Analysis
- max time kernel
7s - max time network
172s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
- submitted
05/07/2026, 00:16
General
- Target minecraft-1.26.32.2-armeabi-v7a-compressed.apk
- Size 668.8MB
- Sample260705-akyevsa13j
- SHA256 f26fad7e5f9e3b92532b8f2300c2590edb9395d6fa8ca0f60b70ce1edbb280c1
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 9 IoCs
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
Processes
-
com.mojang.minecraftpe1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
-
/system/bin/getprop log.tag.APPBOY2⤵
-
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
journal.tmp
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-shm
com.google.android.datatransport.events-wal
PersistedInstallation2621822762816681250tmp
PersistedInstallation7168076293969153889tmp
hs.hex
Anonymous-DexFile@0xebad7000-0xebad92d4