e719ec213ba9e467a0adaefb31e12f95278b7c918540acd85a7fa87d6471410e

Analysis

max time kernel
25s
max time network
171s
platform
android-10_x64
resource
android-x64-20240910-ja
resource tags

arch:x64arch:x86image:android-x64-20240910-jalocale:ja-jpos:android-10-x64system
submitted
27/02/2025, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Squid Game Wallpaper 4K HD_2.1.8_APKPure.apk
Size

10.2MB
MD5

b8c38dc92719aa9f4c6cb96fa9d6f278
SHA1

8c5a65b080716cbfd791e8f5696e6c0185ec8031
SHA256

e719ec213ba9e467a0adaefb31e12f95278b7c918540acd85a7fa87d6471410e
SHA512

2e159faa3b02c03953a0a6d2ac18477128ccc63bb0613cf570b7d76057d3598c4a5ec4079436454c05ae7e532d98073889ece386c2fcb30f6ce40bb5ad504464
SSDEEP

196608:NFUsWLI4pJ+JTNP3K67jT00wRdYw2HPelNevZNy8p/uxCPDMdLG:bUsuI4OZNP3b7v0tuelsZNVtuxUDMdS

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.xexostudio.sqpomofindyou

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xexostudio.sqpomofindyou/files/audience_network.dex	5180	com.xexostudio.sqpomofindyou
/data/user/0/com.xexostudio.sqpomofindyou/files/audience_network.dex	5180	com.xexostudio.sqpomofindyou

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.xexostudio.sqpomofindyou

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xexostudio.sqpomofindyou

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.xexostudio.sqpomofindyou

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.xexostudio.sqpomofindyou

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xexostudio.sqpomofindyou

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.xexostudio.sqpomofindyou

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.xexostudio.sqpomofindyou

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xexostudio.sqpomofindyou

com.xexostudio.sqpomofindyou
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5180

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xexostudio.sqpomofindyou/databases/OneSignal.db

Filesize
52KB

MD5
5715efdd2d828d4d57c1376120ba2806

SHA1
06f279c976087695aaaf885df323d996a2560cc1

SHA256
f8ebc23104952761ccaf8dcf7ea9e5341bb0f3da744550a518f8dbc8b3404904

SHA512
dbc9dcea4f947dc61663054585dcc175b79ce7d69aaa8335754d1fe6d02881dadd75d3846190178e677e80efd63a1e364a31d51620d51e8e6254b8864651bb30

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/OneSignal.db-journal

Filesize
8KB

MD5
7765caeb76eed0fd04f3897d07838db9

SHA1
341d1cbbc54f53bc4160a64852b6f1cdd244e903

SHA256
7f6945a090034cd85c2c9141c237b56439b2cbca7a9989764994f3aff80a3e1f

SHA512
b73941302a0040770aa68fcc1aa551260b98ffbe6d5004f421bc0ba760e1bbdfc2751008647b90398f27704c220eaea86b2eb46c5b0f80fdc2d8e5eff6dc46c0

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/OneSignal.db-journal

Filesize
512B

MD5
0acefc273e70c79b6653832b14c19a17

SHA1
e779aec04de983ea27376bfdca816575fcae54fa

SHA256
ddceecc1b6ed2f0ae5715fd35a51c07a58cbf93901a0008288a3a55bbe124ff7

SHA512
8c05682976cdbe5f536a2733db50e455041cc7f5d7fa0a5da7a77e7d6522acd6318ba8da4ed7bd988ec03380496b59eb8b2117312d55f3c8ca540824142dc5cf

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/OneSignal.db-journal

Filesize
8KB

MD5
66ac24acc52d6ecd22cdb0ccace2c779

SHA1
1fd36c1f26f70da9868b5bb53f7e2f2b48def6bd

SHA256
e1b84c2e160eb4a7381ada9b185256140243c37b1f70f3e7242cbfa934ef344b

SHA512
cfe567ca9b3ed8aef66b9b7b1f836ed466265dbae58ba016d46eaa82b3770951afbda61776743f009b8b2a3c72ccfd0812e362b6f72ccef2c99ed92bba6bde17

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/androidx.work.workdb-journal

Filesize
512B

MD5
ede46803d38bfbcdc1470bbd3e17224d

SHA1
1551cdb02e6ac536e8960ad3d7c9eb76c45b24bf

SHA256
28fb43ee59134505fceb0f1e7b60c35b57ee7df09d2404a1f007fdaab23f35d7

SHA512
fdb3100e47aebcc696daf04391001340c4e9975bb16caee3b26af34e98698c781e3e45db79a8941287aecae0417343019d6899b3ef137df904ffe9e4760ae220

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/androidx.work.workdb-wal

Filesize
16KB

MD5
eb4ea7bc9fc0cc25bf673914b8ac5a27

SHA1
d453eb471fea416df757e3cef45d2e7b888b2c7e

SHA256
2e1c22c044e32eb2e478f180333c5b6322555a22dff0a4c9f568482f8a3eaf56

SHA512
bbbddc97c9ee9dc0e758b95a4b7ca0d11b6df5cb5b0c42224a227909260ae7cb9f3e11a81a0224f4bec5e9a6ab6a7c787bc606a2f307167ce421ad7751363155

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/androidx.work.workdb-wal

Filesize
88KB

MD5
6a2025112a3cc7ace4c8228e76d6f75a

SHA1
2402d6e2df28c3e2c8534b2e9cb3ab109ce04a9d

SHA256
17d0c13374a145b1f283135e1e28c8d7414f7c183e0d2b53ed81dfcd122f12d4

SHA512
e9696d3631bb0b4a5b41226ff0a548317d70e410806033ef4279975e7f7ef89d7c432ed3887e3ee8c7f868ada5479b06e7d89b99923467d222cc3458471bcc14

Download Submit
/data/data/com.xexostudio.sqpomofindyou/files/audience_network.dex

Filesize
3.1MB

MD5
af02dbf436efc92b63dad16a71acba33

SHA1
93fd330f83c76ed7967f320e6f6cd2bbb937efc9

SHA256
38c5c0584805386dfce413656c636c4e73a968ade86cabd7a4ecac4f034a842b

SHA512
a3c77f369abe214b27aba3b8e98def476e20790803db49e2d357cffd9c0ea063b246942f2556ad125aa2e6406a3edee4c7846893befa9d50e08dae849a4e95a3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads