Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    02/05/2026, 12:28

General

  • Target
    Sportzfy%20v1%20aurponmodz.apk
  • Size 11.1MB
  • Sample260502-pntcmsbs6k
  • SHA256 138982bfef95932b916e2641230f797f29e55985a8f1e199cc865b70e8cc3894
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Checks Android system properties for emulator presence. 1 TTPs 6 IoCs
  • Checks Qemu related system properties. 1 TTPs 5 IoCs

    Checks for Android system properties related to Qemu for Emulator detection.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Checks the presence of a debugger
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.blaze.sportzfy
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4752
    • getprop
      2⤵
      • Checks Android system properties for emulator presence.
      • Checks Qemu related system properties.
      PID:4870

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.blaze.sportzfy/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 1ff0ccb39888d6361626582b11685c06dfc015ef79bc4355dbf75df13fd4eb83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.blaze.sportzfy/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 59116d836f8c44f4bcae0c66ddf57a192cb06ea8b11602c00867ca7ba672e27d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.blaze.sportzfy/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 79fe18c65a0ad4a5249afbb8f06bd39811eaded058d9468705be75477b52aba9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.blaze.sportzfy/databases/com.google.android.datatransport.events-journal
        • Size 20KB
        • SHA256 15a12888c08014a61a53e988586e22b69e53c39b7fb0c525ccc3985c98c2b852
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.blaze.sportzfy/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 d2da9b76857418b9d81fbaf1cd0fbdfcd9d59c6275e736f75b161c168aae6a3d
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.blaze.sportzfy/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 663a9965e9b8e8d5bf92338eff7e448b40c4e85ccb8a3b1780bf6334371bc412
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.blaze.sportzfy/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 eb83bb9f8e0ccff685c0017617aa6f4712d298b45313c558cbf2a5e9b58e808a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.blaze.sportzfy/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 f5bbfd09bf0e4a5f0cad6cddcf033152dc56816560d13be76b04e4e3d3c263ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.blaze.sportzfy/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 8020bbe806bffd043b244a0e1ac55da2eb2ce16f430bd7fff9d601e669a2a526
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.blaze.sportzfy/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 0e08946f2a78907f885290496a72e50341e3a14e491d4474b60e84522f64cd91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.blaze.sportzfy/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 70f534169b496dc10c3cf4f22f5ae6ad22d5e610daa412570af8f0070d315c94
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.blaze.sportzfy/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 b02888063a96d7bd44aa9564bc6ddb2f239c796b248add593e668bdab6aebee5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.blaze.sportzfy/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 37217e6fd769bea015af0fad8dd9128c6f458fe9418f363be964e93f94f9221d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.blaze.sportzfy/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 d002806fff88edc461d961d69d71d72339802cb98a229ab57b9548e45fea68ec
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.blaze.sportzfy/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 9a5feb90836ca982f899e086db44085800ee62b150a95192b7768aa833451ade
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.blaze.sportzfy/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 d464b6cde9e7cf9b5ee2ae3f714eae42f10d40e8459ab5f3672b3dae0413b588
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.blaze.sportzfy/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 ab23966569882fcf38f1a74c0eb84fd102d4b7e74841eaed2aa27490f95814de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.blaze.sportzfy/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 4efcd2a6c79595b210cb0dbd1918a865a2ff800e0ec49dadedfb665460bbc507
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.blaze.sportzfy/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 139555de7f823dd6406ebec13856832cddc606e282f32888dd6bcefc63c88ee7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.crashlytics.settings.json

        • Path /data/data/com.blaze.sportzfy/files/.crashlytics.v3/com.blaze.sportzfy/com.crashlytics.settings.json
        • Size 767B
        • SHA256 609d3a6147407f20a103fb51af1545ec2dd3d7bdf390463e5b37b71a08b484c8
        • MD5 SHA1 SHA512 TLSH

        internal-keys

        • Path /data/data/com.blaze.sportzfy/files/.crashlytics.v3/com.blaze.sportzfy/open-sessions/69F5EE10011C00011290472D1BDD242B/internal-keys
        • Size 107B
        • SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
        • MD5 SHA1 SHA512 TLSH

        report

        • Path /data/data/com.blaze.sportzfy/files/.crashlytics.v3/com.blaze.sportzfy/open-sessions/69F5EE10011C00011290472D1BDD242B/report
        • Size 792B
        • SHA256 152285a3b9c4e332f9f7596690b0773d489e7c480c8a2b163a1e213c963abb6d
        • MD5 SHA1 SHA512 TLSH

        userlog

        • Path /data/data/com.blaze.sportzfy/files/.crashlytics.v3/com.blaze.sportzfy/open-sessions/69F5EE10011C00011290472D1BDD242B/userlog
        • Size 261B
        • SHA256 c0571e29271a9d4cf7f824e22405c5a901eea05a319bdc4e4b2d6a3d45982165
        • MD5 SHA1 SHA512 TLSH

        userlog.tmp

        • Path /data/data/com.blaze.sportzfy/files/.crashlytics.v3/com.blaze.sportzfy/open-sessions/69F5EE10011C00011290472D1BDD242B/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        PersistedInstallation8471872071980479406tmp

        • Path /data/data/com.blaze.sportzfy/files/PersistedInstallation8471872071980479406tmp
        • Size 570B
        • SHA256 8e1633e3b5848ae573fef413ec3de15956c83bfa754ffca9df763fd922239a1a
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8873358541072664782tmp

        • Path /data/data/com.blaze.sportzfy/files/PersistedInstallation8873358541072664782tmp
        • Size 90B
        • SHA256 3fb671cbcd0ff9c9c477353180a5d07ffb7add5720b9d75de8107039944cd340
        • MD5 SHA1 SHA512 TLSH

        firebase_session_Y29tLmJsYXplLnNwb3J0emZ5_data.preferences_pb.tmp

        • Path /data/data/com.blaze.sportzfy/files/datastore/firebase_session_Y29tLmJsYXplLnNwb3J0emZ5_data.preferences_pb.tmp
        • Size 50B
        • SHA256 e26f6dc3a9e52493d7f51e48f268e462261d27b6dbdd19de3d38d2ac1f9eece1
        • MD5 SHA1 SHA512 TLSH

        firebase_session_Y29tLmJsYXplLnNwb3J0emZ5_settings.preferences_pb.tmp

        • Path /data/data/com.blaze.sportzfy/files/datastore/firebase_session_Y29tLmJsYXplLnNwb3J0emZ5_settings.preferences_pb.tmp
        • Size 33B
        • SHA256 a4aaa2a4e0cb12123b405a9d33bdd7edf8cbb41ea92e75deb1ba21bf1db5b2a6
        • MD5 SHA1 SHA512

        firebase_session_Y29tLmJsYXplLnNwb3J0emZ5_settings.preferences_pb.tmp

        • Path /data/data/com.blaze.sportzfy/files/datastore/firebase_session_Y29tLmJsYXplLnNwb3J0emZ5_settings.preferences_pb.tmp
        • Size 75B
        • SHA256 1e58e88b20702d0a80025c1fbacc9ad5fe2565311e2230d581d669fbd7e8b0ef
        • MD5 SHA1 SHA512 TLSH

        firebase_session_Y29tLmJsYXplLnNwb3J0emZ5_settings.preferences_pb.tmp

        • Path /data/data/com.blaze.sportzfy/files/datastore/firebase_session_Y29tLmJsYXplLnNwb3J0emZ5_settings.preferences_pb.tmp
        • Size 121B
        • SHA256 232f9626cbee2e063e25f61a08f46575d019b62f02a6753c1325957a95e1c513
        • MD5 SHA1 SHA512 TLSH

        firebase_session_Y29tLmJsYXplLnNwb3J0emZ5_settings.preferences_pb.tmp

        • Path /data/data/com.blaze.sportzfy/files/datastore/firebase_session_Y29tLmJsYXplLnNwb3J0emZ5_settings.preferences_pb.tmp
        • Size 163B
        • SHA256 7495b9faf55ff02d0a2906ca3e3f4b356abd96e421815f9d07f893682da6eaf2
        • MD5 SHA1 SHA512 TLSH

        firebase_session_Y29tLmJsYXplLnNwb3J0emZ5_settings.preferences_pb.tmp

        • Path /data/data/com.blaze.sportzfy/files/datastore/firebase_session_Y29tLmJsYXplLnNwb3J0emZ5_settings.preferences_pb.tmp
        • Size 212B
        • SHA256 4cf53156a4c72e9235845649f294b3901880fb07fced9a05437e9729a2fa17dd
        • MD5 SHA1 SHA512 TLSH

        frc_1:494171799041:android:b4c203c0900245c22d8a00_firebase_defaults.json

        • Path /data/data/com.blaze.sportzfy/files/frc_1:494171799041:android:b4c203c0900245c22d8a00_firebase_defaults.json
        • Size 278B
        • SHA256 d485b16aef981df47bc37d74565da81075def63599f3f68b44fc49832868787d
        • MD5 SHA1 SHA512 TLSH

        frc_1:494171799041:android:b4c203c0900245c22d8a00_firebase_fetch.json

        • Path /data/data/com.blaze.sportzfy/files/frc_1:494171799041:android:b4c203c0900245c22d8a00_firebase_fetch.json
        • Size 294B
        • SHA256 c1529f328e2fa9e6235c8898f3b333f73ee115e8f90fc5d24f3500b8513c83c8
        • MD5 SHA1 SHA512 TLSH

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.blaze.sportzfy/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 18d4d965db0448ee73b6372ab7c6ff928206402890c26d3573da2b0e1df4546d
        • MD5 SHA1 SHA512

        primary.prof

        • Path /data/misc/profiles/cur/0/com.blaze.sportzfy/primary.prof
        • Size 2KB
        • SHA256 14f972305297a6dc8f20f57b5108bcb27afee8f1c9ac607b589d5b3bf5e7a19a
        • MD5 SHA1 SHA512 TLSH