Analysis

  • max time kernel
    131s
  • max time network
    133s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    10-11-2024 10:56

General

  • Target

    one.apk

  • Size

    7.7MB

  • MD5

    d55b4144c8fd49874e211c5f202835ec

  • SHA1

    8afc38d0ee5ac2854d9dae63d1f075654b0dbe14

  • SHA256

    70796fbe34ee7cb73c700f6a817b133ad95727543aef6c992182ec144cc92e5d

  • SHA512

    593457518ec0d62f70e7b37f11d84d2f131f3263f6bb940c43c4d5438ebdf56441c820988607f66174ac429609e9fe188c6ac0097cb570ed9c730bc75514233f

  • SSDEEP

    196608:pr4lU2ceS9+PwE1xsuc6P3bXwlOtluPsUKDptefRc:pi3BIE1xfb+sUq6c

Malware Config

Signatures

  • Checks Android system properties for emulator presence. 1 TTPs 6 IoCs
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • live.oneplayer
    1⤵
    • Checks Android system properties for emulator presence.
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4505

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/live.oneplayer/cache/image_manager_disk_cache/6c958a1e130d08aa0e5db73529ac772901a67c6cbc04a85f021c894257bf754e.0.tmp

    Filesize

    25KB

    MD5

    633712e466a67e179b8d9dd877cbdcf1

    SHA1

    09d0c025fa80f8a9e3a83af95f932ce53eee67be

    SHA256

    bc0f4c5f078da55a95de3e45e841a01526603aaeceeac58b63bf84f6775434fb

    SHA512

    d65d572ace760972eed79f024f0f52b6f0ac9f3ec206b9ddf9cebd1b74c8d39744c9d8c80910242abc8c8cfbd133e98b585e748d77a2a75532f6a103a3bfe029

  • /data/data/live.oneplayer/cache/image_manager_disk_cache/7b5a812ee62361bb510d95e00a086401c9025d483b626ffc37169edeb547704f.0.tmp

    Filesize

    1KB

    MD5

    bbd3abba9b1a7b4b49aff6af2a1c7c0b

    SHA1

    95115487977e3c1956cc96437b55749550b28529

    SHA256

    2260b157cc7539fcc35ac33834f97c6040a86a37aaf81fd145a7ed91ab1108cb

    SHA512

    8064ab2041835b45145469ad921a6061fb00150fdb4024766eb0c28bc6e5e8c7c71482c7c91eca00e799681ecb55b686ec3d35f3bc3270f203f66ae460a27a8b

  • /data/data/live.oneplayer/cache/image_manager_disk_cache/journal

    Filesize

    326B

    MD5

    a0bc80dab6b8e38274b99febe24c745e

    SHA1

    0f35272b5d7d80ad2c611d3f61b7ae8ba79655a2

    SHA256

    22e696b7441c76b635b622a451368d1a457e657fb8c2fc590296226e510132e9

    SHA512

    7911827c1207e67d5c6a80e8055ed5a293b9b342278e2902827299f088960889b5e4eaf24174026ce699228bcd82610e4755a8509f41aabf6da66436f8d8b450

  • /data/data/live.oneplayer/cache/image_manager_disk_cache/journal.tmp

    Filesize

    31B

    MD5

    8c92de9ce46d41a22f3b20f77404cc1d

    SHA1

    8671a6dca00edb72be47363a7071be65cf270373

    SHA256

    68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

    SHA512

    30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

  • /data/data/live.oneplayer/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    d02bf63f26674a283780f1dd57c1b0d4

    SHA1

    7686872035973fd7061647f794bd6ad75fdff1c6

    SHA256

    1980e19d3a7f107adb90c26fa0445592b9fc28224ee885f1da53aee549e9b6df

    SHA512

    b01470adb9b8298c0ad62be5c39f1371bd26aa970e0d9b2d97620b64fd9d24a25dfe565691097ef023bfd63e94ed83a52767fec6f6da53ecb5e2457df4f69b3c

  • /data/data/live.oneplayer/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    d58a21dd780cee548cbdef81d20d793b

    SHA1

    fb37e340ad370858604de5cafb0d7885aa9d691f

    SHA256

    9ddd6448554e05f109bcab74eb63c20ebd9612a1b88f701563419c914cee2298

    SHA512

    8fcdbca20211f084c65214eea093bd8e5ffa24577193c030468f27064df1b035312fb79b36e344b3592ff845ab3f343b080e5fbec27e46f553fc368ba4091baa

  • /data/data/live.oneplayer/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    6fd192b91bae820b62bbaa8e5c9f376c

    SHA1

    596fa2ffbd7184f164f80c6d021fef991bfeb8d8

    SHA256

    2dc8a71fce1f2b231ad31e87313c7eb14a3c0d0ebe87a259df77f0d8e0fc5c8d

    SHA512

    8e45a0a16c31e3d2cb027bcd2ecbe555e44d5fcdd571c10aef2cdfb46213beb071b0519874e891c63d01f3f2c8b9f36ac2e901332deaf2292fae033b0d535609

  • /data/data/live.oneplayer/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    f481668c493326f04c986c1cfab248ff

    SHA1

    f5c9c802971bb1b900e3319b2a329448ae4722dd

    SHA256

    8219abc6866a8b5e0718c308a91c6629ca5d534b5daba02ee5eda393b3594ee2

    SHA512

    7cea8dfd923f4b0d993d859e4e525001e7b3364f3d1d4aed32228c7aa6ed8436066fc6ea3f350dcc2cc0ab4311d89ed0d81e1275d7f36f00d6c0c6456ee2207d

  • /data/data/live.oneplayer/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    f6caab2e4d78bd9645d2a0edd9ff81a6

    SHA1

    63cfef2a78eb50fa68df96cba11553ac197e1361

    SHA256

    c82ab232bf2ab236f9ba7ea261753789f3b4eb7a96d29274b15a91b637ff750c

    SHA512

    e848d99b15e272531dab0952c0b787e94fb09acde95a31f687fad868c4ec5deb91bb4aeefa0bf3339ee9ea02d18b857767b3228b8e5c8d774350de42790ee92b

  • /data/data/live.oneplayer/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    3065f3a01915c30c28fa52c2d507038d

    SHA1

    4fef775ea92213549f70095e07cd7616c7bdd21d

    SHA256

    ead893e7f7090b9a0c138cfaae334893901ca55ee0242a2ab102220e95822547

    SHA512

    19a3fbe48d708296b7ae4d8940604b3f30cd3a17d93bd4d3ea6650e0e6981efec876adfc0b9346550d9bc4949425d61c25709f45883536e19c178ca6e8dbfdb4

  • /data/data/live.oneplayer/databases/google_app_measurement_local.db-journal

    Filesize

    512B

    MD5

    7d50f3acd12a050e7908a5c3ed63e22f

    SHA1

    2bda19fae76a64e2d70d8988de2fed1c32397d7f

    SHA256

    d103773d28e28e7d5a87a871c802705fe1da4979a9bbdca553ac7707bac97ffa

    SHA512

    9f140dc3dea3952fc31713ad97f079645845ca3e53799346c619596ca789573b01359cbf08e81415df469a1e9e7b001c3ba889cc545ffb997abf02c4b4e1e876

  • /data/data/live.oneplayer/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    6b65e930aafe6d119e4e0d46a23afcd5

    SHA1

    6646fcc3384c8d72ed02a5a53157d758a4ceff6f

    SHA256

    dbcdfe3fbcc2cf10770987f68d738683afb5840e8afddb52c411e115205a41c2

    SHA512

    e283764a5bb53aa314c335f22275489355acd841841b8c44a6d78a9b36edafa076d2190180bea205e8bdd475c0555e3028eea2a181784230c88bf2379b24775e

  • /data/data/live.oneplayer/databases/google_app_measurement_local.db-journal

    Filesize

    4KB

    MD5

    48352ccc044c95cae72f905007c37ee8

    SHA1

    b6332a6550b60436f2db23b1a21707e91805e7e7

    SHA256

    7d90989c1a0c0d1b8aa68bf003ccb6f8268f1b9409602d28e7245a4a6c149b23

    SHA512

    1925f7d604fbab6281aa2d52a1ea5ac56b3d1a8f6106b6f2904a021012def6746498e05ca66ebe5b6676452cf701403fe006a336e1c2000fee4a947846876975

  • /data/data/live.oneplayer/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    74dbc66fc6d0fe361d064d7ee22c0449

    SHA1

    329ca4295c08be6af0baeb4cc03c4217515a7134

    SHA256

    8ff3e45c2e0967a8795dd23256ff57921a6cce8c3d73ec5fdd54f6f5edbb7fd7

    SHA512

    168a799f24d5c0ebc77bf945cc470ff7506d3d9071c154c8696471c08a3ed49f224b3afaee64b19af026dd5e6232d6ac37eee52125b4e33bd67dbd1744304b44

  • /data/data/live.oneplayer/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    f7147983892e0a04b95f9e53d5a3ecc1

    SHA1

    9c167a26e45067908d51b3584359f6e51c4791a6

    SHA256

    202481e5e12aeac6974b2d5ea4372a3907a29d3c46ab095973e73f8f6292634f

    SHA512

    506d0471e1a56e9589bf8b9cb75abda9d67f837d4b32719672ce77550baef4c3e9adf081bb1a79a300aae15c9ad23210ab097493220ea30bc5d68cc25d5542fb

  • /data/data/live.oneplayer/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    2ada4c9d7d7798a1555e9485e01e7db4

    SHA1

    8ab2ef7b4e740c54b8c83d3877d40b7326a55ff9

    SHA256

    dd81936261d7f3f4f700b1883861696fe3ff3d0d9e75ee1041ca3b42a7a612f2

    SHA512

    1e8218df23af889cf7c4f7c96a2b3ae13d33d2bc11d17365d4c9f78183df8b102f02bc390b03560e6af04b08b4d83c3f4858d1692b5f949795cd5b125ca1195e

  • /data/data/live.oneplayer/files/UnityAdsStorage-private-data.json

    Filesize

    41B

    MD5

    16d3e6eac0e79222a9b368edac765b34

    SHA1

    48d5e621fcdd84108f5750d6905180b622715b11

    SHA256

    3a518b70256a689906d6740062462e3124aad6e55c5aa47339a87a56e4933ee7

    SHA512

    d0aaacf86100135241426e2a0e9ba44414aa456cd708124e2f9c3a8037e008870cbcb506d316e4fe7cfe1d6dc3073393989a6f3c29f7cfabd6b0f65057afe747

  • /data/data/live.oneplayer/files/UnityAdsStorage-private-data.json

    Filesize

    623B

    MD5

    ca765aa5b6f793526d356528a30067aa

    SHA1

    d7fbe5ad9030c0cb0907041af3f2a0907e075311

    SHA256

    117bab4703d30c1e519630bede44d354015b94411b95e65a35f9ecc277271d9b

    SHA512

    b344d1114b79d243b8554f19df4cbb39560b9ee1cf551948dbac6c5469b3f067e17660d554af93c0be10e12b162228422e5a41f3db96599e56b1eca7797e1156

  • /data/data/live.oneplayer/files/UnityAdsStorage-private-data.json

    Filesize

    1KB

    MD5

    b732fe41320a3b6133b8edcdad2a4db3

    SHA1

    7a22f4243305a6f0493bacd4b04a6c2664d8dc16

    SHA256

    4f545cc6ba2c651daeb376eb9472cf359e715cdf07aad5425f43f9a5a0818c6e

    SHA512

    f1d958b92ab4b0bd6c66433b85250c16889807295bd92304c028cadc26387e7cbdd2cbb05c04e8da97e03fbe1706cd8b0be7cc735764383cfb7e3b8627c5f99a

  • /data/data/live.oneplayer/files/UnityAdsStorage-public-data.json

    Filesize

    2B

    MD5

    99914b932bd37a50b983c5e7c90ae93b

    SHA1

    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

    SHA256

    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

    SHA512

    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

  • /data/data/live.oneplayer/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

  • /data/data/live.oneplayer/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    1492d4820df5929e7f8942d64f35566c

    SHA1

    32dae0a63e040c445bd07b97c693b50b13fd8baa

    SHA256

    eaceb0799913f099572a54911b37303fbdd4d1c0f67e152314529b6e3a00b9e7

    SHA512

    fab92846938c90937f1cfad049d1d8a04becfb5a7f556177a0dd17097d1e8398c09fbea0535bae208e3451ec0e9190ae74a42cbab96f79aa319f3007897b8068

  • /data/data/live.oneplayer/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/live.oneplayer/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    8f0b7d3352010bf7672b2bb1c9d008d8

    SHA1

    4a434efa94a00af56aea3569b5d34535bf566126

    SHA256

    17d5c6fb855a29099f7b8f86a8741ec11c0ba16a0728441fff05d3cac509f272

    SHA512

    eb6db69bdd1fb1236dda854b47873b61667f47b755a17391c788f167277e3f40d7694c39cb58ec7fc8450bc1bced70fa56edf357c0978dd816011aee8cc5d270

  • /data/data/live.oneplayer/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    64ad1149aa1d93e07247e63ec6c0616c

    SHA1

    bf353b44f4693190b9ab7185889f45e17f33d2d4

    SHA256

    78410f9699987581c51aed8f2124dd3350cb4cdbb7daa238098cbf471a4752af

    SHA512

    813f8fa58a7d76c171b21a6c856a7d642cd1f94b131b4a51f79cc354550dfba20e2c18e7ce23716a2905e06d1ccdf18d51fe3726f1961346dff49f6d77c16c5b

  • /data/data/live.oneplayer/no_backup/com.google.InstanceId.properties

    Filesize

    2KB

    MD5

    29571c181b69f1b908889ccde585e553

    SHA1

    fad45f90614eb80982ceaa732a8475b80f7078db

    SHA256

    55576432d5bf67f552b508f4bf9771f1ae241dc6fae3492de4db59e494f203a9

    SHA512

    0c704b9e20f4258f29e0a21efa6844ee46c7521948245fd0f25662a261e3ff9d46ec8a7ba3ae8fdbe882039da89c0679607a40df94ce042e40341cd1c0621f2e

  • /data/data/live.oneplayer/oat/x86_64/[email protected]

    Filesize

    450B

    MD5

    0b2cde7da78a7ee50864de4a39d40da7

    SHA1

    227bcd0562748067f03d9e3ab9a082a1addb10d5

    SHA256

    a8b951b587af129b71b7bdca410a2a5008a3375ed39320680c7152887d71a267

    SHA512

    cd87ba3f88cf12299e6dd320c7a38cf14a8f20c956aeb21a444384a33819f7691fab23defb1725d491028bac7a722dee8624686aab35b31c06652a8946d0f6bb

  • /data/user/0/live.oneplayer/[email protected]

    Filesize

    3.2MB

    MD5

    da2b94774dcd96d257284f7710cd09c9

    SHA1

    6825ddecefc435f1de0608ace7f4c7cdd982473d

    SHA256

    08db2ca6e3f51676dc1c9b114d522ac5ed211ae2e359bf6270066aca651e6932

    SHA512

    9d548c66030456cf28b4efc7e1c399e455daaba6a4e5f44072e4852f62305547b7d0344d7328f514e901c29130ab5c6cce1c0df5d8dfedfa129083ca1712fe82

  • /storage/emulated/0/Android/data/live.oneplayer/cache/UnityAdsCache/UnityAdsCache-8acdfcef857188bd468230b21ed279401f6eb0cd38de52b6951e69cde9bcf44d.jpg (deleted)

    Filesize

    15KB

    MD5

    700a5405708d550686b659d402c5a591

    SHA1

    684f51b6fb6b3a84ff98b621a1d3f75e0d96fd02

    SHA256

    83fc830f0079d01c647675f80d1a81e7f0e8974734b2a38cb1234b7265ab635d

    SHA512

    8b30cb78003a597b5b3971df31eb2583ea0432feb02a78223307c27fdbc39d9776b562e49f67fd7cc4f50521786ec895c747871ec52ff7196d89b583a5234137

  • /storage/emulated/0/Android/data/live.oneplayer/cache/UnityAdsCache/UnityAdsCache-98283cfaeb9b10f025cbe2f25f2e474c16d5f01a5075373b0962c5581c705c22.jpg (deleted)

    Filesize

    20KB

    MD5

    ded748c02fea5c8b4b735e7cce0dfd4f

    SHA1

    853d7ee91fa1fd2545315a7521d09c377099ddc3

    SHA256

    e7f7af1bf533fb62ff38441ca501f9029a3f8b132f933b06a168e8820af897a5

    SHA512

    9c4847bbc70acc0093629ae79c7e1574936e04efbb6b104319092e4b64a83612b8635db8611beef6a49af770e8234975c5e56186af4a8512a459b460229dd0e9

  • /storage/emulated/0/Android/data/live.oneplayer/cache/UnityAdsCache/UnityAdsCache-be97d53ba2e2fac97927a3c66fe9c7fd8fb7a295078855dd0961c0de489627f9.mp4 (deleted)

    Filesize

    2.3MB

    MD5

    2f8c5c4e69f8e795f2d36bafa234ff84

    SHA1

    67e9504eabfff4c2104000d2ea98b4af3e312cda

    SHA256

    4fb51a7ac7ba49f2e85fad09266ffa042a825a11f34f575d50605a1488fb4f3a

    SHA512

    c1acd5978b73318eb2ac15a88041a815722e9f86aa6f1155d69ad682b56643808145053917f5890542b08f94e8ecdaa93b4af4607acdb373ce942e489af45d87

  • /storage/emulated/0/Android/data/live.oneplayer/cache/UnityAdsCache/UnityAdsTest.txt (deleted)

    Filesize

    4B

    MD5

    098f6bcd4621d373cade4e832627b4f6

    SHA1

    a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

    SHA256

    9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

    SHA512

    ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

  • /storage/emulated/0/Android/data/live.oneplayer/cache/UnityAdsCache/UnityAdsWebApp.html (deleted)

    Filesize

    2.2MB

    MD5

    ec0be7729506bf50791fa8831a1fc680

    SHA1

    9ddaaddef48db397270eba733a39b4e30eb1a39f

    SHA256

    3a523de9bbcb80dc3cd9ec2c2d87a46bbd5cfa8017f1e03786317292a8e6d5bc

    SHA512

    f98fcc152d485d35718150d4ea3e59f6a91dc61dddf6fc851d0775f719253b24b1972f34b9d5b124a0c5f24464b0e14596afd354bd976567532892054300d5ac