Analysis

  • max time kernel
    3s
  • max time network
    33s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
  • submitted
    19/05/2026, 00:27

General

  • Target
    Delta-2.720.1167.apk
  • Size 180.7MB
  • Sample260519-arr7esex4v
  • SHA256 f9aa8aa7b0031c04032f5faa8298c1db63ef727e342c99c1e111d64603fcb9ef
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.roblox.client
    1⤵
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Checks CPU information
    • Checks memory information
    PID:4557

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        348b31209f234f03208f50a2783af064.0.tmp

        • Path /data/data/com.roblox.client/cache/348b31209f234f03208f50a2783af064.0.tmp
        • Size 6KB
        • SHA256 3cc9968a3e23a8ab54a4a80deb2610c127081cce30c45aaf64e1e938f88eea26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        348b31209f234f03208f50a2783af064.1.tmp

        • Path /data/data/com.roblox.client/cache/348b31209f234f03208f50a2783af064.1.tmp
        • Size 17KB
        • SHA256 32697ce9b1c0fe1db6137ce5ff53cc0df493eb340ba503b75b42edbe31866f95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        journal.tmp

        • Path /data/data/com.roblox.client/cache/journal.tmp
        • Size 36B
        • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
        • MD5 SHA1 SHA512

        google_app_measurement_local.db

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 f2ba3a71a078d7727a4cc38bc93a1734b9037666d191b494e6f7e81f8fdf5e60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 d990c884278f59686c18717fc42f90edbcf0d637bd02ea87f07bf05df875f64e
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 e18f704ffe5ea7208250cd613aea63c93782c9894ebc13262bcdc43ee322f731
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 8d491afc605dfabfc6c94d43dcfbdfafc0a64780365262b8e5c8d3588093e09d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 be923e53bb4d5a8dd5ebadcaf687906b0985f982a648a945658b05cd7bcb354a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 58e36be7e45bd3ace79b5dfb4741bff11a56893aeae5e48b14f80fce605dec7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation5611027586823650355tmp

        • Path /data/data/com.roblox.client/files/PersistedInstallation5611027586823650355tmp
        • Size 90B
        • SHA256 73fd1a5e85b9d36f9479176fba2548b161a56cb2ef81cedd7f1f9b1984a71c50
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp

        • Path /data/data/com.roblox.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp
        • Size 343B
        • SHA256 53b346d349b438b5d81b325e9720f98c4106f5bfdb57abd224f71b3d6984bf66
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp

        • Path /data/data/com.roblox.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp
        • Size 367B
        • SHA256 59acc539e1af1c06fbfbfcf7cae60101b47bd7e80a83e0d9155fe6da397a3c80
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/com.roblox.client/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.roblox.client/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 22acee1e23df0dd021252df8a5a0e401cdfd29fd5b35c6fcdfd9f72e68a3a016
        • MD5 SHA1 SHA512

        androidx.work.workdb-wal

        • Path /data/data/com.roblox.client/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 aecff2890d23c97aa6eeacfebec9e45b6796d1f3af7397667d46a0638e4f6647
        • MD5 SHA1 SHA512 SSDEEP TLSH