Analysis
-
max time kernel
9s -
max time network
148s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
21-07-2024 11:41
Behavioral task
behavioral1
Sample
5f80dd7fccff6e15d5eda6e0e8263d9f985462155d23f335baaa0a44ea7f5712.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
5f80dd7fccff6e15d5eda6e0e8263d9f985462155d23f335baaa0a44ea7f5712.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
5f80dd7fccff6e15d5eda6e0e8263d9f985462155d23f335baaa0a44ea7f5712.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
5f80dd7fccff6e15d5eda6e0e8263d9f985462155d23f335baaa0a44ea7f5712.apk
-
Size
6.5MB
-
MD5
ac1b77d65246799e91fbbaf7c6a9cce9
-
SHA1
c9b3c027566da411e66942af9a575893ffd41f5c
-
SHA256
5f80dd7fccff6e15d5eda6e0e8263d9f985462155d23f335baaa0a44ea7f5712
-
SHA512
f4a832849613f95b6cfceadceab792fd0022a7f925261ca950e963be41103d1bde93bb6c0298de7f13038b2c2f677c986a1637807bea1c27276292a02aba1089
-
SSDEEP
98304:UUg7Gu5IfRSnPueFuaSMgg6MKRbV+pui2rmyOVLSFivt+OCvibZ+9Uy:ZeGIIteIcx6lbQpuiodMkiViZ
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 9 IoCs
Processes:
mob.play.rflxioc Process /system/bin/su mob.play.rflx /system/bin/failsafe/su mob.play.rflx /system/sd/xbin/su mob.play.rflx /system/xbin/su mob.play.rflx /data/local/bin/su mob.play.rflx /sbin/su mob.play.rflx /system/app/Superuser.apk mob.play.rflx /data/local/su mob.play.rflx /data/local/xbin/su mob.play.rflx -
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
Processes:
mob.play.rflxioc Process /dev/socket/qemud mob.play.rflx /dev/qemu_pipe mob.play.rflx -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
mob.play.rflxdescription ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses mob.play.rflx -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
mob.play.rflxdescription ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo mob.play.rflx -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
mob.play.rflxdescription ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone mob.play.rflx -
Checks the presence of a debugger
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
mob.play.rflxdescription ioc Process Framework service call android.app.IActivityManager.registerReceiver mob.play.rflx -
Checks CPU information 2 TTPs 1 IoCs
Processes:
mob.play.rflxdescription ioc Process File opened for read /proc/cpuinfo mob.play.rflx
Processes
-
mob.play.rflx1⤵
- Checks if the Android device is rooted.
- Checks known Qemu pipes.
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4977
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5f98d4a333de944dcc860384d88b16a29
SHA12e812d538f52346fc7ac31c5e1e5fa4d75fab2a5
SHA256dcef842b6b5ff248e74b7c168e2d748b50109892490ab6a361bd06c8df848bbd
SHA512734c18627f0cf676bce87a4c089dc0a33209e5195d74884a3a6dab77360e051e93ff51186034c8a952b68637835936d91a5c6f3b573ce14a955909cd2b12e4de
-
Filesize
8KB
MD5847f198db1ac637ceca74345e34570a3
SHA1c94e0c078c1d1c027a15372ed4d96004c0fdfb8d
SHA2562a641c6f5d3765612d2e6e2dd1f5cd82705a2a6f6a507c791c56719cf9ef4332
SHA51240cc8add4e2b64eb751674b14e9d5914075cd24e5f7f28b8d704cf1136448d27254b1bd487bb3552216e3a26c47f78efc885510ae75c6f2ca29a196aa8833c12
-
Filesize
8KB
MD55fd7f01a2335c0e6beccf417fd8d04b3
SHA1f0c7c9a6041356ad32b8feb331bf01287a891871
SHA2563afdd8216a367375e079eb6bb7646457e87210d51eda38cdc794e33b2a7ce7a4
SHA5127e6d2af792e54d7b3752e13753cc8e99d6431d275472f4289694ad0324a16d47fe97e4478ca239c8765be0035aa0f3b34477cd7909f10b5e01e3aae53468bc7a
-
Filesize
8KB
MD5851142642a2bf7dcc6d6152c9683a5fa
SHA177383d2a4f9d6b4dcdec02973824a6e252afa12a
SHA256dadbd5778b05491ca0e561698c084fb69a307424160593a79189e2481bb4c152
SHA51257df69ac39d8aedf2a5c98d000aa42cf8d741bc953c0bc09799b08ccad4a34fe6ff2d978f39c9bb1c1658bd00d5d87b4aa302e19ce57dab7dc2b771ae7adc1c5
-
Filesize
8KB
MD5787625e30bfed8fca24e1367851734f0
SHA1204baf47663aff191d2b09ea8f88a1621699c72f
SHA256b6b1d10b0a20de2f39aa6ed6728eee7b6eee8e3443edad6fa8747812f1969bdc
SHA512a20228d686aff362ae6fc77c6f1057ce7fcf7690b5fbd671f224c16aa355e353c73d202b5ace178e30b5fbb99f96182aa143f44d8a7bb8a2c6f499279f85ced8
-
Filesize
512B
MD5a9ef26edecdc8c69670d87ed9470b35a
SHA122b53aed57db9e30b87d8420ace861127dc77b2f
SHA2560030606ad59e0da1754170b52bd426ea55ec03361f1595fe90b1eaa9406fdfc1
SHA512b4621639a01dfd3d7521546372442d8a2c767dd26f63f533a4cf548a5c1b9bf42b32fac21013df9aff9548d6a74e70884f6f663be550912da27944816a1c91dd
-
Filesize
56KB
MD53736066a42aa8323b6058167aee2600a
SHA1996140b9ba84bbf5d916a98c4e11819f8c67039e
SHA256f5fb3babd79fc65819b43fdda743c027ef8b66659186aaf5a7106c799d0f0ad0
SHA512096f2f59a50df6a7da1c9a4709cda2bc66e1125338d46ceab688f7d53af4f61d8101bf398e8f153dad52e6e5ed70ba2537b99cfc834258cb2669bd5dade1bdc4
-
Filesize
8KB
MD598e2b2604234a6e426c659c8690c9496
SHA1b2eaa0e708f503661b552a60e971738829633827
SHA256987cf22d8023922af2de711d2aebe518b367ac9bb8a4744a9d9eda48d7aaba3b
SHA512c2e5082f639d9aa49692f6b952016e010de21eaf687bb13c8f1823de469fe90bd809264777e798ae93c088b5f7454dcb72480a15624d449f4a8a2cbd6320316e
-
Filesize
512B
MD538fa3cbd562e4af5fcce18d0d8a399ed
SHA12c3c0c7a8921d7fe55b59641a041a550f7020fc8
SHA25697f4cde3d46df0f615ba6f33e9fb7ea6899b3fc1fb013d93377a23b7c067c170
SHA5124a7510522cb3714ea9d8e0e377ab03f82e9df680a7d4a70125ec609fc73369efdb9ee9fe93de9ed0cb5bea20574218777a07be81e183d6919c8261f5f72f3180
-
Filesize
8KB
MD5a3841255ce11eaac671ece9e05f32b96
SHA1f0d4f43f89b8e9b88b37f21447cc9c0daae7abd6
SHA2568bf0d4a408b2c528f856f017b27f83e2612943e66a94700d5c1f987ef53b5264
SHA5129602771d30f9f9e6e59eb5806b4106c5d61a3d8b6134145afdc969494915e4e43235fe55d05fe84cc5cc913f643d66378e99052083768ed431cd9dcc7c41863a
-
Filesize
16KB
MD5eb52a90bb70b76e946b62f50b6f7fb85
SHA142d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA25648472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
SHA512b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
-
Filesize
16KB
MD57490f7d0e3b7fa2fbf40db5ba889604c
SHA12c0744e76c9d98b97d3d330c1868137b8c09af4b
SHA25607e6058ef97ef2553bb8b3a55bee24e2a58cf00ba4e73afd14abc99f00300c46
SHA512499b3638bf3efee6330a3f664bfccfd0f6f249a59c23483b6c1f7371c6c8faeeaa71f0277519b769379c18e4af1df0c960021cf60098a259d2600f298001ecea
-
Filesize
16KB
MD50b669cdffa68b3d4f03842f52cc504eb
SHA19f95192ce5448c8649b4af643d988485581e5461
SHA256979a9f312c5f9540424b36ea43a2a28ec6f48c5297fbe65e814e342c6d32ca23
SHA512f5f2960a47b48c6c4fde7702430690e88839f137f4facb95bcf7c2941b279cb0d2f36f5539d4e4c27f4834136f6b20f78c26e619e186e879c2e3b5ad00f263c1
-
Filesize
512B
MD5b312b57698f5bcc244fb8eb807ea428f
SHA199e5ceb23a615d911c7ce9d137eeb85517bee98d
SHA256b8cdcc4b955277ce6768f7f05a9fcbb0300ea12be60c85249b79e182c6276234
SHA51214c894e9a94c0f5f696fd30e1f6f44cbc0e76ff70d2fb6c87097cdabec93b4aac8bed752fc152e30cc54cd84ccf0e61942ea536e30c679cf97cd27d6c8e6feb7
-
Filesize
8KB
MD5e15dd98368921702c9bc9e149d43f3d8
SHA17344036e465d62d8964c6a69790e540219b1753d
SHA256c141e06d6f65e1302a01745bc6cbf178c06a2b29cb856ff2f5d33590714f5d54
SHA512efc246b3f0ef843082743f6f3254f453e97c4ee2c76d5e62581e6558062ee4b25c1ac1baf8841b55554cc52a07aaa78ede642feccd76e0637c9bce7cc9d88098
-
Filesize
4KB
MD52d2b8121bcd2a4a9b5b3b7cbcbc9339a
SHA10a9c76aac5c3ddf09f99bf37418113bfcc608900
SHA256366db1a0b217b7b46fb1efdeb08e60d78d5ab3f10cad9e5bc6b7e3664ef0a059
SHA512e5f3d6d72ece3d13fbc054f404eec63dc2e682e75d7e93ef385ebce5069098facfb1ee5315b8ed42c03ab3e9f1d6c6b02c1cb960095931de9f71caf2b22b60b6
-
Filesize
8KB
MD5e1299226acd9c7f934409fc38c654167
SHA1faaaab4d144cec358463fe6c31c1fb05341b7bec
SHA256df91f9bd860aa29fae244e4e52c383ae37e405a65e581499bbb2642a8b892fd7
SHA512b28f8505ec24740bb05aeb272dfd04e12b2572ec5b9ac5d0817c8acdb1e888f2fd72dd70e6e39441d8ab28be8f80586e3a2e5076ed27437ac4317bd4c21258a4
-
Filesize
8KB
MD5f39c9e2ae1ce352f5c6d0a6614ceff1b
SHA1d84b0826232f1d7c3dfcfab57c2f6f7db0bc6ff2
SHA25624ba3c7fd96b141779d39436d2d6c1f0de4998af8563e1046cd1d550963a7f48
SHA5125270f8ba45562e0843eae49f9bc00b4e4bcb34fdc04928702013b5d2f0c526872d7053803140cc4198939ebc59c0604a1eb319a6699f87c69961c8827132428a
-
Filesize
8KB
MD5f02410f57bb3a778d7031f484893ede4
SHA179184656516a208f112b0a65542fd1a0e95568af
SHA256f813fbbb1820516eec902c5fd32c97dbcfa9286fa287b338f0668754a28bbdf7
SHA512463b4e84aa07fef18ecbe1961755e0652e21bd593156092fa00e9f9ebed545b6bd418e687cc1b87b640ad039df119fce4147e53f838a24ca25ea700f46c9dd14
-
/data/data/mob.play.rflx/files/.com.google.firebase.crashlytics.files.v2:mob.play.rflx/open-sessions/669CF40D03420001137194310FCE0536/event0000000000_
Filesize39KB
MD5709ca4252cd6bb6f2a9a95180e04ee92
SHA1dc3e74fd9f7149081640fc27a03cbc331aa24b56
SHA2560cdb0206c0fe1617a4c0b04002baeefb4b17e3b9c66503238362cc2f19e1b54a
SHA5123b87e96be16a897293e7f12f9c38a77af5adee04341f47d2794f3aaec7e61e17fcf2bdbf5211e7571719348d5d447ae6edf3fcbbde8e20a3847816c81ebe752a
-
/data/data/mob.play.rflx/files/.com.google.firebase.crashlytics.files.v2:mob.play.rflx/open-sessions/669CF40D03420001137194310FCE0536/report
Filesize787B
MD5bd727ceaa5952d47293c7b6b3109f8fe
SHA17f4a813afe315178289a1d9d3b29ad7c424d7a6a
SHA25604f3b8f11b0e14e6bfa4b49828758e0cc689faefe56ba7a53f0da9de22769f89
SHA5124c4d0b04f0be10abd019d71bf818501e7dad590c65a4288796df8b20a5640bc714c84d86c3fb46518a38da867e79053ed582b2038f71e21aa69d968271423b46
-
/data/data/mob.play.rflx/files/.com.google.firebase.crashlytics.files.v2:mob.play.rflx/open-sessions/669CF41300440002137194310FCE0536/report
Filesize787B
MD59462a4e20d0bd0fe19ab51b4c97dd399
SHA1102c9333fc416ebe6dfc883d7ef08b5de76bec70
SHA256eb9537ab94662336411d011c1291bef85018f4e335ded35cdd4ad1e878ab18f5
SHA512e5a71239cb1734851b915b53e9a927798c8033bfb4318db2d17413e4e0996a5af0f4d900ada38ad9aea21333c49f19cbc00e0ffb331bf28e987c9a87bc087f37
-
/data/data/mob.play.rflx/files/.com.google.firebase.crashlytics.files.v2:mob.play.rflx/priority-reports/669CF40D03420001137194310FCE0536
Filesize39KB
MD5aa465d2b95b3e09ca05f20a4f2f01576
SHA13bf409fba5704b8e2fa957793f8f28f2f2e99c0f
SHA256d669e71c890c71cb2c9dcb57db727d2d37aa8245e06d4782c2b41b5a6809895d
SHA512c600dfd92595d1903b91a59e8edfb0461dbe06b67526d7981b25e2228a4a62484eb68346bf016fc63d9d4b2020bb222746288fdf299c277893c01173f3761513
-
Filesize
90B
MD5d79df676b968eae2121c9bae810c833e
SHA1939be0b072b6f29b7fb9d2306f8b039053212089
SHA256b132e0483389f405c772c848778650ddb8977f2ab516f23e47dab4d2d108c40f
SHA5128b8ec7f56882333ac17902203814b585a7acd1ea330357b75959e498b1c8a4a5229a33dd7fe069e856036324923c62743b1d7a204e9651092bf6477ee9f0cbc5
-
Filesize
567B
MD539154be948b21201d2f4d3f77894ef06
SHA1995a3ad068d5272cff77b1aeba24b86262903182
SHA256537d9e3bd02b71ccd91e20109d2fad4bd4b5eda0549ef40ed2ce8c504eb57ab9
SHA512c7c3a78ff58d8202b0a294e36162a75fc017f4a079bd9c4258f85dce0c1474b808966f5624a297c77ecb29521a63c854c819885891c911d1caaa9c1498c81465
-
Filesize
1KB
MD5754ad49457c31a4a8dcb51a8a702d232
SHA11db8908483c154ad82475d3a7ac5b8342f5e5829
SHA256b7553fa19e1a869edc56e5f9d63c11feef71a654a54a95a3e3d9e247c99f3784
SHA512c57b0849e576668e178988f8a11424cde30e53755e34c7c163d55e31527d9874d24c30cf7909304e247baaa3437ef4784fdda33172fd91e0d33eac0091581c57
-
Filesize
2KB
MD5c5ec03049f2a725dbe8dff5598ea7afe
SHA13272e70169bcb264b8072dec2dda5c2d2f7432a1
SHA2568d11f72942817bf46c3b47ba9e7892b70b5ccee1e01116804ac1d5b683c48840
SHA5128d0134a29ef6c20c39e755d4d36fee2c119ae32d6f05d1d62c8ccf116756f216e8a9825a5cfdd576576d79c9bac33055b47216efea7dd4f966a14111680588c6
-
Filesize
797B
MD51464bff0fd2bc323b44f3019e32e43e5
SHA1e723343e3d4bd22bab0510ab4d1233e346b4a838
SHA2565225c5f27e665aa4efe233d9efa63a60e7a62171ed33c1667cbb5bf6b92e44a3
SHA512dcfde2c757c5b83ed0060792c6900f1e2614410a2441563d2bdbadfc24326f73f2fa0fa7f2b7bd4555aa2a2b03c15e0ac3d28ad4836e0fda5484f00f8f2eac01
-
Filesize
978B
MD5c41164d8f5044093acc85a4f93b1ca1b
SHA12001e355baa615da01da5bb8b60c88f64d0e57ff
SHA2565e478ae54831bad55c4dcda78db4fa071411c98ddf9d057ff557a36b1cd9c3e4
SHA5123812f2c85d4e24df3e68b0912a2dab1d1fff198ae0cd8c238e925239b19a084cbf2d58831bf5897ce764029f28bbe515b98acfb940ce985280beb9cf6251c57d
-
Filesize
1KB
MD584d44d07ee0cd574f5c73907b7a6055e
SHA119c7bb2bdf7f98e4ec69bbbd94981fd6ef8966c6
SHA256e0a6705cbbe7af1c15e10c45b471bfff79dada9044f17fb7226c8fb6460f7ca2
SHA512d8ecf9b58cb4aa25d14be75bdbd5c941dd5ecc98b85edd26110f93da78b552d3264b5458ae1e26a489f66e0d4771dc147d8afc73b6532a795e6457e27aa27947
-
Filesize
57B
MD5476a9a5ac80eed08a4e66f4d29c8ca3c
SHA1b448c0954df21e3b3b73533514961e9d252ac829
SHA25672661011844684cef36908b82ac2a14ea6cb33b70ee99228c0bf5330632c0b82
SHA5123da0553793fff80b2eaa5588a2c21a86af8899aedeed6a85f8a88bf2a9b5033931b003cf9e4041614bb9791715058c113b970118aa10d639c57ecda2f21d0798
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
33B
MD535b51faac8b5af3886e70bb5a885dab1
SHA1e6cb282da46cd4bf113e25c8573268578dcd11b6
SHA256af5b3362ec35985974c6b73eeba53e5063861f2491252d61d8cd42168aa5ed6b
SHA5126ad5e9766cc03a4436e1440b9e47c44da6c6440a3c94b1cc988f8c5680043cde6f7b7e02b2b4c71b25df4209c39ed099fb65fdde02a9f09464609a1abe6af8fa
-
Filesize
75B
MD5944e6a5a08cb971370c65c06061f0ab4
SHA184d47725cc29bf167b782c702575bce4bf2ecc5b
SHA256ba8f4af0e35f93cc15649f4c51969f5279421fc12deeafaddec5e5c48aa58dab
SHA512bdc404233927a6a99160492d0b3e2cf00776d51b33612b8c9ecba395747b3572cf1790269fb199915aafe84c546d30e3259833c9d00af8c412823396882ca783
-
Filesize
121B
MD5ffcbf87665a36fc21782400bd0537e79
SHA13dbfbdbfdcde953317b089f9a9fa0bbe50c698ee
SHA256a21d3bf2cca0951e9e7b3fed43cafe9f89a4cf9d844c82279b260852d0ee473d
SHA5127f98ac150c422eb4f1126d86501d0435817ceaa7eb5549e4d21a295d57be3d3fed4388cda782c084130c4ac8d57a4f225139a2e42e8a12b34cc1679140d16b57
-
Filesize
163B
MD5dcf7d6c1cfd5e7b56074e3001577c78b
SHA1b8eba89aee9f6688ecda6675ef8ff4998da0b141
SHA256ba0830617929c78abca9391c2059f89c78049911f502ef5525d39341e4da2b91
SHA51242d75be824d69de23d2e8605d60c3608db20ed5c059f5b67c63ca2845484c67150aea88a3aae36aae12a4ea266fb6b469d09f765bbcd444350d836ab83f7695d
-
Filesize
212B
MD57d1787833315f9b2895173a54ccfc1f6
SHA13be22722cad564ef0173ce4d20f78076c3037496
SHA2567e213ae9a67e9866f731e9da11552253b96a1e9cfe69dfeeca70e3bb3073be42
SHA5125faf2adad4ba7018fa76c5b934092d835693aa3a89b62639d6ae09c76d777aa3764bcab175b7aac80b4b526d1244db51c70eb9c20478a4f49394f7ce0411f5ca
-
Filesize
4B
MD5098f6bcd4621d373cade4e832627b4f6
SHA1a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA2569f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff