Analysis
- max time kernel
144s - max time network
150s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
- submitted
05/05/2026, 12:13
General
- Target 22betLoader.apk
- Size 35.1MB
- Sample260505-pd7saaa19k
- SHA256 4098868a7428f9f4923d71af8f9ae66490ba5eff9e60c16245d8bb62c1780cfe
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
- Requests cell location 1 TTPs 2 IoCs
Uses Android APIs to to get current cell information.
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Reads information about phone network operator. 1 TTPs
- Checks the presence of a debugger
- Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
org.bet22.client1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
31d8ac0c2c2772a31d0c9d7c03bbc2ff7065b6a903b0110224946c9377d2b5e4.0.tmp
6bbbe7930959f52ce734a1b7329587d9a5d5401253ff0cddbb3a782b7b0ef47c.0.tmp
6f702a65a386d0a4b81e44dc47f23e5503a8f2aa929dbb9afaf5080d630771b7.0.tmp
724dce5a9fccfa8093ae8df98cb41b85eecb4f5ce4497276ef5c1c0d2801dfe4.0.tmp
9a689cee87eea551d75c4e3a1c6ec742f683539d963665c88ecc164883077eb1.0.tmp
b1618fb071221853fd441ce5178e7486da4a9143540a3ad3ebdc9c0e30a827a9.0.tmp
bf49c9cdb638a8e9ac11a6157ac31d062c92fb785ab0e95eb34ecb8626612a59.0.tmp
ccc7fd605573a3e03cb80574d1a21781092554d4d4576cdaf76187a414a30cfa.0.tmp
d959f5034c8aec7a876c5fa126b50e785022a82730225154151bebf8102fa8a7.0.tmp
dbd91bce316bc6786d361b13c217b8a543a3e55dcd7b1995cd9a2faf3c9abc86.0.tmp
journal
journal.tmp
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
onexdatabase.name
onexdatabase.name-journal
onexdatabase.name-shm
onexdatabase.name-wal
onexdatabase.name-wal
onexdatabase.name-wal
crashlytics-userlog-69F9DF1C020F00011299975CDA276D33.temp
crashlytics-userlog-69F9DF1C020F00011299975CDA276D33.temp.tmp
event0000000000
report
PersistedInstallation5512443313432265434tmp
PersistedInstallation8338643326951360491tmp
frc_1:366675113911:android:e06854c2cb72a6e5d39a32_fireperf_fetch.json