Analysis

  • max time kernel
    2s
  • max time network
    774s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
  • submitted
    08/07/2026, 11:59

General

  • Target
    Roblox_v2.725.1142(2546).apk
  • Size 140.6MB
  • Sample260708-n565dsf18m
  • SHA256 435d5015b950b5e1149ab4d44541a4d13846b40a52e57bd9bb62bd41c1e5264d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.roblox.client
    1⤵
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Checks CPU information
    PID:4517

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        3280246c8498e1363bb1e597334aeb92.0.tmp

        • Path /data/data/com.roblox.client/cache/3280246c8498e1363bb1e597334aeb92.0.tmp
        • Size 6KB
        • SHA256 3ec1c071a7693bf14d53a869f94a5ba80acab423c5053505de3e8fe19c5d53ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        3280246c8498e1363bb1e597334aeb92.1.tmp

        • Path /data/data/com.roblox.client/cache/3280246c8498e1363bb1e597334aeb92.1.tmp
        • Size 24KB
        • SHA256 d13c04d46da37275211340411f15e477dd8afac75b1e8255d8d418801ee55165
        • MD5 SHA1 SHA512 SSDEEP TLSH

        journal

        • Path /data/data/com.roblox.client/cache/journal
        • Size 39B
        • SHA256 e8b5e22446d16930a69065e1c7f95a5574f6ab9923c6010adfe8e692374f7fe3
        • MD5 SHA1 SHA512

        journal.tmp

        • Path /data/data/com.roblox.client/cache/journal.tmp
        • Size 36B
        • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
        • MD5 SHA1 SHA512

        google_app_measurement_local.db

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2a340388f145288c8867ecda5c58991d8dd97363ac730d5a0251136491461a20
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 8b5e55e1fe2a83923690b0e8dfab218d4bb5831e96b14a3d184b2704088518f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 dc21bc88238f86e6e9ce2a4fd7559c366f7cd6be9bda4e648f5a776ccdd816a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 4d362661ae7140e76a7e4989fa0332f8e140ba5b18d615ca80ae27998c2690f6
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 3ff8f5dcf8ded057b8614ca208300ca6a20e4b1347c52240a48d5b3a38c3007f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 e0b80fc484ea8e28ecff90333e211cca6d1b51b05f8fad5311875eeb46a3ef0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 ce0978e37470f6af22814c3d8b76a5c2352671bd17779bf9f1411f22ef54d47c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 d8c320f41c27fc2dc7b9a349946de14fd6ba1c52ca0688fa31700b7b514d124d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 267fda31cf47537381193e2a31b67028ea78ea0d301a1046b06d112bdce17393
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation3368069790829254233tmp

        • Path /data/data/com.roblox.client/files/PersistedInstallation3368069790829254233tmp
        • Size 90B
        • SHA256 1a72fbb27ec49c8a9f52a5602fcf88ca6a9ac6cb8db3fa284b03baf935cfaad2
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8722713780490537638tmp

        • Path /data/data/com.roblox.client/files/PersistedInstallation8722713780490537638tmp
        • Size 562B
        • SHA256 4d67197b1f2dc93cdf042c9809ece6db945704c7c3901b6103671a716887b71c
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp

        • Path /data/data/com.roblox.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp
        • Size 343B
        • SHA256 ec073f025d3eb7f4bf2af2902ee14f2fc16d277b5f6b235d2a87a24ea1e5cbef
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp

        • Path /data/data/com.roblox.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp
        • Size 367B
        • SHA256 dd839576c0964ca5da18740474c5e51e92b3555ae4f632f2439d62d767e0ce6c
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/com.roblox.client/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.roblox.client/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 4f60a5353be10c1c0ec1a9e2d3f4f6223b0f1a3d9c5d46585f300757c9ec759d
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.roblox.client/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.roblox.client/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 3f417c7da704cc51bf904d5abb4aa8ce563286175ceef51ac2011e2d43aa5968
        • MD5 SHA1 SHA512 SSDEEP TLSH