b568e937fc42440184bef65a1db322ba966061e675c500e42d32168cd3412bfd

Analysis

max time kernel
5s
max time network
157s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
17/04/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
com.mojang.minecraftpe-1.26.20.27-free.apk
Size 462.4MB
Sample260417-e77z2aaw5y
SHA256 b568e937fc42440184bef65a1db322ba966061e675c500e42d32168cd3412bfd
MD5 e21e873a6a9fae7ded9950df8dc8e3d2
SHA1 81b0dd8a48486ca57a832a6487a30b0452b8ce1a
SHA512 90f2be16c47e476cc089a44dd8ae40a1bb012b04f2ff45fc9597a7e498350daea34566ea1c1beefee7254504543eec5343c70bb790d9dec2cfc6b14f3b8cf027
SSDEEP 12582912:2LUI+hukU/vWsQG8K2aG+ewvwT/o8W6Txa1CwIR8:2LUIGukdsQ1JaAwvwT/o8W6lat
TLSH
T1AB392376CAB84818F62F907DCA0ED2D1D497CA048763D2BF79706BA771E9E901911FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery evasion

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/sd/xbin/su	com.mojang.minecraftpe
/system/bin/failsafe/su	com.mojang.minecraftpe
/system/app/Superuser.apk	com.mojang.minecraftpe
/data/local/su	com.mojang.minecraftpe
/data/local/xbin/su	com.mojang.minecraftpe
/sbin/su	com.mojang.minecraftpe
/system/bin/su	com.mojang.minecraftpe
/system/xbin/su	com.mojang.minecraftpe
/data/local/bin/su	com.mojang.minecraftpe

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.mojang.minecraftpe/[email protected]	4801	com.mojang.minecraftpe

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mojang.minecraftpe

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mojang.minecraftpe

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.mojang.minecraftpe

com.mojang.minecraftpe
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
PID:4801
- /system/bin/getprop log.tag.APPBOY
  2⤵
  PID:4966

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/data/com.mojang.minecraftpe/cache/appboy.imageloader.lru.cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events

Path /data/data/com.mojang.minecraftpe/databases/com.google.android.datatransport.events
Size 56KB
SHA256 1f3fa07e5e0ad1d88535e10794459ca339dd0785fd2e1cada6e3b7906794136d
MD5 349c3bdb9ce1d6779649ab784c0a4fda
SHA1 f247db12645a9b6821d57603b685e1df6f07e7b8
SHA512 f7f784a913f32ee82ba00f5941cc7ac19a3aba8f4b8026ad807d40143f5e486c47fb8b0c020e580e71440e0a96aa0b0a4b12ca12b2b3a5ac99b5a2c9928b3c83
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSo:rAMEX0wIyNjao
TLSH
T1DA43639D1A3C2221C57E283ED3E143635B7C93DF572392623E908CF98DC346974355A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.mojang.minecraftpe/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 d57dc44c01a1276f9dd1a46f30f620a5302505d9e337fac7e7c2d9ef4b985b7c
MD5 63b0141621104385cfaf5ac55187065a
SHA1 47bc581be007a39585fc9d6be9278bc520fcdf0a
SHA512 10b447ef64e27a5a2d8261854ccdef20830993031f5ed06b6bcef0273bf6ef8fca1ae3b2e472dabeed106ce023f0256c533767e051f25f8457561164a0dd3819
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.mojang.minecraftpe/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 8c8151778f7f787af44cd321686713013874e2afe2aff4135ff30fa5093eb96d
MD5 771d5b0d8a0bc7cfa2cc2e07f275be1d
SHA1 0cb1c83668214f9a29dc8286940fd467a05fc72f
SHA512 e24c89a3e1af81090b507bd65ba283863061a45aa50f07d310187796217c2e2b62fac6014c941b0dba8109f63c47cee315a23631c26f4831594fd85bcde8596b
SSDEEP 6:7+/l9lel4n1Mg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK+e:7+t+lxqLiuWdYRmBEyPbPe
TLSH
T1E30222C8638008A2C9292E7790D683400D10AB2892A2CB2717D008942C07ACCA4A0D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.mojang.minecraftpe/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 9c77dd7f9c0a3444001db7e2b4b7b45ee1f291f285cc9b5b368dcb3aec4904d5
MD5 bccc7f996fe3a3d1ebe4e8c3d070e9f4
SHA1 9d3c0ede18930fb0f32181a2a4471950faac61d2
SHA512 aaa9229fb7676f1acdd3d2d8927336cd3813cc583f9bbb98ebb85e027cac21126a4794794d742fbe76a6642c0973a0cc657c63f473b01bb7719d5641f8e42f9b
SSDEEP 6:7+/l9AuPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKq7/A:7+tJqLJdeWRmBEyPbbzA
TLSH
T10D02228863400903E42A27B7B8E883801E10EF3C9AE3CB0716921868BC0A6CCF890D80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation5933890257891660634tmp

Path /data/data/com.mojang.minecraftpe/files/PersistedInstallation5933890257891660634tmp
Size 90B
SHA256 216049be1b4ffdaef59dce731be93be503ede8442c334c5c75b7892dbc4fada8
MD5 f81f0de2e3600e31b8042025d2657052
SHA1 f923ff0c238822736cac9d1a0809a55c1329a40b
SHA512 4a5e70abfd18c74ddc9524438cd1353a308d139a99bf782cb91478d9273cc9dd32d678ea7a8853d153439549f55f9e0bfd264fe2ab68fba79aefd1b3904757ea
TLSH
T13BB0128456704642858EB2033C8CA2801E402841982E8B044F19909880C11D18243A95
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation8928446071403827064tmp

Path /data/data/com.mojang.minecraftpe/files/PersistedInstallation8928446071403827064tmp
Size 566B
SHA256 770382dff43e7096a387f9da5f882a7b678a4143ddc387dfd37d6b9a7082fc33
MD5 47fb7971fd7fbeee718b4919174c0ee8
SHA1 fa1ff319c2b8c6ae046637f468d0a504d31618ca
SHA512 136674c4227c7c00e36786ee62c692ec67eab847de38a4676395456b272de801888689f112bb9f2796ac4456a27284a90055ff2f089511c09860a5d5b5eeeaf8
TLSH
T19EF04146A721034CE7DF6003398C3C10492E2CA6861600A7EF3A00F1CEF2E5BA302990
MD5 SHA1 SHA512 TLSH

Submit Download

external_servers.txt

Path /data/data/com.mojang.minecraftpe/games/com.mojang/minecraftpe/external_servers.txt
Size 108B
SHA256 ead08f5c8ef06d0aa4bdd4f92cbd5bb7ce29ba4148e9529cd3cbc662de99a4a3
MD5 987a6006a9dd5a20a981dec737ebd280
SHA1 9e99f2551ea2fd07162a5130958b3ae3aa2e217c
SHA512 2305abe9fce7a8184970333f7700a22b2cf5f1ee4280665e480adc422b76c3ad9ca963d7f3df371886a03e38b03792fac2c944becbe18d2a49f9b1c01a66516b
TLSH
T1C9B01254C30BD543207430230F346D1045C81042765320F0DC05070BF2C91133D1F1FC
MD5 SHA1 SHA512 TLSH

Submit Download

options.txt

Path /data/data/com.mojang.minecraftpe/games/com.mojang/minecraftpe/options.txt
Size 33B
SHA256 ec42b226683c839a1184466b7030c4701dcfb7c1b65a30275ff821a360666fef
MD5 d88b078befa6d4fc381a3f538fe87fa8
SHA1 9f83487e363d595ca1d67ab5cc0ac2876bacfef6
SHA512 796090593cd1b7152d52fe27a793ea93aa1b1eb6782c4ad57589ba28b45f5348e59c73a594050f40ee6f8c83bdbe119f14a2d26364e9c0abad2d44ac7f0fc96d
MD5 SHA1 SHA512

Submit Download

[email protected]

Path /data/data/com.mojang.minecraftpe/oat/x86_64/[email protected]
Size 878B
SHA256 2400c11f5c7ae55cf0fc13ae111a1b3262b29c1588c9a1819b05af9c5718ab89
MD5 fc8ca3bd7f54f230ae9f6c84058212d1
SHA1 7c95e9ce007c7f1dd5814f2965f3ca714736125d
SHA512 6766e33b338a5e9c4d07bb637590fc3b3b28ec51d61b3cbbcc54b68f0b013026c5f09ef95f987ee87f2571aa95e01aebad99385ecbb213fe0f7675e132364dcd
TLSH
T14F11C0D5D69E50C287396420337C600753A9FE63880151D16B925DD22E3BDF3BA45DBF
MD5 SHA1 SHA512 TLSH

Submit Download

com.mojang.minecraftpe_preferences.xml

Path /data/data/com.mojang.minecraftpe/shared_prefs/com.mojang.minecraftpe_preferences.xml
Size 140B
SHA256 63db72ebfa745b47996cb08b532a6c01f48d2f827dd591a0a11056c8f9299662
MD5 ab5928e27ba8c3fe200cf23ae18f2ce4
SHA1 23975b2cc5df5c87ae0a98b67dd2917cc826f430
SHA512 f24464b9244c5de4ecdebe698b12a3a3dc5ac22de7bf227acac9624d143363060eac23e7f1eab69771a0ffeb2830151130032c332d6b0a5b15ce1fdeef0097e6
TLSH
T1C5C02BC080ECAD0354C0062A0874449826353793326810F8FCCF901A4EC81000230075
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path /data/user/0/com.mojang.minecraftpe/[email protected]
Size 8KB
SHA256 460af80321f8410e688a8a3975b94c629e78b50f7d170894e41e3005b6b296af
MD5 016617e60bff401854c47ec9d4d56b37
SHA1 b6da861209b4fdeb2dba8c57511eb65b558c9131
SHA512 30439f5bb51806fd31d4c2debfdc3032b01b252f08b463939dfc51d508b956344e6924b0546f2ec289477e8bedc2b2cd7d34dc80213da0f09b6946b72fa84bde
SSDEEP 192:CI7ObQCjbgMTEdVgd06v5pKDBquUnqhOz:CuKbpYP4TvLKDBnUvz
TLSH
T109028583FB16DDB3C5ACDB7F646E135123B143411303535E8928C8996EC369A9B8EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads