rokarolla | 890ecea4ebe4fea692ad36adf02abeb37c181cb7bdb6122cd52d9aaafe7d6cf3

Resubmissions

04/08/2026, 05:42

260804-gehwjsw1at

06/07/2026, 12:37

260706-ptxx1sfs6t10

06/07/2026, 12:34

260706-pr4msaa16q10

18/06/2026, 18:36

260618-w8wrtscx4w7

Analysis

user interaction
yes
max time kernel
11s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
06/07/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update.apk
Size 13.0MB
Sample260706-pr4msaa16q
SHA256 890ecea4ebe4fea692ad36adf02abeb37c181cb7bdb6122cd52d9aaafe7d6cf3
MD5 1e2812e17d950099c496b7c756b5abbc
SHA1 1e64ec113364e37d7a95976dd611779058580994
SHA512 549158e5e209144c47c678987775e2526b4e27643fe25e0b1b246603edc8fa814be641d773bb0a9b665351afa81a40468bf0aebb2a8092cf1325025460b1c096
SSDEEP 196608:6sGvZeY8juQgY9/XzKk47nKoBSRuJMC4WPsUl111QlCO/y2:dY8juQtKDBJJMCVsU7PQlfy2
TLSH
T1B6D6D051B7054A32C4AE623379BB4720BB3AAE8DD2835B472508B3787C771D47B663C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker defense_evasion evasion rokarolla infostealer trojan

Malware Config

Signatures

Family: Rokarolla
Rokarolla is an Android banking trojan first seen in 2026.
trojan infostealer banker rokarolla

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

defense_evasion

System Checks

T1633.001

ioc	Process
/dev/qemu_pipe	com.yzr.pij
/dev/socket/qemud	com.yzr.pij

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.yzr.pij/app_onion/ZD.html	4952	com.yzr.pij

com.yzr.pij
1⤵
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
PID:4952

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZD.html

Path /data/data/com.yzr.pij/app_onion/ZD.html
Size 1.6MB
SHA256 f2777918b8aba2cd61e1cc1719ea383af3123473803c3c9e49b8ef684b00b0e5
MD5 42530b9745b619a299a17f80673def9b
SHA1 53967c50a2bce50af811bbdc4bac13d351ea3b9e
SHA512 bbc513cccd084154167a679b63dbcd7ebded7c7174331dfb42ce3f759161b43daa4dd800b3129ad85f8d64bd053eccd54268edcfe93c400d136ee150d20061ef
SSDEEP 24576:HzlmoWYECCs/eUjQKlwMDiQVYOSPp7zf0ReCK4aQ/+2j4avzCM6UnrqdKezQndt2:TgoWeCFUjQixDZVJUJARAabtlnrIFh
TLSH
T17B753341AA7D9CC148848AB82573BE5EC7ABD85C025FB40FD2CAC9A5486EC7CD11F87D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZD.html

Path /data/data/com.yzr.pij/app_onion/ZD.html
Size 1.6MB
SHA256 ecaaeffc5bc9f240ace2c16577cabfd8709bf886ca4492d940e2aea999590f90
MD5 7fe5c046ee34d692ac2e9f4959b57b88
SHA1 9279df14a56fc92da4113fba9bc9092a5057e66d
SHA512 9ed5eeab6ffda3bbbad1bee1f6d10a89abe42a4a832f59cb7ba15d3b6eefdc2b81410b5e94d44b76def6692f7d32336afd2ea28f927071c95371cf35227c1a17
SSDEEP 49152:f718Zr5gtJiGGOSTPs3u6T3vxm1GBv4Q7aaBm+R:fRMgtoNTs5g2v07+R
TLSH
T1997533D9BAC5F0D00D9FFA152D79DC8B29E53375880824CBA8CC0DDC5A976540EFAE29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.yzr.pij/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 b76d96f8190ad077b8e1ba70a2fd7004643e0175045b4caf10df6968a7680c18
MD5 35fb4e3d76b523ee842d6c643b308a34
SHA1 3ebb5ebc06815241f3d3b973a61a81faac22170f
SHA512 8d57f1f332c4ac6d293f4d8873d72d6cbc92d8ffff2b4f101a892a978408de868a660c4897ef7c54eb72048290d71ccf723eee26b3c4bc37a91b9b90f636e875
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.yzr.pij/primary.prof
Size 4KB
SHA256 a8690dc1847739cebd71f1f49ef00c687b88a213b4d25e00772b29cb1b9ddcdd
MD5 78fb8c0995749b30fad5ae5c7e12e279
SHA1 0b57ee9dc1b6b7ee1ac5feff39f41dce4668e806
SHA512 00a56965236be01ed570c66b88c174f99120f5a9f905e4fd9f69e8cf46610303a9c4b025181df361f87912d69efc084e9040a993bc9e6b9e262bea2e982517d9
SSDEEP 96:QI0hRRPwN5p097MeAaTjxU/Rif1jVVV2fVKfIfZfjHT9lGAHJClQTIn7CAOMBpis:TEr4N+7nxsu1jVX2frZbHT+eAYdMBUdY
TLSH
T113A15D0FB15F21980DF313F7872DD6B6221B65FB0CF1199A369045960782CD98F68DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZD.html

Path /data/user/0/com.yzr.pij/app_onion/ZD.html
Size 3.6MB
SHA256 11c7b04bb1fff88c763085064c926d8fd7be607fc96b0540b7c4c3847acd7a8d
MD5 14e4cee8eaedcab1a0d5ff26d60fd322
SHA1 c9a270c1b86cb187aad13e4d1626f76db070c45b
SHA512 994f1a322bd8209d55e02e6290bea7252f11180e2e7a7b906a1132c9273fe6b088bd64321d1ec56f91bc32b824a9ba4831ab581c645eefcabb69213dd1dd6a57
SSDEEP 49152:SXUe+8pKTfYrkd162Ni9droCPVgfZYjD7vG+KP:StSCmYbrKP
TLSH
T1A2064CF5B7114964E4D872347CFECE10F72C68CED6CE3A06100963B4A92A2F57AB5297
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads