Analysis
- max time kernel
87s - max time network
127s - platform
android_x86 - resource
android-x86-arm-20240624-en - resource tags
- submitted
09/11/2024, 04:39
General
- Target iFlyTube.apk
- Size 68.8MB
- Sample241109-e934vszrel
- SHA256 e90a678db9e09a87d6949fdb16791e9448f5a064e759c3f2d5ab0246ba03434e
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Checks the presence of a debugger
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
com.videomate.iflytube1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
cookies.txt
yt-dlp4720878135604545707.tmp
YTDLnisDatabase-journal
YTDLnisDatabase-wal
YTDLnisDatabase-wal
YTDLnisDatabase-wal
YTDLnisDatabase-wal
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-shm
com.google.android.datatransport.events-wal
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db-journal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
com.crashlytics.settings.json
report
user-data
userlog
userlog.tmp
PersistedInstallation5537075978817714667tmp
PersistedInstallation8225904381947476013tmp
firebase_session_Y29tLnZpZGVvbWF0ZS5pZmx5dHViZQ==_data.preferences_pb.tmp
firebase_session_Y29tLnZpZGVvbWF0ZS5pZmx5dHViZQ==_settings.preferences_pb.tmp
firebase_session_Y29tLnZpZGVvbWF0ZS5pZmx5dHViZQ==_settings.preferences_pb.tmp
firebase_session_Y29tLnZpZGVvbWF0ZS5pZmx5dHViZQ==_settings.preferences_pb.tmp
firebase_session_Y29tLnZpZGVvbWF0ZS5pZmx5dHViZQ==_settings.preferences_pb.tmp
firebase_session_Y29tLnZpZGVvbWF0ZS5pZmx5dHViZQ==_settings.preferences_pb.tmp
profileInstalled
profileinstaller_profileWrittenFor_lastUpdateTime.dat
androidx.work.workdb-journal
androidx.work.workdb-wal
androidx.work.workdb-wal
androidx.work.workdb-wal
libc++_shared.so
libcares.so
libiconv.so
libxml2.so
libavcodec.so
libavdevice.so
libavfilter.so
libavformat.so
libavutil.so
libpostproc.so
libswresample.so
libswscale.so
inputrc
cert.pem
openssl.cnf
capi.so
libandroid-support.so
libbz2.so.1.0.8
libcrypt.so
libcrypto.so.1.1
libffi.so
libformw.so.6.1
libgdbm.so.6.0.0
libgdbm_compat.so.4.0.0
libhistory.so.8.0
liblzma.so
libmenuw.so.6.1
libncursesw.so.6.1
libpanelw.so.6.1
libpython3.8.so.1.0
libpython3.so
libreadline.so.8.0
libsqlite3.so
libssl.so.1.1
libutil.so
libz.so.1.2.11
formw.pc
libcrypto.pc
libffi.pc
liblzma.pc
libssl.pc
menuw.pc
ncursesw.pc
openssl.pc
panelw.pc
python-3.8-embed.pc
python-3.8.pc
readline.pc
sqlite3.pc
zlib.pc
LICENSE.txt
__future__.py
__phello__.foo.py
_bootlocale.py
_collections_abc.py
_compat_pickle.py
_compression.py
_dummy_thread.py
_markupbase.py
_osx_support.py
_py_abc.py
_pydecimal.py
_pyio.py
_sitebuiltins.py
_strptime.py
_sysconfigdata__linux_.py
_threading_local.py
_weakrefset.py
abc.py
aifc.py
antigravity.py
argparse.py
ast.py
asynchat.py
__init__.py
__main__.py
base_events.py
base_futures.py
base_subprocess.py
base_tasks.py
constants.py
coroutines.py
events.py
exceptions.py
format_helpers.py
futures.py
locks.py
log.py
proactor_events.py
protocols.py
queues.py
runners.py
selector_events.py
sslproto.py
staggered.py
streams.py
subprocess.py
tasks.py
transports.py
trsock.py
unix_events.py
windows_events.py
windows_utils.py
asyncore.py
base64.py
bdb.py
binhex.py
bisect.py
bz2.py
cProfile.py
calendar.py
cgi.py
cgitb.py
chunk.py
cmd.py
code.py
codecs.py
codeop.py
__init__.py
abc.py
colorsys.py
compileall.py
__init__.py
__init__.py
_base.py
process.py
thread.py
Makefile
Setup
Setup.local
config.c
config.c.in
install-sh
makesetup
python-config.py
python.o
configparser.py
contextlib.py
contextvars.py
copy.py
copyreg.py
crypt.py
csv.py
__init__.py
_aix.py
_endian.py
README.ctypes
__init__.py
dyld.py
dylib.py
fetch_macholib
fetch_macholib.bat
framework.py
util.py
wintypes.py
__init__.py
ascii.py
has_key.py
panel.py
textpad.py
dataclasses.py
datetime.py
__init__.py
dumb.py
gnu.py
ndbm.py
decimal.py
difflib.py
dis.py
README
__init__.py
_msvccompiler.py
archive_util.py
bcppcompiler.py
ccompiler.py
cmd.py
__init__.py
bdist.py
bdist_dumb.py
bdist_msi.py
bdist_rpm.py
bdist_wininst.py
build.py
build_clib.py
build_ext.py
build_py.py
build_scripts.py
check.py
clean.py
command_template
config.py
install.py
install_data.py
install_egg_info.py
install_headers.py
install_lib.py
install_scripts.py
register.py
sdist.py
upload.py
config.py
core.py
cygwinccompiler.py
debug.py
dep_util.py
dir_util.py
dist.py
errors.py
extension.py
fancy_getopt.py
file_util.py
filelist.py
log.py
msvc9compiler.py
msvccompiler.py
spawn.py
sysconfig.py
text_file.py
unixccompiler.py
util.py
version.py
versionpredicate.py
doctest.py
dummy_threading.py
__init__.py
_encoded_words.py
_header_value_parser.py
_parseaddr.py
_policybase.py
architecture.rst
base64mime.py
charset.py
contentmanager.py
encoders.py
errors.py
feedparser.py
generator.py
header.py
headerregistry.py
iterators.py
message.py
application.py
audio.py
base.py
image.py
message.py
multipart.py
nonmultipart.py
text.py
parser.py
policy.py
quoprimime.py
utils.py
__init__.py
aliases.py
ascii.py
base64_codec.py
big5.py
big5hkscs.py
bz2_codec.py
charmap.py
cp037.py
cp1006.py
cp1026.py
cp1125.py
cp1140.py
cp1250.py
cp1251.py
cp1252.py
cp1253.py
cp1254.py
cp1255.py
cp1256.py
cp1257.py
cp1258.py
cp273.py
cp424.py
cp437.py
cp500.py
cp720.py
cp737.py
cp775.py
cp850.py
cp852.py
cp855.py
cp856.py
cp857.py
cp858.py
cp860.py
cp861.py
cp862.py
cp863.py
cp864.py
cp865.py
cp866.py
cp869.py
cp874.py
cp875.py
cp932.py
cp949.py
cp950.py
euc_jis_2004.py
euc_jisx0213.py
euc_jp.py
euc_kr.py
gb18030.py
gb2312.py
gbk.py
hex_codec.py
hp_roman8.py
hz.py
idna.py
iso2022_jp.py
iso2022_jp_1.py
iso2022_jp_2.py
iso2022_jp_2004.py
iso2022_jp_3.py
iso2022_jp_ext.py
iso2022_kr.py
iso8859_1.py
iso8859_10.py
iso8859_11.py
iso8859_13.py
iso8859_14.py
iso8859_15.py
iso8859_16.py
iso8859_2.py
iso8859_3.py
iso8859_4.py
iso8859_5.py
iso8859_6.py
iso8859_7.py
iso8859_8.py
iso8859_9.py
johab.py
koi8_r.py
koi8_t.py
koi8_u.py
kz1048.py
latin_1.py
mac_arabic.py
mac_centeuro.py
mac_croatian.py
mac_cyrillic.py
mac_farsi.py
mac_greek.py
mac_iceland.py
mac_latin2.py
mac_roman.py
mac_romanian.py
mac_turkish.py
mbcs.py
oem.py
palmos.py
ptcp154.py
punycode.py
quopri_codec.py
raw_unicode_escape.py
rot_13.py
shift_jis.py
shift_jis_2004.py
shift_jisx0213.py
tis_620.py
undefined.py
unicode_escape.py
utf_16.py
utf_16_be.py
utf_16_le.py
utf_32.py
utf_32_be.py
utf_32_le.py
utf_7.py
utf_8.py
utf_8_sig.py
uu_codec.py
zlib_codec.py
enum.py
filecmp.py
fileinput.py
fnmatch.py
formatter.py
fractions.py
ftplib.py
functools.py
genericpath.py
getopt.py
getpass.py
gettext.py
glob.py
gzip.py
hashlib.py
heapq.py
hmac.py
__init__.py
entities.py
parser.py
__init__.py
client.py
cookiejar.py
cookies.py
server.py
imaplib.py
imghdr.py
imp.py
__init__.py
_bootstrap.py
_bootstrap_external.py
abc.py
machinery.py
metadata.py
resources.py
util.py
inspect.py
io.py
ipaddress.py
__init__.py
decoder.py
encoder.py
scanner.py
tool.py
keyword.py
_asyncio.cpython-38.so
_bisect.cpython-38.so
_blake2.cpython-38.so
_bz2.cpython-38.so
_codecs_cn.cpython-38.so
_codecs_hk.cpython-38.so
_codecs_iso2022.cpython-38.so
_codecs_jp.cpython-38.so
_codecs_kr.cpython-38.so
_codecs_tw.cpython-38.so
_contextvars.cpython-38.so
_crypt.cpython-38.so
_csv.cpython-38.so
_ctypes.cpython-38.so
_ctypes_test.cpython-38.so
_curses.cpython-38.so
_curses_panel.cpython-38.so
_datetime.cpython-38.so
_dbm.cpython-38.so
_decimal.cpython-38.so
_elementtree.cpython-38.so
_gdbm.cpython-38.so
_hashlib.cpython-38.so
_heapq.cpython-38.so
_json.cpython-38.so
_lsprof.cpython-38.so
_lzma.cpython-38.so
_md5.cpython-38.so
_multibytecodec.cpython-38.so
_multiprocessing.cpython-38.so
_opcode.cpython-38.so
_pickle.cpython-38.so
_posixsubprocess.cpython-38.so
_queue.cpython-38.so
_random.cpython-38.so
_sha1.cpython-38.so
_sha256.cpython-38.so
_sha3.cpython-38.so
_sha512.cpython-38.so
_socket.cpython-38.so
_sqlite3.cpython-38.so
_ssl.cpython-38.so
_statistics.cpython-38.so
_struct.cpython-38.so
_testbuffer.cpython-38.so
_testcapi.cpython-38.so
_testimportmultiple.cpython-38.so
_testinternalcapi.cpython-38.so
_testmultiphase.cpython-38.so
_xxsubinterpreters.cpython-38.so
_xxtestfuzz.cpython-38.so
array.cpython-38.so
audioop.cpython-38.so
binascii.cpython-38.so
cmath.cpython-38.so
fcntl.cpython-38.so
grp.cpython-38.so
math.cpython-38.so
mmap.cpython-38.so
ossaudiodev.cpython-38.so
parser.cpython-38.so
pyexpat.cpython-38.so
readline.cpython-38.so
resource.cpython-38.so
select.cpython-38.so
syslog.cpython-38.so
termios.cpython-38.so
unicodedata.cpython-38.so
xxlimited.cpython-38.so
zlib.cpython-38.so
Grammar.txt
Grammar3.8.0.final.0.pickle
PatternGrammar.txt
PatternGrammar3.8.0.final.0.pickle
__init__.py
__main__.py
btm_matcher.py
btm_utils.py
fixer_base.py
fixer_util.py
__init__.py
fix_apply.py
fix_asserts.py
fix_basestring.py
fix_buffer.py
fix_dict.py
fix_except.py
fix_exec.py
fix_execfile.py
fix_exitfunc.py
fix_filter.py
fix_funcattrs.py
fix_future.py
fix_getcwdu.py
fix_has_key.py
fix_idioms.py
fix_import.py
fix_imports.py
fix_imports2.py
fix_input.py
fix_intern.py
fix_isinstance.py
fix_itertools.py
fix_itertools_imports.py
fix_long.py
fix_map.py
fix_metaclass.py
fix_methodattrs.py
fix_ne.py
fix_next.py
fix_nonzero.py
fix_numliterals.py
fix_operator.py
fix_paren.py
fix_print.py
fix_raise.py
fix_raw_input.py
fix_reduce.py
fix_reload.py
fix_renames.py
fix_repr.py
fix_set_literal.py
fix_standarderror.py
fix_sys_exc.py
fix_throw.py
fix_tuple_params.py
fix_types.py
fix_unicode.py
fix_urllib.py
fix_ws_comma.py
fix_xrange.py
fix_xreadlines.py
fix_zip.py
main.py
patcomp.py
__init__.py
conv.py
driver.py
grammar.py
literals.py
parse.py
pgen.py
token.py
tokenize.py
pygram.py
pytree.py
refactor.py
linecache.py
locale.py
__init__.py
config.py
handlers.py
lzma.py
mailbox.py
mailcap.py
mimetypes.py
modulefinder.py
__init__.py
connection.py
context.py
__init__.py
connection.py
forkserver.py
heap.py
managers.py
pool.py
popen_fork.py
popen_forkserver.py
popen_spawn_posix.py
popen_spawn_win32.py
process.py
queues.py
reduction.py
resource_sharer.py
resource_tracker.py
shared_memory.py
sharedctypes.py
spawn.py
synchronize.py
util.py
netrc.py
nntplib.py
ntpath.py
nturl2path.py
numbers.py
opcode.py
operator.py
optparse.py
os.py
pathlib.py
pdb.py
pickle.py
pickletools.py
pipes.py
pkgutil.py
platform.py
plistlib.py
poplib.py
posixpath.py
pprint.py
profile.py
pstats.py
pty.py
py_compile.py
pyclbr.py
pydoc.py
_pydoc.css
topics.py
queue.py
quopri.py
random.py
re.py
reprlib.py
rlcompleter.py
runpy.py
sched.py
secrets.py
selectors.py
shelve.py
shlex.py
shutil.py
signal.py
AES.py
ARC2.py
ARC4.py
Blowfish.py
CAST.py
ChaCha20.py
ChaCha20_Poly1305.py
DES.py
DES3.py
PKCS1_OAEP.py
PKCS1_v1_5.py
Salsa20.py
_ARC4.abi3.so
_EKSBlowfish.py
_Salsa20.abi3.so
__init__.py
_chacha20.abi3.so
_mode_cbc.py
_mode_ccm.py
_mode_cfb.py
_mode_ctr.py
_mode_eax.py
_mode_ecb.py
_mode_gcm.py
_mode_ocb.py
_mode_ofb.py
_mode_openpgp.py
_mode_siv.py
_pkcs1_decode.abi3.so
_raw_aes.abi3.so
_raw_arc2.abi3.so
_raw_blowfish.abi3.so
_raw_cast.abi3.so
_raw_cbc.abi3.so
_raw_cfb.abi3.so
_raw_ctr.abi3.so
_raw_des.abi3.so
_raw_des3.abi3.so
_raw_ecb.abi3.so
_raw_eksblowfish.abi3.so
_raw_ocb.abi3.so
_raw_ofb.abi3.so
BLAKE2b.py
BLAKE2s.py
CMAC.py
HMAC.py
KMAC128.py
KMAC256.py
KangarooTwelve.py
MD2.py
MD4.py
MD5.py
Poly1305.py
RIPEMD.py
RIPEMD160.py
SHA.py
SHA1.py
SHA224.py
SHA256.py
SHA384.py
SHA3_224.py
SHA3_256.py
SHA3_384.py
SHA3_512.py
SHA512.py
SHAKE128.py
SHAKE256.py
TupleHash128.py
TupleHash256.py
_BLAKE2b.abi3.so
_BLAKE2s.abi3.so
_MD2.abi3.so
_MD4.abi3.so
_MD5.abi3.so
_RIPEMD160.abi3.so
_SHA1.abi3.so
_SHA224.abi3.so
_SHA256.abi3.so
_SHA384.abi3.so
_SHA512.abi3.so
__init__.py
_ghash_portable.abi3.so
_keccak.abi3.so
_poly1305.abi3.so
cSHAKE128.py
cSHAKE256.py
keccak.py
PEM.py
PKCS8.py
_PBES.py
__init__.py
Numbers.py
Primality.py
_IntegerBase.py
_IntegerCustom.py
_IntegerGMP.py
_IntegerNative.py
_modexp.abi3.so
KDF.py
SecretSharing.py
__init__.py
_scrypt.abi3.so
DSA.py
ECC.py
ElGamal.py
RSA.py
__init__.py
_ec_ws.abi3.so
_ed25519.abi3.so
_ed448.abi3.so
_openssh.py
_x25519.abi3.so
__init__.py
random.py
DSS.py
PKCS1_PSS.py
PKCS1_v1_5.py
__init__.py
eddsa.py
pkcs1_15.py
pss.py
Counter.py
Padding.py
RFC1751.py
__init__.py
_cpu_features.py
_cpuid_c.abi3.so
_file_system.py
_raw_api.py
_strxor.abi3.so
asn1.py
number.py
py3compat.py
strxor.py
__init__.py
__init__.py
_constants.py
_file.py
_iff.py
_riff.py
_tags.py
__init__.py
_util.py
mid3cp.py
mid3iconv.py
mid3v2.py
moggsplit.py
mutagen_inspect.py
mutagen_pony.py
_util.py
_vorbis.py
aac.py
ac3.py
aiff.py
apev2.py
__init__.py
_attrs.py
_objects.py
_util.py
dsdiff.py
dsf.py
easyid3.py
easymp4.py
flac.py
__init__.py
_file.py
_frames.py
_id3v1.py
_specs.py
_tags.py
_util.py
m4a.py
monkeysaudio.py
__init__.py
_util.py
__init__.py
_as_entry.py
_atom.py
_util.py
musepack.py
ogg.py
oggflac.py
oggopus.py
oggspeex.py
oggtheora.py
oggvorbis.py
optimfrog.py
smf.py
tak.py
trueaudio.py
wave.py
wavpack.py
site.py
smtpd.py
smtplib.py
sndhdr.py
socket.py
socketserver.py
__init__.py
dbapi2.py
dump.py
sre_compile.py
sre_constants.py
sre_parse.py
ssl.py
stat.py
statistics.py
string.py
stringprep.py
struct.py
subprocess.py
sunau.py
symbol.py
symtable.py
sysconfig.py
tabnanny.py
tarfile.py
telnetlib.py
tempfile.py
textwrap.py
this.py
threading.py
timeit.py
token.py
tokenize.py
trace.py
traceback.py
tracemalloc.py
tty.py
types.py
typing.py
__init__.py
__main__.py
async_case.py
case.py
loader.py
main.py
mock.py
result.py
runner.py
signals.py
suite.py
util.py
error.py
parse.py
request.py
response.py
robotparser.py
uu.py
uuid.py
__init__.py
__main__.py
Activate.ps1
activate
activate.csh
activate.fish
warnings.py
wave.py
weakref.py
webbrowser.py
__init__.py
handlers.py
headers.py
simple_server.py
util.py
validate.py
xdrlib.py
__init__.py
NodeFilter.py
__init__.py
domreg.py
expatbuilder.py
minicompat.py
minidom.py
pulldom.py
xmlbuilder.py
ElementInclude.py
ElementPath.py
ElementTree.py
__init__.py
cElementTree.py
__init__.py
expat.py
__init__.py
_exceptions.py
expatreader.py
handler.py
saxutils.py
xmlreader.py
client.py
server.py
zipapp.py
zipfile.py
zipimport.py
yt-dlp
primary.prof
primary.prof