Analysis
- max time kernel
149s - max time network
154s - platform
android-13_x64 - resource
android-33-x64-arm64-20260325-en - resource tags
- submitted
19/05/2026, 14:05
General
- Target Shadow_Fight_2_v2.43.0_Menu_v20_by_Aadil.apk
- Size 131.6MB
- Sample260519-rdy69agy2k
- SHA256 1c6df97066e5d44a1d4bf7cceeb0b245adf922cf500b324eecf08cdb55202a9e
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
- Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
- Loads dropped Dex/Jar 1 TTPs 13 IoCs
Runs executable file dropped to the device during analysis.
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 2 IoCs
- Reads information about phone network operator. 1 TTPs
- Checks the presence of a debugger
- Schedules tasks to execute at a specified time 1 TTPs 2 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.nekki.shadowfight1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
-
com.nekki.shadowfight:AppMetrica1⤵
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
app_resources_lib.jar
google_api_resources_lib.jar
app_resources_lib.jar.cur.prof
google_api_resources_lib.jar.cur.prof
app_resources_lib.vdex
google_api_resources_lib.vdex
com.google.android.datatransport.events
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
com.crashlytics.settings.json
event0000000000
event0000000001
event0000000002
event0000000003
event0000000004
keys
keys
keys
keys
keys
app.json
device.json
os.json
session.json
report
userlog
userlog.tmp
PersistedInstallation5024303062926442086tmp
PersistedInstallation8640742299330759825tmp
firebase_session_Y29tLm5la2tpLnNoYWRvd2ZpZ2h0_data.preferences_pb.tmp
firebase_session_Y29tLm5la2tpLnNoYWRvd2ZpZ2h0_settings.preferences_pb.tmp
firebase_session_Y29tLm5la2tpLnNoYWRvd2ZpZ2h0_settings.preferences_pb.tmp
firebase_session_Y29tLm5la2tpLnNoYWRvd2ZpZ2h0_settings.preferences_pb.tmp
firebase_session_Y29tLm5la2tpLnNoYWRvd2ZpZ2h0_settings.preferences_pb.tmp
firebase_session_Y29tLm5la2tpLnNoYWRvd2ZpZ2h0_settings.preferences_pb.tmp
profileInstalled
profileinstaller_profileWrittenFor_lastUpdateTime.dat
androidx.work.workdb
androidx.work.workdb-journal
androidx.work.workdb-shm
androidx.work.workdb-wal
androidx.work.workdb-wal
appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat
appmetrica_vital_629a824d-c717-4ba5-bc0f-3f3968554d01.dat
appmetrica_vital_main.dat
client.db
client.db
client.db
client.db
client.db
client.db
client.db
client.db-journal
client.db-journal
client.db-journal
client.db-journal
client.db-journal
client.db-journal
component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal
component_478cb909-6ad1-4e12-84cc-b3629a789f93.db
component_478cb909-6ad1-4e12-84cc-b3629a789f93.db-journal
component_478cb909-6ad1-4e12-84cc-b3629a789f93.db-journal
component_478cb909-6ad1-4e12-84cc-b3629a789f93.db-journal
component_478cb909-6ad1-4e12-84cc-b3629a789f93.db-journal
component_main.db-journal
service_main.db
service_main.db-journal
service_main.db-journal
uuid.dat
primary.prof
primary.prof
app_resources_lib.jar
google_api_resources_lib.jar