General
- Target HappyMod-3-4-1.apk
- Size 10.0MB
- Sample260706-rwaxdab17k
- SHA256 09d351343ae3cba954e4a99f67dabc2102913645444c710b7b2a258c550cd56b
- MD5 ee907da53f42b3ffecabecc3e85b5515
- SHA1 6d95b2a082f7c752788c748a8424f8fbb3004587
- SHA512 c2a97a9093b29cead3959efa7c8bb14a8d667a8d70e4176f7b3a5ce7a0cbe56ffb1abb60280ccbe40ef0eac9866de30b2611422e97b3d21a555467bb17d49be0
- SSDEEP 196608:/e9TBhkJv/MLOeHgzqpbY7NLskoxCxm2HfDxGd6tmaE4Jjy:AUHMLhYxox7afDxGWI
- TLSH T192B6016AF70CDD2FC8B72076485A3231661B5C298F5297C75944772C7AB72E80F2ABC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
HappyMod-3-4-1.apk
Resource
android-x64-arm64-20260325-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target HappyMod-3-4-1.apk
- Size 10.0MB
- SHA256 09d351343ae3cba954e4a99f67dabc2102913645444c710b7b2a258c550cd56b
- MD5 ee907da53f42b3ffecabecc3e85b5515
- SHA1 6d95b2a082f7c752788c748a8424f8fbb3004587
- SHA512 c2a97a9093b29cead3959efa7c8bb14a8d667a8d70e4176f7b3a5ce7a0cbe56ffb1abb60280ccbe40ef0eac9866de30b2611422e97b3d21a555467bb17d49be0
- SSDEEP 196608:/e9TBhkJv/MLOeHgzqpbY7NLskoxCxm2HfDxGd6tmaE4Jjy:AUHMLhYxox7afDxGWI
- TLSH T192B6016AF70CDD2FC8B72076485A3231661B5C298F5297C75944772C7AB72E80F2ABC4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Checks known Qemu pipes.
Checks for known pipes used by the Android emulator to communicate with the host.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Reads the content of photos stored on the user's device.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network
-
Reads information about phone network operator.
-
Checks the presence of a debugger
-
Listens for changes in the sensor environment (might be used to detect emulation)
MITRE ATT&CK Mobile v16
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
3System Checks
3