Analysis
-
max time kernel
55s -
max time network
104s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
23-10-2024 16:41
Static task
static1
Behavioral task
behavioral1
Sample
subway-surfers-androeed.store-0-1729034867.apk
Resource
android-x86-arm-20240624-en
General
-
Target
subway-surfers-androeed.store-0-1729034867.apk
-
Size
179.0MB
-
MD5
96aeb2a83518118f4e517375edcb3e09
-
SHA1
fed9bfd41ee0fd2ee39b842d66fd1bfd52638c73
-
SHA256
fbe74c2667f417dd2958df25d9da6946145edab1bce64c561b399fee359763b5
-
SHA512
bc3aebb9cc2807275a5b11e7743a1eba748906372864bff9f31175f7283168420babeec1325b808775b296519a971d1fa5591549773b1565e5bd73039bd7e741
-
SSDEEP
3145728:E+u3CFB004I7dHtHAlDdhMf334YMiXONbGxgYV2ei8xodxfYi14mXZRHG6QAA+cm:EX3CT0cHGlRh2n4mONbG2YV2xdGiDXZP
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
com.kiloo.subwaysurfioc process /system/xbin/su com.kiloo.subwaysurf /system/app/Superuser.apk com.kiloo.subwaysurf -
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.kiloo.subwaysurfioc pid process /data/user/0/com.kiloo.subwaysurf/files/audience_network.dex 4331 com.kiloo.subwaysurf -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.kiloo.subwaysurfdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.kiloo.subwaysurf -
Acquires the wake lock 1 IoCs
Processes:
com.kiloo.subwaysurfdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.kiloo.subwaysurf -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.kiloo.subwaysurfdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.kiloo.subwaysurf -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.kiloo.subwaysurfdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.kiloo.subwaysurf -
Checks the presence of a debugger
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.kiloo.subwaysurfdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.kiloo.subwaysurf -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
com.kiloo.subwaysurfdescription ioc process Framework service call android.app.job.IJobScheduler.schedule com.kiloo.subwaysurf -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.kiloo.subwaysurfdescription ioc process File opened for read /proc/cpuinfo com.kiloo.subwaysurf -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.kiloo.subwaysurfdescription ioc process File opened for read /proc/meminfo com.kiloo.subwaysurf
Processes
-
com.kiloo.subwaysurf1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4331
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD51df1c0a2faa697494fa3b5128bbd12df
SHA1a211404c920986a7f50c26e8eaa2594446c9b5b5
SHA25663b656d093496757160c7ca7ee257532274280e81777c025709af58d0e04d1a5
SHA512cb4fbdd57d462c27349ad86acef4f14d24993b1c1775d39c43b15d4f322cea49e3ab7f41a2ec77e51f745a1997f11d71cad928ba43728cea3475489a3909987a
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD55dbcc55734e0cbbdf177b2c908fde469
SHA144fcfc734acf91fb4eed22a821eeb37786472f88
SHA256e321bd45fcfc0d45d7fae31d66f66622faff7516d848cd2cf34e1ba31d324ef9
SHA51281db79fa7371e679a4b9f7bf5a0859e14772f079f77ccc9fadaa35b9debed4c8a5e08aac3042f0295ff9236315ef89167b8775c869873a5f95d11cb880fa4bce
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
120KB
MD53733ac6baa16013c59f8ce28acd4f2d4
SHA1e40546efe57e252fa2b712593c8a463e0d5c2867
SHA256e3894e41d4e373b46a1c1305bcac51ad728e329fe3ac45b159283e00e1cf2cab
SHA51236af5dd41fa0bf04ceb25ed868c37680764d9c9cd2beb01be6a05b9e1b61542a69687740411ac5d1c72f34212cb60dc449999c01aec5f675e80479d1650de868
-
/data/data/com.kiloo.subwaysurf/files/.crashlytics.v3/com.kiloo.subwaysurf/com.crashlytics.settings.json
Filesize716B
MD59f28bfcf8c6381d878a3dfcf51d3b284
SHA1ea57c7d950c0265cdfb30734f2cb3bda084a27c2
SHA256c9a7847fe02becadb90909ad79e723f03f03f09a38bc200e2859302d2002da5b
SHA5123269feddf80be977273d8a39f8a202fd8ba962a5f1506a130855cb409243a754dabb1abf8735e6dff2a31a066150e02eb9198b83ecf06ee216d2b964e8d88b98
-
/data/data/com.kiloo.subwaysurf/files/.crashlytics.v3/com.kiloo.subwaysurf/open-sessions/671931DD0307000110EB331DCBC9D5FF/report
Filesize875B
MD5183ae0ef7a305c8fe0107fb5ecd7e4d2
SHA1600d41b1a0ff0edbd361d307c7224d26455630ad
SHA2563aca8b9edc8eea90b2afdda599c95602d2517fbc4a1c539d04524b1b2647bbe0
SHA5122d6b7f6d7c6fb58512245a0e9fe3c631b93a143198c2ae0443193a0026cd592431175fbfe13446ff1534caee3eec14fbcb6ff6f2775ba0aad584be5b5ec8697f
-
Filesize
208B
MD5d984996d8ea94c86a86e5256e46191d1
SHA1bf796fcf05449302a6d8d1d5438e29b129e8f5ab
SHA256ada6f2ed178bbb5182f3220cca6d224c5494cc3cd673547e38459f8bbf1f9903
SHA51274e2714b839f19c6d6e3b387c3b21e0d29937ae3823fb3548dd87ad799c2f7c8cea10a2920a48750883b28701dda8d017ca7439c420477aaf88f64119e3dc84b
-
Filesize
571B
MD5888e4c3ccfcbe566a37855b26d67b356
SHA190dcfebca235cea5cb4b64e7b2191d8574ff8de8
SHA2563e8ed1b34cf3c6c47cc151163c219f0af06851ff32ab267db4bc4c52a04daa20
SHA512dad7442e0e29aad9c189bdd57dada7fb27b32a87e2fa120c22f7882f308cf48d8eac61b5204761c91eafd13341733ec11afb3abf32125c5e31fef0bb47659223
-
Filesize
90B
MD5a591f867ad1b3228a8f546dfd9c6eb9d
SHA1a941e074f7446674b509a52262f83653427eed56
SHA2567c4997e6d33b36db3566d1c2a879301aa353222f1599b533c6631e9de14d0c34
SHA512d73a544d20871eb83719a6e6313ee9c000520a4c077d072504127218fd40519b2f7adac254400be207a995ffb47b1d2412dc60fa2a873233ffe6790a64e504ad
-
Filesize
3.4MB
MD506dfc829bf9345876f04db7b69485799
SHA1afac2a96af43bfe4c6db99fcf0deff352a4f5a70
SHA25677909b82bcc2dab7e432d0547058313c5bcc5ea298de628a6ae05fb9d39d56f0
SHA512b57fa956d0afa8dab830592a42692df3577cd7d1479f9beaed790796951eeab2120619ecdc8801006e3a607dcdbfd8ef2592436fba19f838d1851c42948dc67f
-
/data/data/com.kiloo.subwaysurf/files/datastore/firebase_session_Y29tLmtpbG9vLnN1YndheXN1cmY=_data.preferences_pb.tmp
Filesize50B
MD5b120dcb2a8def33cec16e7eb616e2271
SHA1bd67a68fc7f1c0cbf1b78c575148fcd3bb18b03e
SHA256f7f24792c7c919833edc2c0fcb546cae62a64a6d6098127dcde39fcbf91820b0
SHA512cfe6a46ddd77886cc410d7483a41dfbc0a213fef058b7b45446b3fc52269f0abafa305cb6b04637f862111b9296697a7828a6aa050619646e21c9eb44fc6e47a
-
/data/data/com.kiloo.subwaysurf/files/datastore/firebase_session_Y29tLmtpbG9vLnN1YndheXN1cmY=_settings.preferences_pb.tmp
Filesize33B
MD5a65b9b3e4670dc3b48a9609f816ad531
SHA1682a73f2c248815fba0cb50c45031a53d6f8dbcf
SHA256a4aaa2a4e0cb12123b405a9d33bdd7edf8cbb41ea92e75deb1ba21bf1db5b2a6
SHA5126c06e6791dd41c1c8d8e0246e9bf7fed81dbdb5e918e7dd78cc2af1f002f8a532ec28335b229a0ec5c1ee220861092cb1a7c7f4060663394e420d80ed391179e
-
/data/data/com.kiloo.subwaysurf/files/datastore/firebase_session_Y29tLmtpbG9vLnN1YndheXN1cmY=_settings.preferences_pb.tmp
Filesize75B
MD506bd63584cc699cbc92ade3aeab0ac42
SHA1e21167e5419847271e7f67b3b286916b8124165d
SHA2561e58e88b20702d0a80025c1fbacc9ad5fe2565311e2230d581d669fbd7e8b0ef
SHA512675f177e388425023df5e19cda634ab1e7673681feabfa7bb860089105353166491d15b8c86b5408833230dc5b0ac43e2b5a61e1d36ea0b40d6ce7166bfc385e
-
/data/data/com.kiloo.subwaysurf/files/datastore/firebase_session_Y29tLmtpbG9vLnN1YndheXN1cmY=_settings.preferences_pb.tmp
Filesize121B
MD51fbccf7b936a9b713de5d42c6d8a075d
SHA17c8bbdf9151e7f53e2675329d471e552446e9ad3
SHA256232f9626cbee2e063e25f61a08f46575d019b62f02a6753c1325957a95e1c513
SHA512b9177426b3facda6d86b5a83d05805a4dd2f5357d4979ca7282a13ce3f08ef7e7a0c5922675ada826bde264450b1b4ddcc54eea4de62249fd3eab1ec9acf32cf
-
/data/data/com.kiloo.subwaysurf/files/datastore/firebase_session_Y29tLmtpbG9vLnN1YndheXN1cmY=_settings.preferences_pb.tmp
Filesize163B
MD514770edbc1290230aebe82f8dcc730a0
SHA1f86874de3ff45c2dd7c982f9ada6b5fc979f082f
SHA2567495b9faf55ff02d0a2906ca3e3f4b356abd96e421815f9d07f893682da6eaf2
SHA512c6be6c93262e0c42527722af20fdd3be2c9936eb601280c36492e0bb2151bb63f88bfb150690ae361c75d01a33647c2440bb49e290af38c5c5af5a707320e3de
-
/data/data/com.kiloo.subwaysurf/files/datastore/firebase_session_Y29tLmtpbG9vLnN1YndheXN1cmY=_settings.preferences_pb.tmp
Filesize212B
MD594d9d49c5fcd9d2b654c3ffb50f689b1
SHA13939d0c21e28cfd780ea7024f1618a6af10c1d3c
SHA2562c71faf69b7188dc42e512ec0db36992b11ddbbc286f75520dc595f110f71b84
SHA5125e0b238996b2a24f5b85db5cd42587020ba5674e0ac87b62168ba7e3597884f8e58e8d27652a348df1b05ec3cbce60e7a014a2d1fd5dbd0f5c841f7965bd5a76
-
Filesize
24B
MD5ae8ef0e42acc9e339ee5485f328e7260
SHA193e56d624e8091392160dad03c944aad68acf674
SHA2568982450c7dc6a5a103d7bd8190cf1d80ee1e3e62e0e80022db6ba2414cf0781b
SHA512bc53ed2433d7b3a9724e403b1c3e0799ac45ee138ad9ca3288955bbdf930cfe826950b1b64cc9422c43e943d807f57fe8b798eb2c0b68479265f1408b5e1d15e
-
Filesize
8B
MD5ea7f4ad9f1f1ba158cf71db14d7bce52
SHA1a56e46f9409dc5d98c939e0d79312de70a66b0f4
SHA2569490e946a7dda0847facf2787ef181d0a65e40fd12edcb8418a69c9d5334ee8f
SHA5120cc374b2d905c9bdbf379c8c4bf8c23d3061db8776f8a8afec28b6efc08a3ad4c2794a63e316ea974a5f0d78e7987d214bbb2f81fd55c4d14f938ecfa812d943
-
Filesize
512B
MD522e88ae677b414012b17edd6f444a498
SHA18f336efaed2d6eefff8d0ad6149b6bf2bf98467c
SHA2564d0edf3a1cfef3c3299811bdf3f7b69e7d37fdb199a9c6cf68bfd34cd8233e0a
SHA512e9a54c23ef909b5d3254d1d9e77e30ecb86a471fd8e409324a587ee3bbd635ae44dea6462aac0836037e2082bf91788172a5ecbe61b991cb3466de2803b3716c
-
Filesize
16KB
MD52b54f483d6e709475b06fcf7c0ac417b
SHA164ee70be66aacce0f340b5ba8960ad515debae20
SHA2564802d8f7f9d4ccedfbf531dabfd2e9a69a5b9321a7d97f3e40ac66d9131d06e6
SHA51202b08d794cf6404c0343e3cadf38f6aabcfa6b25e7463564e95abad7a20e223dcdafaf1c2a06e8dea1c79746a5f5a0f6d2ed2f4c1ada3e2dcf1e5a4739ad86b0
-
Filesize
116KB
MD57fe72c121ec5c0991a4a4ba50dc02d71
SHA14fb3e36e7d5f9ff8a2c2df2ceffd54d66ab3bcf9
SHA25684ff44858fbb0de826d0ed47415acfe088f92f95d0a9d5d90ac59278135bed34
SHA51245f4764d935af4916cb4a046b237a1eb0804e67b066120a129d4d0e81b1da12aee1076cc25d3cfccab3f41f5a6802aa703e74a965031e432d37afe1b63809db9
-
Filesize
261KB
MD585e202c212aa28a7816800511b203bca
SHA16fef3473c6596db122a77813fc1f17d36877173b
SHA25645278444ebeb23bc51a1b3856ba4675ae553bdec227c9a5018cdf88797d0e4f1
SHA512499b210be71d7d05e00fb01a21c1c4c0fd174f29a77430dbe4f8b4925b8c75846b85753c2335e4dbc3bc571c20c4b7bac7c7860b3cd7194244aac964ab4722c1
-
Filesize
3KB
MD5fcb9badff8dd9f2bdf043ff47f98808f
SHA1b77325d66b38b4d16da38f6680de3d6fe21cf89f
SHA2560c679560143c6ee44d35c64106776f29560925eb77864c8465166cb5c8b13835
SHA512674a8086b2eab8485a81789074207b3ba39b423f524c77560502aef4d3a8377b12c8f8184880e7ef314d99a3012d957099b269b45732be390bdfe51ac55aedb1
-
Filesize
14KB
MD58a0230f86abfd73bbbcccf931151e007
SHA10ff8c6afccb5bd1b3896490d6cacaa9404a95e94
SHA2569aa4d89bed6c445e35e5c29b61e8fd4891e7766cc448097920ac8d762af7017d
SHA5128407918f8bca5c24faf3f688289bb935f7bce00b519aadf67db26d046170cc3f39a498f0287502628bf47992c062e0bba8a2c07b350e6412f9fab22a0fdb7504
-
Filesize
22B
MD564351b6847c6925629977111ffad0afd
SHA131c19e7b04d9d9ef503cd5205543158eef1989cb
SHA2566adee5be1d9d2cecc4d952696ca92162a39015a615b0bae3d385e3f5cb81c780
SHA51265128dd554fd439a3147516f06b6045116ec5b055e4e3c7080fc54ec5c7612222f8d83e3ffa1d1cdf18b66558456b6f156345e5a70b8557536a774f94e2f0a8b
-
Filesize
45B
MD5fcb64a24dd3c94ae7cc41585d6a0a45f
SHA182db445f9a2324046d25eb0f074743438310ea58
SHA256108943d0ace576476a00f1c23a2e73137e84e0ce2d98604b74d45e99d5869c33
SHA5127d462b43ca4ede42c2b1968d6d0e33475c5e625c59706c6d13c30875d05863072c5b5ab3b8d0c356e046cbde59fac6940d2ae17c54e3ccff771eebaef7ec928b
-
Filesize
61B
MD5f68a3aaf40adcc93f8d945a310522751
SHA130d09a060d46428c563f34e989adeba58b5e3baf
SHA256089483db62303868620a3e0fd24a6afe05271bf5bd9fa3a6332add341cd0cc05
SHA512bb8213ace8d86dc1a3c6578984b6a73699670aed17d393d0dff7992a42d518d10eefc4cd0139729244f725612afd1155c5ac4e50aee8ee30a8b7408d8a77d672
-
Filesize
11.8MB
MD5ae05967d82fd6f91cd26006bd1787b3d
SHA12c42f5d19a9d77e67c2cc6c99a98ea5090457804
SHA256cc0950eab85f382faa0fb4da8d8519ba925e6c6497e2b0594e513e06bb5de525
SHA51276b06ac7efc22ade0d0737db07c3752987b5687a9cc934cea73a8b1d190b709614a6a4a190caaf4306234b84e9943bbe84ea0728da4791568112bd3377e85854
-
/storage/emulated/0/Android/data/com.kiloo.subwaysurf/files/il2cpp/Resources/System.Data.dll-resources.dat
Filesize91KB
MD54860ddd4350579f8fcacb1881582335a
SHA1493c03e9cfef6f72a00f92023cdb88527dfdf72c
SHA25698a7950ec6de3242c2e190dfa630188dfa32511a125542b94baa952d1c757d49
SHA51251421a1e79914cb6d828305103c5f7cdb020d98107586abd7e04614f65bae8004101e5567a873f52fe2daa3a7984bf4f7a4930e628cc5f86e709e3a37f812a95
-
/storage/emulated/0/Android/data/com.kiloo.subwaysurf/files/il2cpp/Resources/System.Drawing.dll-resources.dat
Filesize24KB
MD5be7be6458aead12c07a04f26e260c3d1
SHA134d46d957520cb1a525ea9eab36cc40d57a3715a
SHA2567c33aa707bc3fdc83991b81a97d6fc622b140762a767300f08f616c2c0a91255
SHA512554a6b2983fdd055bab56b7f210340521b7e7b480f38aa6368691ea9e38fbaa5eb93aab0137e6c9d7f3b58feb0780753d48eac951a83ea8db67a91df1db0ced6
-
/storage/emulated/0/Android/data/com.kiloo.subwaysurf/files/il2cpp/Resources/mscorlib.dll-resources.dat
Filesize329KB
MD521d06dbc8af6432b2b49536ed30609af
SHA111a1c0e2ab2f8c06fe4507535ed47e0dd279a60d
SHA256c5baa176a5b72cd545266340e42102d393a5e43d38c95796bc828918bb95277f
SHA5122971f54eaa14c3ce6e2352e5a1aea5b044f0894bf4eac92de8cd92515b6473b5ca56ebfcad4369a9d4935cbefea2540a83f332fd4d832c37768310e8776ceb5e
-
Filesize
36B
MD5eab8ad38d158fb356530216896e211e3
SHA156f3d3eeff8a0d5a33fa1e33f7d66e018810c891
SHA2569b13d276c4a303c1a8679532e181f93d4efe0e8fd6dbaf83135de67652b4d4dd
SHA512a9ebdc0f30d92144cfe423f5d82feb13c6a061c16be3912960c95c9dd4bf8ea447dcd560e8e59a59fc280aa22bc4ee6e74ccc4ea36281a14ef4bf0e9cbbb6ffa
-
/storage/emulated/0/Android/data/com.kiloo.subwaysurf/files/sybo_analytics/raw/Sybo_Analytics_Buffer.log
Filesize642B
MD59e5c8abd6dc0ac61bc92909b14c29957
SHA1ef4d7815049757d328a915673600dc1d9cc72fcd
SHA256c31a91812d723331545739c5a198f7b8fafba0c855af330edde98cdc4cc4de29
SHA51228b5f2d0d89fd67286234e62af0c6cea3830d0669c00487129338e14d048e54bdea622f94fcbac188b69748126e1769ec2e1f87c3eaa226c788dabfb32f7a911
-
/storage/emulated/0/Android/data/com.kiloo.subwaysurf/files/sybo_analytics/raw/Sybo_Analytics_Buffer.log
Filesize1KB
MD58d445344ca883dadbd478c309afddb93
SHA1518fef2d9fb6737068388b263b78adce8b584441
SHA256341ce7de5e57d3e3b7364e2afd9d659090fff072eb224cd290a6d4b72000e284
SHA5128b37797eda1bceefb3e01b3bf22f49e83204de92e20251ba76d15518180be1e5195f1a43891b7ccd2bd59f229b556a8cd83be7fd89da976ef6e93b2fdd996b05