b568e937fc42440184bef65a1db322ba966061e675c500e42d32168cd3412bfd

Analysis

max time kernel
3s
max time network
41s
platform
android-13_x64
resource
android-33-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
submitted
17/04/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
com.mojang.minecraftpe-1.26.20.27-free.apk
Size 462.4MB
Sample260417-e77z2aaw5y
SHA256 b568e937fc42440184bef65a1db322ba966061e675c500e42d32168cd3412bfd
MD5 e21e873a6a9fae7ded9950df8dc8e3d2
SHA1 81b0dd8a48486ca57a832a6487a30b0452b8ce1a
SHA512 90f2be16c47e476cc089a44dd8ae40a1bb012b04f2ff45fc9597a7e498350daea34566ea1c1beefee7254504543eec5343c70bb790d9dec2cfc6b14f3b8cf027
SSDEEP 12582912:2LUI+hukU/vWsQG8K2aG+ewvwT/o8W6Txa1CwIR8:2LUIGukdsQ1JaAwvwT/o8W6lat
TLSH
T1AB392376CAB84818F62F907DCA0ED2D1D497CA048763D2BF79706BA771E9E901911FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery evasion

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.mojang.minecraftpe
/system/bin/su	com.mojang.minecraftpe
/data/local/xbin/su	com.mojang.minecraftpe
/data/local/bin/su	com.mojang.minecraftpe
/system/sd/xbin/su	com.mojang.minecraftpe
/system/bin/failsafe/su	com.mojang.minecraftpe
/system/app/Superuser.apk	com.mojang.minecraftpe
/system/xbin/su	com.mojang.minecraftpe
/data/local/su	com.mojang.minecraftpe

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.mojang.minecraftpe/[email protected]	4450	com.mojang.minecraftpe

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mojang.minecraftpe

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mojang.minecraftpe

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.mojang.minecraftpe

com.mojang.minecraftpe
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
PID:4450

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/data/com.mojang.minecraftpe/cache/appboy.imageloader.lru.cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events

Path /data/data/com.mojang.minecraftpe/databases/com.google.android.datatransport.events
Size 56KB
SHA256 266b6638a729e0802cb38ccb7d148bc8b78f0e9dd6daf712ccdf191327a54eec
MD5 9040adcdd654e6b595951565db576abb
SHA1 c8847f090f279237444aefa427883bcef4e4abb5
SHA512 def167e4feeacfc9bb2df36610f3c0cc2684b0ec456771b60c23bcffe1742626d5f73d06a5d873702de3dc630c62dc041686ff9537139e3aa0f44199ebfd3bf5
SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSM:RMEX0wIyNjaM
TLSH
T13443529D1E3C2221C57E283ED3E143A35B7C93DF572392623D908CF98DC206974354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.mojang.minecraftpe/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 de081c4e3f9d2142e041e471fb92f023b6b8aa2beaaa623de2ca15fd98d3554b
MD5 f7c5697884273b4af17200b95828b032
SHA1 806077c5aa20538baf84cef4a2e226bb4fbba0a9
SHA512 ceb4c7eb038c0bce3dd44e5bbece016dcb54eac80f2143a0cdf88071321eca3ecf06f9ec311ca8d3b4bdfabc8a648150a1804baf3bf8975ee1dccbc337e79640
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.mojang.minecraftpe/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 6cd4d74dbde74918b9bf1cc3dcbe49a8ef7ce266bbf93e31f5bfd2f73b3b9764
MD5 8365fee3485d3ba1045b16ea276da90b
SHA1 146bac95308c4ac5f74bbfa7b7f158c4140d65aa
SHA512 40731e3b7be7d1d811bfa96ff6cbcce1afcb9a79bbf20e9f044fed6ae56567ffc373a30cc04dbe7bb2c85e480a84f88c3d731787138252cdcc0b1ae56c74c357
SSDEEP 6:7+/l9VcSn1Qfg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKp:7+tQqLiuWd7RmBEyPb6
TLSH
T1DA02C09C73C00823C81E567794ED83800D00E71D8272CB67455009DC3C034CCE4F0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.mojang.minecraftpe/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 cc896c78d28ac451bf5367773879e1f08f99532473be49b9e539ff3aec9a3387
MD5 257655a177d32fe72a10546acf908ce1
SHA1 e41824b40d3834118942930de1b46ce6d0ddb07e
SHA512 0a4da3ecf6524263de13b20c581ff61a610b782696b9a25ec2f4fabdeaa0f31e71cbc02d9d1c84304716efeb2aae654626bdff12992998f463a40b130ba738dc
SSDEEP 6:7+/l904Pg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKj0/k:7+tywqLJdKBRmBEyPbSUk
TLSH
T15C02228967400C03C01E977790D88F401E20A716832BEB4709500C953C036CCE890D14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation1767278211379729637tmp

Path /data/data/com.mojang.minecraftpe/files/PersistedInstallation1767278211379729637tmp
Size 569B
SHA256 55175111ee756ea765953df7eed5de6e5ded47116377278bd5a4a2cd3ec14390
MD5 bf79c0e618fc1f0ab8f6b4e7f4ccd5fb
SHA1 a5ab847a41f13a45be82f3a21c489548a6112e19
SHA512 d8254b8de5add132582a16bb5d1a27df247f42ad9b51ba4f5b9fb5e97d467eea8f406677680c3a102416a8a29fe95b9b87a71d7d16cc20e427e4e5fc131f6964
TLSH
T1EBF0414F5AD6520CEEACD12A184CF8098D180076C99B00626EE84972AD6FFA6E4077C0
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation3764178840902660805tmp

Path /data/data/com.mojang.minecraftpe/files/PersistedInstallation3764178840902660805tmp
Size 90B
SHA256 3fe0f520948a15e5d04af3a8c9159ba7cac5cbd09120dd176452e19dac58e41c
MD5 7eb21f0852fdbed1a90b37618623280e
SHA1 8960755fff955bce81ba77890617015ebfc66adf
SHA512 b99355c63f335946f1e01adef96ad7e1727edfbefb98906135cfad90e275bdd3b6c030410e7eab3fc19ec1c3fa03a6a405f461c7b87d2dad91caf29c05410b81
TLSH
T1B3B012024B3081898B9AA2176D4DD1455E8014450C5ACB240E9C924202853E09103B98
MD5 SHA1 SHA512 TLSH

Submit Download

external_servers.txt

Path /data/data/com.mojang.minecraftpe/games/com.mojang/minecraftpe/external_servers.txt
Size 108B
SHA256 ead08f5c8ef06d0aa4bdd4f92cbd5bb7ce29ba4148e9529cd3cbc662de99a4a3
MD5 987a6006a9dd5a20a981dec737ebd280
SHA1 9e99f2551ea2fd07162a5130958b3ae3aa2e217c
SHA512 2305abe9fce7a8184970333f7700a22b2cf5f1ee4280665e480adc422b76c3ad9ca963d7f3df371886a03e38b03792fac2c944becbe18d2a49f9b1c01a66516b
TLSH
T1C9B01254C30BD543207430230F346D1045C81042765320F0DC05070BF2C91133D1F1FC
MD5 SHA1 SHA512 TLSH

Submit Download

options.txt

Path /data/data/com.mojang.minecraftpe/games/com.mojang/minecraftpe/options.txt
Size 33B
SHA256 ec42b226683c839a1184466b7030c4701dcfb7c1b65a30275ff821a360666fef
MD5 d88b078befa6d4fc381a3f538fe87fa8
SHA1 9f83487e363d595ca1d67ab5cc0ac2876bacfef6
SHA512 796090593cd1b7152d52fe27a793ea93aa1b1eb6782c4ad57589ba28b45f5348e59c73a594050f40ee6f8c83bdbe119f14a2d26364e9c0abad2d44ac7f0fc96d
MD5 SHA1 SHA512

Submit Download

[email protected]

Path /data/data/com.mojang.minecraftpe/oat/x86_64/[email protected]
Size 404B
SHA256 1f0417c68fcab1d670f6c3de6215496636d0a9549e4478c29224301b6edbdc59
MD5 9c9726afb002f8d7511ff3f7f49de840
SHA1 6b4d7865c55ab7e7effb42fd305fc69c10bd4882
SHA512 650073ae457888ff330bb6601b1a775ef417bf76caf4045e51f901a71464d26b7170df0cc51bf2806d065570f894dcaa94179bb0c37a1d809e141608173a4408
TLSH
T150E086B5F71D8A53D65C113C205EF083DA54D34ADA169622980519CD36D137115E1915
MD5 SHA1 SHA512 TLSH

Submit Download

com.mojang.minecraftpe_preferences.xml

Path /data/data/com.mojang.minecraftpe/shared_prefs/com.mojang.minecraftpe_preferences.xml
Size 140B
SHA256 49c43244b092c4999ef0f5c591d57f31951ea89819a970d570ff45b105658d3f
MD5 3a7da09dfd7c17761239bb40fdf8d466
SHA1 9c1f6665c438a85f8ac819c0400e3f1ad7b561f5
SHA512 f1e757c89c4b3c86f7f0cc3b8b8d486593aae2c3d2eab79cc139a77f9087825c2fa5bc82fc6349c4e5f9e3d473792879e85fa124c1336d4ad0531d16edc1cac5
TLSH
T1FFC02BC080EC8F13A5D104A70C21840C0237368B1D3826F0BDCBA8114F5D3000030270
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path /data/user/0/com.mojang.minecraftpe/[email protected]
Size 8KB
SHA256 460af80321f8410e688a8a3975b94c629e78b50f7d170894e41e3005b6b296af
MD5 016617e60bff401854c47ec9d4d56b37
SHA1 b6da861209b4fdeb2dba8c57511eb65b558c9131
SHA512 30439f5bb51806fd31d4c2debfdc3032b01b252f08b463939dfc51d508b956344e6924b0546f2ec289477e8bedc2b2cd7d34dc80213da0f09b6946b72fa84bde
SSDEEP 192:CI7ObQCjbgMTEdVgd06v5pKDBquUnqhOz:CuKbpYP4TvLKDBnUvz
TLSH
T109028583FB16DDB3C5ACDB7F646E135123B143411303535E8928C8996EC369A9B8EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads