Analysis
- max time kernel
3s - max time network
33s - platform
android-13_x64 - resource
android-33-x64-arm64-20260325-en - resource tags
arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system - submitted
19/05/2026, 00:27
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Delta-2.720.1167.apk
Resource
android-33-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target Delta-2.720.1167.apk
- Size 180.7MB
- Sample260519-arr7esex4v
- SHA256 f9aa8aa7b0031c04032f5faa8298c1db63ef727e342c99c1e111d64603fcb9ef
- MD5 b4adae9932ea0e926187eaa2d74661e5
- SHA1 a60f9352b943d26eea6201bf5f6ffe50ac299e3d
- SHA512 bdebf6f38dce1a3c084d2efd2620ad2d852f0f2cd9cf8a74afc8ca4efa0aef84eeede9f618ba1f39365bb418c24355c6e686d0da88a8dc6685b0b89fa28a4084
- SSDEEP 3145728:Q2RBTDi1nP8lXLTlteuJKn7jvEnJdM/TD/cM8epr4gZWxWrOqV:Q2UuvLZqoJC7TLpr4f2V
- TLSH T18098D019E2824E23EE1A4B3956B396957335EC5E5B07DBAB300EB174BF733840F815A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.roblox.client - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.roblox.client - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.roblox.client - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.roblox.client - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.roblox.client
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.roblox.client/cache/348b31209f234f03208f50a2783af064.0.tmp
- Size 6KB
- SHA256 3cc9968a3e23a8ab54a4a80deb2610c127081cce30c45aaf64e1e938f88eea26
- MD5 6ed66d20a688fe2ebff89f28bbb80a83
- SHA1 87a201dbdd34fc9d820ef06d02b45f379309e356
- SHA512 1c403cd80a571eff693d5193b5a0abf767e2b1b9a894fccdd3dc3a6ff95fc185411f54cb6a31e8e8500a532639db9c8d8b2414c0fe154ab3af622faa12bfbebc
- SSDEEP 192:N3vNSOMskn5qGp3JhXy9KHt8+BsRTssg7lbmDAf:bSONk5qU3fy9KHm+Bsqsg7lbaAf
- TLSH T18AD16D630F3260C81E53AAE1E96F5444A86EA71DFBE2C4E7D9583504C9CC2BC32B25D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.roblox.client/cache/348b31209f234f03208f50a2783af064.1.tmp
- Size 17KB
- SHA256 32697ce9b1c0fe1db6137ce5ff53cc0df493eb340ba503b75b42edbe31866f95
- MD5 a978b0573ae79eb6394ab3267fb41e59
- SHA1 4e52d1920dc1c9da0667b70bb0dea62229aa44fa
- SHA512 3191384f847dff15b4c818243b7afb7ae528c1550efc731f9c7668efd48ea3dba5480b5fc0eb41a8246717dfb555b9b81c28d50dcd4a5a5ecc3d6a1bd8fa5631
- SSDEEP 384:f3/5hLXLWJm1m5zrviPBwshk4xoQIZtRagkx7txMYKP3n1Gq49ik:fPLt4pWK14KZnkx7tCYm31Ez
- TLSH T1A482D07E65F4FC97646326ACA6A00704F3F4BDD1592C7A93CC3D25203AB22E62174E53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.roblox.client/cache/journal.tmp
- Size 36B
- SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
- MD5 37e8e716e0e2f4a0b05cd9571d95b84d
- SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
- SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
- MD5 SHA1 SHA512
- Path /data/data/com.roblox.client/databases/google_app_measurement_local.db
- Size 16KB
- SHA256 f2ba3a71a078d7727a4cc38bc93a1734b9037666d191b494e6f7e81f8fdf5e60
- MD5 d6fa404baa513e2d24f0548ebe0a15bb
- SHA1 3b4e24b3fdea6b04dac6fc17a45e96df6206a810
- SHA512 8c4cc32174875ecc18b18267b0fab712e5cd27b0d05b4c2da565202ba3fafec0f75ff96cc6348945915bfe45961a3bfbf81a3192e5bca5a6ca36ace51a6e5274
- SSDEEP 6:l9bNFluls1OElO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOw:TL8En9zmzrfRmBEyPbBvOw
- TLSH T15572C2CD9F102606C6664733B8CAE3905DA4A22D837BDA476A940460AE42559A051F98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
- Size 512B
- SHA256 d990c884278f59686c18717fc42f90edbcf0d637bd02ea87f07bf05df875f64e
- MD5 16100cb4172e7e9d94df39c168f0b073
- SHA1 bc8f46ad643d45a241ab058c8f615a5fca7e06dc
- SHA512 b0a37bf5d7b9efefcb09488aba8a49cf05c788fc463d6adc74ed5879a2033a952ca8eb5c3f99c8c3e376da4a75d0702965656035315d5661ffaa19f3d554e4c5
- MD5 SHA1 SHA512
- Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
- Size 8KB
- SHA256 e18f704ffe5ea7208250cd613aea63c93782c9894ebc13262bcdc43ee322f731
- MD5 c7fa8c8147491c42f65202efbe03ef75
- SHA1 6597f6d240296040f188e007495b2e876e5fec62
- SHA512 c36503c90b6d43a401aee2e2a9d9d19e8ec86e071cc02466177ade2e9b12dfcedfdac8384402dbabeba0e1d3c4515cdc330c66d1be7f3fb22927909fbf38abc7
- SSDEEP 6:7+/l9g4On1LRg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKudPn:7+tsqLiuWd7RmBEyPbfdP
- TLSH T1200222D863800E12C82A56BBA0E483440D00A718C262CF170D51089C2CC74CCA4A4E18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
- Size 4KB
- SHA256 8d491afc605dfabfc6c94d43dcfbdfafc0a64780365262b8e5c8d3588093e09d
- MD5 8095e68ac5e7732829389a068482efc1
- SHA1 8db5dd99631db365c4e6ffc35b95ef5dced99c80
- SHA512 c3f1391e9044f4bf0119559b013ba80257aab032d4c3139d3cf55983e1531010a719a4944d608f303c4d013edde73db3d791e751e66f782c73932ad8bf235b17
- SSDEEP 6:7+/l+Pg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKj:7+tSqLJdKBRmBEyPb4
- TLSH T1E191809D77810D13C51D5BFB90D983945D50A719C373CB675551085C7C476CCE491D44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
- Size 8KB
- SHA256 be923e53bb4d5a8dd5ebadcaf687906b0985f982a648a945658b05cd7bcb354a
- MD5 640b5132474faecd98f1ead0a33b95a9
- SHA1 c140a67275ba2e1321c0b84bc3bb11ee1d72b41e
- SHA512 0e13a505a2000f7c710c8cba43a7f46a2743fedf81b264f6f70b23dc3aa84af61041462cabc57954048c623852d7a223c30d11059a9c511ec7137cb866760e8d
- SSDEEP 6:7+/l9o+Pg9bNFlqhO1oAlOERX4PBX4ogLugMBX4suuKoS0//A3:7+tnqLmq9RmBEyPbc0XA3
- TLSH T1B602C08873C10C03C01D6777D0F893400FC0E3148372CB1705A008683C434CCE8E4D60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
- Size 4KB
- SHA256 58e36be7e45bd3ace79b5dfb4741bff11a56893aeae5e48b14f80fce605dec7f
- MD5 43d9a45c3df541acc5081eca5176b3f3
- SHA1 1a48557cc3ad64f9fbf3c61a3e2def9c2f7bc025
- SHA512 d6a567a39b5126e4fc98d107059495b0d1602a6aa8ce066041bb4570606b0749db9c673495af5dcf5f3e01852212a0d0197eb0f199d71c29c2a0fc248315fc81
- SSDEEP 6:Lvg9bNFluls1OElO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuKK:rqL8En9zmzrfRmBEyPbV
- TLSH T1D3912B8D9F102603D2774737B4CF93515D2462198337DD672B940470AE03549A051F84
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.roblox.client/files/PersistedInstallation5611027586823650355tmp
- Size 90B
- SHA256 73fd1a5e85b9d36f9479176fba2548b161a56cb2ef81cedd7f1f9b1984a71c50
- MD5 036940b9695ade73f689d74a5f4d9a6a
- SHA1 b73c97791a631e2a4de11fb5f1594e9482ac5c71
- SHA512 2f375d14c0b1ca6bfb9eb838e6ed1e6dbf265b4984bf7dc8416fcb18ac3235b712ee734eefd1df62136839ff4b57cce2f32f79c84cb4f17c0e726d21ab59c6b7
- TLSH T1D8B012188A75C551C9C6B3862C4C91011D882841180ACB050E0CD44041812D5C11BFE8
- MD5 SHA1 SHA512 TLSH
FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp
- Path /data/data/com.roblox.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp
- Size 343B
- SHA256 53b346d349b438b5d81b325e9720f98c4106f5bfdb57abd224f71b3d6984bf66
- MD5 447eb88f7d6ffb902193e76d4131ea15
- SHA1 5373491b3c11ce0ec1ef076b3dc87cb3a7522110
- SHA512 918c3518085f0ac562ba9d3826a78f5d5fa0b1587aa22ea4494876e24e585c5a104a53e64080f0e4218ffe35194be72337e3b2555b9f4618abc04eeb2b37d746
- TLSH T1E2E02000D6E119B15D6F110D7FB801180F3FF3966171449935F40544F50D684D1C7F1B
- MD5 SHA1 SHA512 TLSH
FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp
- Path /data/data/com.roblox.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp
- Size 367B
- SHA256 59acc539e1af1c06fbfbfcf7cae60101b47bd7e80a83e0d9155fe6da397a3c80
- MD5 0cdba712c372856cb6373c09a3f43c43
- SHA1 36bffa08b1f180e72cab37a2406f2236d4af9368
- SHA512 56ce935d5ce9c708a76a43dcceb5b6990c40aa4906592ba76b4b8e1984e37af1634b1946dcdff61397b50a3c9f5e95924ff1e001ef1279b77f25d9b1437c3331
- TLSH T141E0D801D6E11AB1596E520D7FB806180F3FB39761B6449925B80584B90E684D5C6F1B
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.roblox.client/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
- MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
- SHA1 fee434f784e73cc7916322e949f727caf8363102
- SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
- TLSH T183810250534000E1D05446B354E113080F06D19496428B03550100428C415440C60E88
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.roblox.client/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 22acee1e23df0dd021252df8a5a0e401cdfd29fd5b35c6fcdfd9f72e68a3a016
- MD5 dbcbcd5363d30450273686561f9ca758
- SHA1 1f122bdb1b7dfd115de513e0408f62fc7b0c5ded
- SHA512 9c51f0e547ae3d9e078f086b44a4d11d230a1d3440dfa6f0623bf1b25be88e68dae0a13581487aec75e8241d69229bea0a1045fb8ca2278ea60a9dcf99e16e34
- MD5 SHA1 SHA512
- Path /data/data/com.roblox.client/no_backup/androidx.work.workdb-wal
- Size 116KB
- SHA256 aecff2890d23c97aa6eeacfebec9e45b6796d1f3af7397667d46a0638e4f6647
- MD5 1823aab49eaa5f17bd8679690da0808f
- SHA1 f14a2d1c7b648d5caa955b5341ad2697d4cc9e0b
- SHA512 31fdf60590aaca0f3d072a298273cc87da1af350f0f7afbaf7b0c61a956a08e83a0575283ec4facd20250683c3d34846af88e7c656223c45bf1581012b4fbcbe
- SSDEEP 192:bHuV9RW7AotidjnfWzzb83zSv+XD86u0ED:qRUtidjnfWzzb83zSmXD86u0ED
- TLSH T160C344CD0F882640C1BD6AB6E5D10FE17D3E412F8793D3D2A5920075AEE2961DE29CF9
- MD5 SHA1 SHA512 SSDEEP TLSH