066f23c28ddaaf5fe67cee4baed00d59dc993335b3d97
SHA5129a47c9bb977edec9d29d22f280e0078ca931a722eaecc2b085c6b5aaf6246d17a6ad07c9faca45070bb5b89a3ee6cf896f5e2c7e73fb033e3ac57471df70a8b1
-
/data/data/com.joeykrim.rootcheck/databases/google_analytics_v4.dbFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/com.joeykrim.rootcheck/databases/google_analytics_v4.db-journalFilesize
512B
MD5ae43e2835d41478740ff6ab3acbf72c3
SHA1546338ac7e7a20f286b17c16634512df9f4e2bd7
SHA256ab111a8c850197fdef9fb07943594a3667be0e349d3595ea05c7ec6382ac2f0e
SHA5129d16b6d39339e9afb97ee665098b1f12672791c815fcf00b9bff0c94b731f4b96d4f013da119da7ce65b5a3ad81fbf14f4a40f5952f9c187451c2b70c65d5417
-
/data/data/com.joeykrim.rootcheck/databases/google_analytics_v4.db-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.joeykrim.rootcheck/databases/google_analytics_v4.db-walFilesize
245KB
MD5de86ff82eff92c41dec113657c848c7c
SHA1e6f785b25709bf91cf42b728e4dd0ea01c5fbab5
SHA256ca3c568a466ff23a359bb602633fdbb640972cc1b3793d04cb564a5be4d44ea7
SHA5124ac42eab79e8bc8a6ddd0f381a0b009cb0a96c338691b699d1845ff73aa1c9af006cbb59da7e07d4a20e110574865aa50f25f2ae0a6b6fd8faf174a9ef6cfda4
-
/data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/665093D80022-0001-109A-E06C5FECBA9EBeginSession.cls_tempFilesize
77B
MD5ffc55c8117ca5df8485b4cc6ddb8f31d
SHA1e60e6b0eebccd2df4a167332b2f33db08cee04ab
SHA256b51205c595435512d00fceb0e6410d6fb4b49135179698d5971a928b2355ca56
SHA512529d2d64ce89d4de540db696ce44720490fe0d7df5d4265c550e1dd250a58ab867ddfd3e48f48c6d349437ca9b7d1e7747b38c67e78e58d4b22db18a3e30f3ce
-
/data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/665093D80022-0001-109A-E06C5FECBA9ESessionApp.cls_tempFilesize
118B
MD51be83e818fc60bc099757048f1557d40
SHA12448836919f173bf498511b1d66e6900e4736670
SHA2568b94597914911191b29b885d73705eacfd9df014d26aff9b1aa50459fd6b0862
SHA5122413000822a9e1bc03c46efb06a64d86542ac3b783f8f4d2ce99504a560663416fa9650ea5bfac99867c0152acf9880273c43c7fc64de214915436e2e84420f0
-
/data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/665093D80022-0001-109A-E06C5FECBA9ESessionDevice.cls_tempFilesize
131B
MD56e555fa12d9b147f9e0620c6d6a616fe
SHA1dc5280d0e934d169e815dba8d8fc40d578278672
SHA256bb9b3daf81addd99b28148a221d0e4c85fd424003deb45e2954677be661af363
SHA512be37740342412d3e9c59689c92ca8cba5b7bce8b27e6c14fd497dc2a3f188a7e02af6aa5bbda9be188383346209897142e0dbfdc80c39a8d5d6bc1a22baa18cd
-
/data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/665093D80022-0001-109A-E06C5FECBA9ESessionOS.cls_tempFilesize
14B
MD59b3d4522944ce6396563812bfdb92fa9
SHA16d2a6133c8f01938a48ccc77ef86ad8ca335c020
SHA256d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9
SHA512091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727
-
/data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tapFilesize
540B
MD569ebe37f94c771c6a1c850ebcd25c218
SHA16601db32201f682432dcca8b9d6e727f2e06d95d
SHA256ec813abed77457f6e77db103d1bbd74a8ee028263c1c628226005865bf76590d
SHA512f64b90343c5bd09f2839f95e93afa7f23080302270e598aeebbb375961ecfff4278a0bdaa7f37d6f79ba6eac84ddf363a44d95fabb5b162189dd1c386b6c4f0a
-
/data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tapFilesize
1KB
MD528a6e674f18d462d43e4cf8a9ca38678
SHA1606a31f85d8bbec0f76488fd74080a0cec32dde2
SHA25658db2a7246492142cdcb5cd20f8daa9e0dd9dfcbbe72fb4465615789685e3b48
SHA51276c2e17a69abf57224cb5e2c08d0f614fda8ec9f9900e363017fb64f6d5ff817652d64b54a97806f00c02dca7f9ebb0880ee6967f4894a0d527c84cb4611499f
-
/data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmpFilesize
16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/data/com.joeykrim.rootcheck/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_15dc3c91-8d7c-43c4-86e1-eeacc67c9a38_1716556766517.tapFilesize
412B
MD5affa1b0c725757f8af04aaf93e23701f
SHA1b0d93335b62049378e1ed363d92061a0835e3705
SHA256e008509c849c2974814a5667915485a752009d836a686d0b849e397383c3c31a
SHA512fcae13209b1606bf1188eeb771083506a5c562995dafd12428a8a039f401f98f96dda4044300959b016affd56f0faa2261e844ba29925aaf4ecfe5633e27e1c0
-
/data/data/com.joeykrim.rootcheck/files/.YFlurrySenderIndex.info.AnalyticsData_RG6P5WWKVXRC8CPTJZJT_211Filesize
88B
MD54f6cc70618f526b37c83d8ac84bac85f
SHA1b8ee9f3be1642cb7e49e6dbab1f98b5c4d98cdf6
SHA256ddbd3d180cf41cd713cd6d14e1aedcfe37fbd8835d6ae9dec90d255734bcda6a
SHA51280a983459c44292ca45c08a7a328b74e594a04ce0e74318f224eac072ab7265f7b54530d672aa076bc13fb66748e3e2f10df38478f2bd7b6fc08fafb7fe9a8ef
-
/data/data/com.joeykrim.rootcheck/files/.YFlurrySenderIndex.info.AnalyticsMainFilesize
72B
MD59d52b65d0631d3dfff877c5bf56a8440
SHA19d66929722fd30153a57e30f0f68f17380e2b0e1
SHA25636936bb994843fbb0b91fad190471623a66ccd059f85ccbeed8d755d4fb3c98f
SHA512170cfdd8ac8959e0fbe9a261cef3c5c7a0848b426c9cb6eb2fe0dd296d1d71bc6e1c8348d5c887c69ef1c312f711df4cee402ab9ffd3da0f88801d018a3444e7
-
/data/data/com.joeykrim.rootcheck/files/.yflurrydatasenderblock.905d4418-8ab7-4d04-b5fa-eface9dd3ca2Filesize
305B
MD54fa68e8151d9556ffd388852209e8fa1
SHA13c55c0d8c44c492ecaba96943f766d98ae0d9f3c
SHA25644ad4770180d0a455aef6f53cb5023a11903a1d93007071a41f44ed07d9cee38
SHA512a9b2cbe9bdafb3cef017f3f44c2095412f45ec0fc6f545d13377d52615fbda43505d65cb9fe8326627af1b2912e2d8ddc9afcfca45bd6fe74e6e5f9cbeff7abf
-
/data/data/com.joeykrim.rootcheck/files/AppEventsLogger.persistedsessioninfoFilesize
495B
MD5468bc467366255679b5ce89d5cb49828
SHA1045fe23b67672062fd379013cf0cc4b51a449ef6
SHA2569ac0a3b209c61c4a1915a147df683c979a0b31246d5e5bd93902b2283ba2b81e
SHA5127a486384e7146d400b863f33e5a43822b13bb59eadce8a27f7b80e9be7b4de16fca9912b4ab95ddb7c5b886928a33fd9fa29ec9565e5587db37534081dc4311c
-
/data/data/com.joeykrim.rootcheck/files/gaClientIdFilesize
36B
MD53f84e966873ddb90e9daa19b66309b1b
SHA1f727a100918bfa5b5952426b90d0b0f7ef9c792d
SHA256ee04da23ec2a3c7c7cb7edd7fb9552e039b93687e807dce5f02eec866cfad187
SHA512a544b5b122d412ca5483c586709735d4713f070fb86bd3aefc34f82a895fa7679115e55ede7abef5a8e47f3c1ea8d4dd317222c4a89e1dbba6c352acabbc4c7a
-
/data/data/com.joeykrim.rootcheck/files/gaClientIdDataFilesize
32B
MD57f1d287be16ccc75119345f7f4144945
SHA11d97d21328a9aee1db2baf6005bc3ac2741efd56
SHA256cf34204eb55423bdcfc24203af891c6d4ec010e5d691d15b45b64a848ad4ae12
SHA512a2ac8728cd65d2ff36c42f1144ca03edf36dd5313e7d64f7be7e7997a70f2121c254cd2b5f714b18b7ebcb3d3c2050a63171a3d906b593dfad5aa9e3c2ba777a
-
/data/user/0/com.joeykrim.rootcheck/cache/1582435991586.jarFilesize
20KB
MD5fde2ee00cbd121cfab5290b078aa3ceb
SHA1e2b77d5320e155e413d040a8c20020962065b2f8
SHA2562897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56