Analysis
- max time kernel
149s - max time network
195s - platform
android-13_x64 - resource
android-33-x64-arm64-20260325-en - resource tags
- submitted
18/05/2026, 00:03
General
- Target Soccer-Manager-2026-v3.5.5-9mod1.apk
- Size 860.5MB
- Sample260518-achpfady41
- SHA256 29c7effa3a29144579c75c0ec211e88f9b0e10ae91d9e013b544d9316f66031b
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
- Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Checks the presence of a debugger
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.invinciblesstudioltd.soccermanager20251⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
com.crashlytics.settings.json
internal-keys
report
userlog
userlog.tmp
FIREBASE_CLOUD_MESSAGING_LOCAL_STORAGE
PersistedInstallation1773349363740277206tmp
PersistedInstallation7451399951640275548tmp
FirebaseHeartBeatW0RFRkFVTFRd+MTo4MzMzNzM4MTg5NTphbmRyb2lkOjM1ZTc0ZjAxOWVjOGY3YmVkYjQyYTI.preferences_pb.tmp
FirebaseHeartBeatW0RFRkFVTFRd+MTo4MzMzNzM4MTg5NTphbmRyb2lkOjM1ZTc0ZjAxOWVjOGY3YmVkYjQyYTI.preferences_pb.tmp
sessionConfigsDataStore.data.tmp
sessionDataStore.data.tmp
profileInstalled
profileinstaller_profileWrittenFor_lastUpdateTime.dat
androidx.work.workdb
androidx.work.workdb-journal
androidx.work.workdb-shm
androidx.work.workdb-wal
androidx.work.workdb-wal
primary.prof