Overview

overview

10

Static

static

6

050cdaa79d...28.apk

android-11-x64

10

Resubmissions

08/06/2026, 18:07

260608-wqbc6sc12y

08/06/2026, 18:06

260608-wprc1acz9z10

04/06/2026, 15:24

260604-std2pahw6t10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    04/06/2026, 15:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    050cdaa79d05ba3be02652cfec893d3c4d8cc4af9f3808682e6371fc7f1cf128.apk
  • Size 786KB
  • Sample260604-std2pahw6t
  • SHA256 050cdaa79d05ba3be02652cfec893d3c4d8cc4af9f3808682e6371fc7f1cf128
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryevasionbadboximpactinfostealerpersistencetrojan

Malware Config

Signatures

  • Family: BADBOX

    BADBOX is an Android botnet that targets Android TV devices.

    backdoortrojaninfostealerbadbox
  • Android BADBOX payload 1 IoCs
  • Checks if the Android device is rooted. 1 TTPs 10 IoCs
    defense_evasion
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.android.launchex
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4942
    • which su
      2⤵
      • Checks if the Android device is rooted.
      PID:5000

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .q.jar
        • Path /data/data/com.android.launchex/app_data/.q.jar
        • Size 25KB
        • SHA256 c1847bb7c751dca3b44080c5367eeb8a9128f052fc429a2c352195ee70849e08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        .q.jar
        • Path /data/user/0/com.android.launchex/app_data/.q.jar
        • Size 54KB
        • SHA256 2f5581ca42d4c2cff88e7d0b2d686340a78bae0d396820ad04401be31c3cfcef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download