Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    11/04/2025, 22:08

General

  • Target

    56d02524b2ee7df8e4bb5070ab2b480385518d16b8acbbdb0265ee3f1d8e1024.apk

  • Size

    3.5MB

  • MD5

    678b025a29837ea87e3921d8b846c531

  • SHA1

    3c559ad7f1884c6436043215f9c3498324fa4fa8

  • SHA256

    56d02524b2ee7df8e4bb5070ab2b480385518d16b8acbbdb0265ee3f1d8e1024

  • SHA512

    7e912619068c322d749fa7024bea4c463a679793201e042b1e02d247abbc0e606289e80e626cc098603120ed33243805e1de7fffa1380267172a9a9981b923c1

  • SSDEEP

    98304:CEHjl+YWTgeoc81GWXYQ7eqguHpBUpF5sr8Tgkbx:7HRMglJ1BHCnTdbx

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 8 IoCs
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 20 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests cell location 1 TTPs 1 IoCs

    Uses Android APIs to to get current cell information.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • ru.sobgqfur.fjgfgkcxl
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu pipes.
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests cell location
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4268

Network

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/ru.sobgqfur.fjgfgkcxl/databases/PackagesDB

    Filesize

    272KB

    MD5

    da2ef0b53ea4381367c35bdfc31ccb90

    SHA1

    bbf952ee2776a1b47c009a975c3f11e54fad0bb6

    SHA256

    da7c6931a6a94a46012ce887e4cefe02f2b8fb803b02973d8eee65ffa4363247

    SHA512

    24f87a6bfcb3716cd52ca5972fe1923cc4ba48bf46129b84ca0e6729ed2e4efc51d2459a3ad400fe8ddf40631fd874ca121e4986a00b167398cd275fc40d9bc3

  • /data/data/ru.sobgqfur.fjgfgkcxl/databases/PackagesDB-journal

    Filesize

    512B

    MD5

    75fa24913bd0c867756067a95c109761

    SHA1

    fd8a2e063de2f3c5cef2fcf64f04b5b44e5431c9

    SHA256

    aeac2a85b4213052ee20b25fe4e4fc8609f6c2ac84523ca0b4bea0506390900e

    SHA512

    c4b5f43b1b3ca9508a221d2913f7e038106bd9fb121d9222d8d5504890ee73823b851fe4b20cdb4c1d12dc0df2b1bbd6156a593c6091383bef04d4687102bd10

  • /data/data/ru.sobgqfur.fjgfgkcxl/databases/PackagesDB-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/ru.sobgqfur.fjgfgkcxl/databases/PackagesDB-wal

    Filesize

    418KB

    MD5

    a3d92fc3ecb428a94d590a6be918e2fe

    SHA1

    fffcfcaff8cfc94988f30c70effbccf41314a9b6

    SHA256

    2c9c9059063bca7291744ec9a8e68fa5e525f5a505aa8720a9f76be80c6630e2

    SHA512

    a7ccfb3cd18b5db9574b1cf22d04d8a9963e238a66b47baa669059bad8ebf61ca2837c00039c0e5a33899073a068918955946d67d40163a5c672277c52b5fcb5

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/StartappAdInfoMetadata

    Filesize

    1KB

    MD5

    3385bf5e84b924101e0ef8bcc2d45778

    SHA1

    7a755ead52124d5f7642f693ca90fab7ef5b6bfb

    SHA256

    c9441c1df77315149a18556fd1480415e6b97b95fb3cd3196833ef227073aa93

    SHA512

    98ee789aeecec2b1c2b2f94dc87f7c50ac3d41b418f560af3f6fb89baf7ad8ae0ced4f5eb6b5a8ae4b34b89798cccf892cd511a16f64b1c515bbc2ef836e1e9d

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/StartappAdsMetadata

    Filesize

    2KB

    MD5

    128503719bfdef6b09d4c8feb1a096d4

    SHA1

    8ca4eba243150f61a8660ed41c42510e16f36cb1

    SHA256

    db1874b1c410bf8b36c2715ddd5b274e67146a1b75c6393be20abb9dafd6c20b

    SHA512

    038e1cc07930281bbc2e6395baf41f9d463530496933a0f26bc1a37de4f3a1d75536ee1425a6f1580f8f32cda1e2e2fa4db754288d09351d81af5aafaa4aed61

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/StartappBannerMetadata

    Filesize

    719B

    MD5

    64837ec60a5def703db0471648bdabff

    SHA1

    f1eb4a00833351d6dd8040d9658faca109c0859f

    SHA256

    04e4c66980a46478b18296ce2620239907d7406143d003fd7ba7bb6382440ae3

    SHA512

    e856f892b0a8b4c645fb87d841e4faba64e2398589dbf25ee36f20e7df7a63e2e9464276232a625be4063659c924a005d8598fe03aa967c9d2a8d97b4ab68f34

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/StartappCacheMetadata

    Filesize

    785B

    MD5

    e9a968e4938a9bb9632799e2f10bbbbb

    SHA1

    8c9e1e04c6784d0f9d182081e6329897c957d166

    SHA256

    8afd711f027fad53c5c96bc0d79574983b6d661af90aebaddf0f1dd858d03f2d

    SHA512

    cf76a0a9051cade548200101d5e0837b1d1eacc441fed901641e7e9fa87ffa3304a98ba674c8d20ea30ff682076f45b60cdbf260e3dd2770b8f19ff2d393f133

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/StartappMetadata

    Filesize

    7KB

    MD5

    c06147337103f7cd62ecac94478d5d77

    SHA1

    38ba182429ebf1cefb2b839a3eef9ba180f78254

    SHA256

    3e5b9b0cd3dac896a1b7e629cbe93db0b573c6e28c93e96fcf599145014d38f6

    SHA512

    521b79c027ba0b60581bcad14ceed0cb5b8fe62da78e27abe6be395af1f77452b2956ceebd93211dc6cf104ebb23450c6c9d9e375fdf934a906afbcf473e2fa9

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/StartappSplashMetadata

    Filesize

    1KB

    MD5

    8e4f0494efafc6045ae519ab3a6e0fa1

    SHA1

    17a6a545c056070e6ffa457b74f4014b7f986215

    SHA256

    69a142d2894aa1f22c5277f527b61df2f461a230750ee0c74a3f07e6a9c953d0

    SHA512

    19e5b8dedf13d99432c6e64dba78c6c5041c078cb034b63778c2aacfe42ac8b085ad01642e117f4bd749fd80712ba31a83adea42ddac9b81eda984235292b4a6

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/UnityAdsStorage-private-data.json

    Filesize

    41B

    MD5

    16d3e6eac0e79222a9b368edac765b34

    SHA1

    48d5e621fcdd84108f5750d6905180b622715b11

    SHA256

    3a518b70256a689906d6740062462e3124aad6e55c5aa47339a87a56e4933ee7

    SHA512

    d0aaacf86100135241426e2a0e9ba44414aa456cd708124e2f9c3a8037e008870cbcb506d316e4fe7cfe1d6dc3073393989a6f3c29f7cfabd6b0f65057afe747

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/UnityAdsStorage-private-data.json

    Filesize

    627B

    MD5

    8f4da98f196b6f3503a1d52bcf4e67b9

    SHA1

    68813f4d2d8464fd1e95712d756b6afb5976a852

    SHA256

    6c43276b9c753e22d31b1aff5774f78c39766ef4203e1cc43b1e4fc3c39ad85a

    SHA512

    61edda7d69fff92a7f1574726622df3af3d4d39c6cf5589400d839302a134c83306aa917939c27227515584befb5db758a8d159fcd83183cd7803fad1041f928

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/UnityAdsStorage-public-data.json

    Filesize

    2B

    MD5

    99914b932bd37a50b983c5e7c90ae93b

    SHA1

    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

    SHA256

    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

    SHA512

    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/adc3/026ae9c9824b3e483fa6c71fa88f57ae27816141

    Filesize

    41B

    MD5

    be948aecc38887832616d20c3b40085c

    SHA1

    8efbcf98d000ac2a914842b26d3b9394b828a3cc

    SHA256

    28d865d25ec483005cbfdcb954f2b5e441b5a3caeb073a99a1dfdba5cf0ca350

    SHA512

    348dedccfd3b3775eb62333a56cd675329f40e2f918f2cf3f169ac0d05fdd47979532b1009aa690fd0f7e498118aa1c805e021c26ffd50ee0f4f258abdf7ec62

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/adc3/AppInfo

    Filesize

    68B

    MD5

    429059fdba597db89e491d6bc8d92b45

    SHA1

    2500f7f118b7d4c29521eab5030ef652d21c3630

    SHA256

    a9ecdd5568d8ab46101cec0af5a5e2d14a0d44859e442ff55e241383e293f557

    SHA512

    f9ffc61326c7acf79ca5c6e3405126ed2035cd422841392c8f4e485313095e13ef0220c275a756481dfb8542e75ad14e66311d6d039dc2aa51d799cd63de97c1

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/adc3/AppVersion

    Filesize

    26B

    MD5

    29db6a72c1e09eed862c761d605d3ce3

    SHA1

    403bdda585a8efb56a65fa628094a61a0cfcf244

    SHA256

    76a0b274004ab9a42916efbd70bb7d6cf04fb3db55e067f56349fa20a7119a22

    SHA512

    3e01fd3a2afb905fd4aabb016b70811d482c1e6cb8168d0b22a5589dfb77b9423b5249b0950158ab8e67c626f72b93a431df7c1ca5ec3c2433b38fdfa8f40356

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/back_.png

    Filesize

    1KB

    MD5

    527385c9a7dadd870919fb95ce4ff227

    SHA1

    a83ddb0ba89e4f83a07d6e0524d6ea900e800c2c

    SHA256

    3df2ccce7702c69051afd3fe66cf99e3f07e86d354956eba3888ddbaf545e717

    SHA512

    3b2f1781552f701331e91eb46fd38a982b2a9de8eb7259e912a710c63399fbe86fcdbe4c41fd8b8f34b99773a94cb02024e9ec64c38aeea68ef378de4f842355

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/back_dark.png

    Filesize

    1KB

    MD5

    74860bc33c04b72a4848a5d7b97bec5f

    SHA1

    336856eed4d49ebd0d429877822ac5781b4a18eb

    SHA256

    fb479f88bc809d106fc15c465079b19f6027a01ecbd0d79267147c0529adea69

    SHA512

    9b6993ba917c3a687b0df03deaf9e5e6ac41d3606ef148e259eb32de8c41203249063059a11bd598b860f2e3d795c73cd339c5325f80a2623745e7003f6586aa

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/browser_icon_dark.png

    Filesize

    1KB

    MD5

    c954c504c75c8ba2b112deb64869f78d

    SHA1

    5b594778f7a5bdac4e41de2d6c81225d5e329e0f

    SHA256

    37ee870f153d26b3956abcead4c45160b264fde6ca016bc2d330e9e36060ee46

    SHA512

    af1705681c3a2ef83427c853d310bc2dd6159f5db1c1b5a5740431a5a928b4c6541dcd5e3fcffd6c06697b87ca740a0ce2473e2cf141f21ee13730f325d4403b

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/close_button.png

    Filesize

    2KB

    MD5

    4d332a5c731fb506bb4644c91c38f5fc

    SHA1

    56fdadb5d38b29161910b3c89ce57b1aae67733a

    SHA256

    43e7ff284e786cced9a54218970d357ff06374836bc1791eb63d9bf26c6a3784

    SHA512

    c791b70329e32559d99f0259b38a832bc849768cab37973567a04fe8f66e9f5477136014ac17d16d1a0df0ca0f4fdad86d6a5f29581c85068b7979fb9e73b7c6

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/empty_star.png

    Filesize

    882B

    MD5

    136e73ffc6805e043bf61a12b3755b1a

    SHA1

    b7bd8ee6bd46f7bf3a2f21879e71ff4684e56361

    SHA256

    ecf9d2a4448842086066d82fecd6ec372497298bfef3c8e3fd17a97187a3e7bc

    SHA512

    62a12a8070955026e27e6c146d46bc44a345b0b4752e1c45487f06224e11c42490344b259ee6fe51fb6e9847cf4146abd7d4fbd0274d0f2c532868bc4be5d527

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/filled_star.png

    Filesize

    740B

    MD5

    4ef85932c17e863921c9bbdf1394fe92

    SHA1

    f3811986d3648be1ca89162a079aff4644fe26d7

    SHA256

    0d6e7d7a915944adfb498a45a6db96efc77d0112ba1f374461868e257315dfa3

    SHA512

    1ba7939efbd515f81333a155064e248de27b2c70cc71004136ab9d3c61ad34baab7f1d00529e1c78d4cdf11deddbad2376d27d5ab1af699a9d29c5b5da7f4db1

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/forward_.png

    Filesize

    1KB

    MD5

    795fe2fffc9505398b787eb2f15f440e

    SHA1

    c124812df2fbd8e4a65fb104aaab352ba300a57a

    SHA256

    976cb8c0c715b0b0e8b4769b51af1a08f06a4823d69b1f5284fec4531da21fb7

    SHA512

    c698c060692567afea47446d58d32e92b0bc922088c99e175f5125b264c20d425fe7dddc4b0d70fe9f53d41cfb87ef52965cd40934f21c9f5e2b9281dee72389

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/forward_dark.png

    Filesize

    1KB

    MD5

    ae1702688d33694b08e2f990527fd179

    SHA1

    fccea348af9e98608b152c1e35307d04a1cddeb1

    SHA256

    87916bc88b54b8602b2f43695d34b196b5cc8948ccb6576b24cced2feacb245f

    SHA512

    aa0aa7306867900ec765e0645e2666ae1a913fb1bc67ba205b3b80d1b37089bd8692c2b34fca233ed3bcfe89a42f095a375df787d5c29ced86bd040981110d2c

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/half_star.png

    Filesize

    881B

    MD5

    ba75be02cd7e410fa660a1783b0fff3c

    SHA1

    b5b60389112f5c6179878423c6c97eb5ab1680b4

    SHA256

    77a060cb9e3f9a5eb52654135d00106d36208f3d38878ca3b752ca1af85cf42d

    SHA512

    9985e466e1652eed843a9dd97832b8ee9bad05cd591a4b17548e876ac65c6cfa4da4f46e83dddf89f9fb1924d92dbf21ce13e66059d5cc7dbe0500cf0c0e7b0c

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/logo.png

    Filesize

    2KB

    MD5

    5f93b7b61e5bcf973fd93c049061023e

    SHA1

    7c154666967abc13d9d38c9b79eb6933db64566f

    SHA256

    4e537f889054c9f1dfb4b1a30c34ea180310dbc9b9bcc9123605f0f802a24557

    SHA512

    d96bb4c9daab3b2a72a3d82682a8f66ee85a0eb525a87afd13f46de949ee8a02d9a560da6584ecd658681c93a13df03d9a0f57382fdc40f56b2541a51e858a67

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/pinapp.apk

    Filesize

    93KB

    MD5

    ba57f9fe62bbcf10348091b7d08ce123

    SHA1

    0fba82354a775094f68fb49bd8530f97f6db97cf

    SHA256

    1df6c43a03bf45cb91c83eb81d123877eb4f663b0693daf4ba590df900a01160

    SHA512

    d030cb078a399eb104e5780426e14efeaeeaff93c4710186d1622b64a5ec547e20e318f72ac3c6adc3baa4680a955a3e43fa5964dd87a0684b21902672854e69

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/shared_prefs_sdk_ad_prefs

    Filesize

    153B

    MD5

    65026ee778e1372d9f4aed742772e893

    SHA1

    5a5f1c821d7639424f3c75a44468ab5f7dd4e8cc

    SHA256

    15070f52136d5a8332f8d70f790bd7bb04cd6a99b386d40e0abedc40c42caa3c

    SHA512

    589c4a12c6b6ec1a1cca957da758aaa900e68a23b4bc2f42524b0e8dd34f6c5378541d9293eae1ae8d478bf5b5229ce4218c058fc3b399eb5756afeb05c68616

  • /data/data/ru.sobgqfur.fjgfgkcxl/files/x_dark.png

    Filesize

    663B

    MD5

    2e42562e9d02dafe67ac6404f58289b7

    SHA1

    c37072894b2169be2643dd5e541ff8dfccecebe2

    SHA256

    2f70939006596d2496c26284508e70ef260968eae1385c220e91e74b58e0d13a

    SHA512

    a65a9fff0c6e17c322d0f0d6e0233fcca6d701a331a0fbc7da7eb21474c11875bd0e3edafc6c1df248ba85f22fc47b403d5668316405adcd8f6e4907a893d3bf

  • /storage/emulated/0/Android/data/ru.sobgqfur.fjgfgkcxl/cache/UnityAdsCache/UnityAdsTest.txt

    Filesize

    4B

    MD5

    098f6bcd4621d373cade4e832627b4f6

    SHA1

    a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

    SHA256

    9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

    SHA512

    ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

  • /storage/emulated/0/Android/data/ru.sobgqfur.fjgfgkcxl/cache/UnityAdsCache/UnityAdsWebApp.html

    Filesize

    2.2MB

    MD5

    8ae099facbbe7c96b1a7de24dd3f8bcb

    SHA1

    9bf04713a81ef1c94e7e5f298d990d6fc944b09f

    SHA256

    2cd36c5a9f434b0d32f02cd3955c572151b8fa9c7517a25069ee4719a6511410

    SHA512

    9d6e4eb82494e76d4741b7743ea561f198d244bfa575a02c21a05d5f3649d5e2508b21719409e7900a06fc8b9dc93a6e556c67aa4a217007af7927873ca69a60

  • /storage/emulated/0/Android/data/ru.sobgqfur.fjgfgkcxl/files/LuckyPatcher/AdsBlockList.txt

    Filesize

    1KB

    MD5

    634ab5e3e49b830079f88825c88d7f80

    SHA1

    cabe4068d07d52c60f5b9f840fd887051748a3aa

    SHA256

    2824000ad496be920c29d0a78589c72935288b40ce44b44c5fae672fbfe87fe4

    SHA512

    ffc893fcad8d81f6ca272cf03737ab466eafd135599e6f6f20285d7f4c3454bedde4de5929dbb1be5010192747f5f11d86166509f24bfbf778f949762e47ef72

  • /storage/emulated/0/Android/data/ru.sobgqfur.fjgfgkcxl/files/LuckyPatcher/AdsBlockList_user_edit.txt

    Filesize

    29B

    MD5

    302f7b6d9a4ffeccdda9ef94184c8326

    SHA1

    d4038ca0629f57b7e5c4056e74a395e5598aa16a

    SHA256

    5b36134b695f0a9a32f570b08cc3ef74e0687a0d2aa228853bc0346f77bffebe

    SHA512

    299fda4936acf6479e22f9166d545976d5d99ba6fe7a5b7298cb336cf730eb7790524e4569fe64bc03c598c7e4117f163ddffc2e2889439f709c4d80ff665039

  • /storage/emulated/0/Android/data/ru.sobgqfur.fjgfgkcxl/files/LuckyPatcher/Changes/changelog.txt

    Filesize

    44KB

    MD5

    f33be26debeddf0e9a7c09c9cff3de88

    SHA1

    9e6b341947c3b36d44ec278b725b6b00e39314f3

    SHA256

    7f9bc8f892bbed27779b48b93019257657fab55d3fe5798fc4a4f490a00aba03

    SHA512

    d04dba29dde7b66bfa2ec0025892b199f3283bb248b9849a6536e2871e30dff82850887e6f78fcb843499b97db43903c9301575881beb93f745e4336075fa3d8