Analysis

  • max time kernel
    65s
  • max time network
    71s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    03/01/2025, 21:30

General

  • Target
    five-nights-at-freddys-2-demo.apk
  • Size 8.2MB
  • Sample250103-1cg11strcx
  • SHA256 4fd2360965f4024aad74ffca01dddcc598e2e22a7269b8c106c1b7352c050243
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 6 IoCs
  • Checks known Qemu files. 1 TTPs 3 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Checks the presence of a debugger
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.aptoide.android.aptoidegames
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:4256

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        2e91ecbfd4aa73a2b62863fd8888807a.0.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/cache/2e91ecbfd4aa73a2b62863fd8888807a.0.tmp
        • Size 5KB
        • SHA256 3534d691576b27a7c89e88a4df7826f1b509f4b14d3ccde2b62c2711f30bb58c
        • MD5 SHA1 SHA512 SSDEEP

        2e91ecbfd4aa73a2b62863fd8888807a.1.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/cache/2e91ecbfd4aa73a2b62863fd8888807a.1.tmp
        • Size 1KB
        • SHA256 599671561b9fc0e7d12b9d4b04ab4d3fd1f53ed43436d0a9f8702a70ea2bfac2
        • MD5 SHA1 SHA512

        998d9f3c1369d11ea60ccf51d889a65b.0.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/cache/998d9f3c1369d11ea60ccf51d889a65b.0.tmp
        • Size 5KB
        • SHA256 7d16409650c71a40330f2ed4db482b534f13035d73d728be82efe7c437430da7
        • MD5 SHA1 SHA512 SSDEEP

        998d9f3c1369d11ea60ccf51d889a65b.1.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/cache/998d9f3c1369d11ea60ccf51d889a65b.1.tmp
        • Size 57B
        • SHA256 45b21f74fa0c7fc63f39f5d07ee50bb0e617752b97448b67d729a8dffb047a79
        • MD5 SHA1 SHA512

        journal

        • Path /data/data/com.aptoide.android.aptoidegames/cache/journal
        • Size 210B
        • SHA256 5f4e86384ca6321f32d0b41ab86c72b0b58dbcea085f645d96b90a32b3045baf
        • MD5 SHA1 SHA512

        journal.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/cache/journal.tmp
        • Size 36B
        • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
        • MD5 SHA1 SHA512

        LibGlobalFetchLib.db-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/LibGlobalFetchLib.db-journal
        • Size 512B
        • SHA256 fe12d30112b5c5632b58c34a8184190f4c9718acac6b6a813b142fe6e2e705f8
        • MD5 SHA1 SHA512

        LibGlobalFetchLib.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/LibGlobalFetchLib.db-wal
        • Size 16KB
        • SHA256 9d5bb7d1bde80ff10604245edc1e0e34c45f173328b9599696355ade6f6c38f0
        • MD5 SHA1 SHA512 SSDEEP

        LibGlobalFetchLib.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/LibGlobalFetchLib.db-wal
        • Size 40KB
        • SHA256 b4807a5a3bf94201df2c34d9165d4c66e5ef2999e17b27b7320f0571d25a97fd
        • MD5 SHA1 SHA512 SSDEEP

        aptoide_task_info.db-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/aptoide_task_info.db-journal
        • Size 512B
        • SHA256 dcaf7832296c7d2c95458f0fb542b5aa682b439f221c8782a8f9222330191703
        • MD5 SHA1 SHA512

        aptoide_task_info.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/aptoide_task_info.db-wal
        • Size 16KB
        • SHA256 b4b640b34305453aebd4de12ea6061f59c1c3d358068e03c55eab90f2bc1cd06
        • MD5 SHA1 SHA512 SSDEEP

        aptoide_task_info.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/aptoide_task_info.db-wal
        • Size 40KB
        • SHA256 eaecc625261cb96095a4140f1b8757dcc1e586e16eb38cb10a623235c0f2ddb2
        • MD5 SHA1 SHA512 SSDEEP

        aptoide_updates.db-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/aptoide_updates.db-journal
        • Size 512B
        • SHA256 f3fe048f2f148f5779305e5cb36b65ee19f26728602d181fa3276192925ab0d9
        • MD5 SHA1 SHA512

        aptoide_updates.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/aptoide_updates.db-wal
        • Size 16KB
        • SHA256 8b93ccd31688dcd389fa326350632d64d87f2e8de4a9e8150fe00e82b919adff
        • MD5 SHA1 SHA512 SSDEEP

        aptoide_updates.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/aptoide_updates.db-wal
        • Size 36KB
        • SHA256 98b67126291e847ad5fb148ae9096071931765a18fa9c9153c4fd21087910c9d
        • MD5 SHA1 SHA512 SSDEEP

        com.google.android.datatransport.events

        • Path /data/data/com.aptoide.android.aptoidegames/databases/com.google.android.datatransport.events
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 a14a932e0cd67e785fd8d8aa8d0e5f799ac95f8e1fcb6e88ec1cc43b50eb6126
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-shm

        • Path /data/data/com.aptoide.android.aptoidegames/databases/com.google.android.datatransport.events-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        com.google.android.datatransport.events-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/com.google.android.datatransport.events-wal
        • Size 120KB
        • SHA256 6058551a4adc38edb3620fbb47e39f1056dacdbdf2cda129f29e1c5f50925603
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 a62e9c48a25e9b9dc663c6ad4c20327e20688df275789c0b69be457fd150f2dd
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 fb5863321512a508d9b91d25511f163efe991e025ba7c7a153d3b84572d977ff
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 e2b50dfd0345c9b6089af1080aa94c0281cf41b776cf86ba4e67f1630bbfba3a
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 1e167a031d7f2c9d3fd399c0849e7681335c998fa4bba78b698438d7d385524d
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 55b7414695cd389e7f4c6d2823e0ee32e73ae440f9d566d4baf90931a0a83a5a
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 0da906d72b0b0286a14ce8405336ac7fecf3e44387afcafb4a6a17f15bedb06a
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 1dabe0ec765abebca7832d2a168655e972baab864070bbd5a8ff9b140903fe04
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db-wal
        • Size 36KB
        • SHA256 d580d06c38b34f654b6c1ec194e35e50a5cdd310cd33136939c1fa196a2f283c
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 7dd6e58c937b44ab021d2f4a3c05b83ca00ba78bf40417e81e5b2289f547f7d1
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 4693589a5ed0b9ef121df7ab91337871261d8ab648a30010711f20475ea4222c
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 995a6ec5ffdd45ac4c4c2ea4539aec6cbc8994214ed86dd4ccd9c4ec278da17a
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 f90e3b9d4e737f8d5a070b53eef2f8e9e560d73079c32a8d6cbf7f5a4f2cb99a
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 a9476aa354d383532476416dcb3874bdb0c9f76e7040cfbcd532e818f77d3ba1
        • MD5 SHA1 SHA512 SSDEEP

        com.crashlytics.settings.json

        • Path /data/data/com.aptoide.android.aptoidegames/files/.crashlytics.v3/com.aptoide.android.aptoidegames/com.crashlytics.settings.json
        • Size 728B
        • SHA256 da7d82401155f964fc16633d723535083acb2dcbadd89857cb01e3b8608432fe
        • MD5 SHA1 SHA512

        internal-keys

        • Path /data/data/com.aptoide.android.aptoidegames/files/.crashlytics.v3/com.aptoide.android.aptoidegames/open-sessions/677856F50088000110A09018563D5570/internal-keys
        • Size 207B
        • SHA256 952963de66b5e50647d5eaa9654a3e125146d59af93ba53458bf52aeee1052da
        • MD5 SHA1 SHA512

        report

        • Path /data/data/com.aptoide.android.aptoidegames/files/.crashlytics.v3/com.aptoide.android.aptoidegames/open-sessions/677856F50088000110A09018563D5570/report
        • Size 807B
        • SHA256 a1e61677a65fe9b3c954dac8c7d5795f54565e81d1dad0b9fa35fd6909030890
        • MD5 SHA1 SHA512

        userlog

        • Path /data/data/com.aptoide.android.aptoidegames/files/.crashlytics.v3/com.aptoide.android.aptoidegames/open-sessions/677856F50088000110A09018563D5570/userlog
        • Size 803B
        • SHA256 6f96b9315a23876bf57a6981871bd2498b84e0a4f1110ef059916a59e05f247f
        • MD5 SHA1 SHA512

        userlog.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/.crashlytics.v3/com.aptoide.android.aptoidegames/open-sessions/677856F50088000110A09018563D5570/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        PersistedInstallation1575609118094943587tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/PersistedInstallation1575609118094943587tmp
        • Size 568B
        • SHA256 6867e1f1d6c08c93dfa0811d0f83244300b41de91ab1fb4778825621dc16d901
        • MD5 SHA1 SHA512

        PersistedInstallation2823453174777860702tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/PersistedInstallation2823453174777860702tmp
        • Size 90B
        • SHA256 fd38915a8e95a261e30d4c731dbed6a0d09c8296d16fcb11932cb84f360b8f41
        • MD5 SHA1 SHA512

        RAMP_CONFIG_DATA

        • Path /data/data/com.aptoide.android.aptoidegames/files/RAMP_CONFIG_DATA
        • Size 398B
        • SHA256 6b6f2387792f5b1a17397b0901a0f20f2e0b4e537a57c2e0e7c3da89b6a594f8
        • MD5 SHA1 SHA512

        RAMP_CONFIG_TIME

        • Path /data/data/com.aptoide.android.aptoidegames/files/RAMP_CONFIG_TIME
        • Size 13B
        • SHA256 41ebf30fc3063a5face99c88563a3fd3e70f261c82f066f6fbdcd2a95aa09c36
        • MD5 SHA1 SHA512

        REMOTE_CONFIG_DATA

        • Path /data/data/com.aptoide.android.aptoidegames/files/REMOTE_CONFIG_DATA
        • Size 2KB
        • SHA256 253955eaff2930f48134d9c5650ef9e71c0b2d02bd465c93749dbb795c41fb07
        • MD5 SHA1 SHA512

        REMOTE_CONFIG_TIME

        • Path /data/data/com.aptoide.android.aptoidegames/files/REMOTE_CONFIG_TIME
        • Size 13B
        • SHA256 d28e36119d91ee26ff4cfee7f3d31772ef272f3e6b6bb80da0838c126ea6ac07
        • MD5 SHA1 SHA512

        appLaunch.preferences_pb.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/datastore/appLaunch.preferences_pb.tmp
        • Size 23B
        • SHA256 aa557f5a8162af42a746cf692e31535b7fc553c8fae288868f5b9079bbdcbfa8
        • MD5 SHA1 SHA512

        firebase_session_Y29tLmFwdG9pZGUuYW5kcm9pZC5hcHRvaWRlZ2FtZXM=_data.preferences_pb.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/datastore/firebase_session_Y29tLmFwdG9pZGUuYW5kcm9pZC5hcHRvaWRlZ2FtZXM=_data.preferences_pb.tmp
        • Size 50B
        • SHA256 836071d1aa1df3ca236de055545ba0eb45f5a5452349bd220f4bbb919bc7d074
        • MD5 SHA1 SHA512

        firebase_session_Y29tLmFwdG9pZGUuYW5kcm9pZC5hcHRvaWRlZ2FtZXM=_settings.preferences_pb.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/datastore/firebase_session_Y29tLmFwdG9pZGUuYW5kcm9pZC5hcHRvaWRlZ2FtZXM=_settings.preferences_pb.tmp
        • Size 33B
        • SHA256 a4aaa2a4e0cb12123b405a9d33bdd7edf8cbb41ea92e75deb1ba21bf1db5b2a6
        • MD5 SHA1 SHA512

        firebase_session_Y29tLmFwdG9pZGUuYW5kcm9pZC5hcHRvaWRlZ2FtZXM=_settings.preferences_pb.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/datastore/firebase_session_Y29tLmFwdG9pZGUuYW5kcm9pZC5hcHRvaWRlZ2FtZXM=_settings.preferences_pb.tmp
        • Size 75B
        • SHA256 1e58e88b20702d0a80025c1fbacc9ad5fe2565311e2230d581d669fbd7e8b0ef
        • MD5 SHA1 SHA512

        firebase_session_Y29tLmFwdG9pZGUuYW5kcm9pZC5hcHRvaWRlZ2FtZXM=_settings.preferences_pb.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/datastore/firebase_session_Y29tLmFwdG9pZGUuYW5kcm9pZC5hcHRvaWRlZ2FtZXM=_settings.preferences_pb.tmp
        • Size 121B
        • SHA256 232f9626cbee2e063e25f61a08f46575d019b62f02a6753c1325957a95e1c513
        • MD5 SHA1 SHA512

        firebase_session_Y29tLmFwdG9pZGUuYW5kcm9pZC5hcHRvaWRlZ2FtZXM=_settings.preferences_pb.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/datastore/firebase_session_Y29tLmFwdG9pZGUuYW5kcm9pZC5hcHRvaWRlZ2FtZXM=_settings.preferences_pb.tmp
        • Size 163B
        • SHA256 7495b9faf55ff02d0a2906ca3e3f4b356abd96e421815f9d07f893682da6eaf2
        • MD5 SHA1 SHA512

        firebase_session_Y29tLmFwdG9pZGUuYW5kcm9pZC5hcHRvaWRlZ2FtZXM=_settings.preferences_pb.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/datastore/firebase_session_Y29tLmFwdG9pZGUuYW5kcm9pZC5hcHRvaWRlZ2FtZXM=_settings.preferences_pb.tmp
        • Size 212B
        • SHA256 81a7fa72527b9d2d4f053e5e9dc1cbd5ec82622369aeffa154cf7357d0dc8639
        • MD5 SHA1 SHA512

        ids.preferences_pb.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/datastore/ids.preferences_pb.tmp
        • Size 57B
        • SHA256 409ee7907fa751b25c186573f4854ee85118db092416d95e5f99577a84fe0680
        • MD5 SHA1 SHA512

        userFeatureFlags.preferences_pb.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/datastore/userFeatureFlags.preferences_pb.tmp
        • Size 99B
        • SHA256 4afe2255e484402bdb54441c26b0769e18e4bf6ce1e5a438b98abba9b154c9c7
        • MD5 SHA1 SHA512

        frc_1:808759492170:android:4f9abf37305c970450f0b3_firebase_fetch.json

        • Path /data/data/com.aptoide.android.aptoidegames/files/frc_1:808759492170:android:4f9abf37305c970450f0b3_firebase_fetch.json
        • Size 593B
        • SHA256 9120497ecda370b7f2c97f04116651dd40ba2a534f1840a7b4332da42f0953e6
        • MD5 SHA1 SHA512

        profileInstalled

        • Path /data/data/com.aptoide.android.aptoidegames/files/profileInstalled
        • Size 24B
        • SHA256 3f1574f3407697c9bc8e4172c1922bd996103688313a737364488ea4005d80c6
        • MD5 SHA1 SHA512

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.aptoide.android.aptoidegames/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 2e8dd508a6a072780fbc01e2daaff916f2292ca8bb7129f6b068b6e5fc2a873c
        • MD5 SHA1 SHA512

        androidx.work.workdb-journal

        • Path /data/data/com.aptoide.android.aptoidegames/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 dad868f81e2dbda6164b14ee59b170e2d9a93bfd33d76407c93bdc97519972a4
        • MD5 SHA1 SHA512

        androidx.work.workdb-wal

        • Path /data/data/com.aptoide.android.aptoidegames/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 f852e0e95e2ee62f1d18d466b95e9e133831c32621db25f43efe2856a0596f8a
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.aptoide.android.aptoidegames/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 0ec65a9a98a530fafd69868b70bf8b651b498c39fda9a6768f7d63530ca6e4d4
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.aptoide.android.aptoidegames/no_backup/androidx.work.workdb-wal
        • Size 342KB
        • SHA256 3bb9bebd73d80488eaf11e881820eeab09262106253a313413c212ce605969e8
        • MD5 SHA1 SHA512 SSDEEP

        primary.prof

        • Path /data/misc/profiles/cur/0/com.aptoide.android.aptoidegames/primary.prof
        • Size 7KB
        • SHA256 08ccbe5235488de4cee7ba090257053efa71ccd12db7f6cff18e435c1235756b
        • MD5 SHA1 SHA512 SSDEEP

        primary.prof

        • Path /data/misc/profiles/cur/0/com.aptoide.android.aptoidegames/primary.prof
        • Size 14KB
        • SHA256 717d9db62dfca863b2d2c5ca801a01b9cfec55cc38df177289d7345b1ce6f8b4
        • MD5 SHA1 SHA512 SSDEEP