Resubmissions
16/07/2026, 07:56
260716-jst7vafz3k816/07/2026, 07:50
260716-jppg7afy7r816/07/2026, 05:44
260716-gfg1msht7w815/07/2026, 00:49
260715-a6m61sgx2j815/07/2026, 00:18
260715-al32qsgs4k814/07/2026, 08:11
260714-j3bs9abw2z814/07/2026, 07:55
260714-jser6ag13q814/07/2026, 07:35
260714-jeyywabt2y814/07/2026, 07:31
260714-jctalsbs71814/07/2026, 07:25
260714-h81h5abs4t8General
- Target com.honeygain.make.money_1.2.1-LP-UJ-81_minAPI21(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk
- Size 10.5MB
- Sample260714-jctalsbs71
- SHA256 e82e4e524e7b659b6a13ee51997738f7d75e6a4a33b2937591058d0f994d9bae
- MD5 d41494c4c0d6e7042c16a982e5bc6362
- SHA1 8c168fe3cf9d29737f860ffb407ab575e58481b8
- SHA512 257f5bce9fc8d5772977f3d873d2bf3c19ae90a9dc823cf74db111a3ffd7fc54aba79da0b33157841b2132792ea5da58825c4ccc9f1e283ee07fb5cfe5b882c4
- SSDEEP 196608:q/CHhW+fDPjWT/LmYySoi53YV+S7F0dw0h6j6nO0HGzQ+kyaKFO:DWTCZu5qF0GebHGzoKg
- TLSH T178B612C6FBE9D92FC8731072CC5B52F1265A4C268E82AF476448375C28B36E84F59BC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
com.honeygain.make.money_1.2.1-LP-UJ-81_minAPI21(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk
Resource
android-35-x64-arm64-20260325-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target com.honeygain.make.money_1.2.1-LP-UJ-81_minAPI21(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk
- Size 10.5MB
- SHA256 e82e4e524e7b659b6a13ee51997738f7d75e6a4a33b2937591058d0f994d9bae
- MD5 d41494c4c0d6e7042c16a982e5bc6362
- SHA1 8c168fe3cf9d29737f860ffb407ab575e58481b8
- SHA512 257f5bce9fc8d5772977f3d873d2bf3c19ae90a9dc823cf74db111a3ffd7fc54aba79da0b33157841b2132792ea5da58825c4ccc9f1e283ee07fb5cfe5b882c4
- SSDEEP 196608:q/CHhW+fDPjWT/LmYySoi53YV+S7F0dw0h6j6nO0HGzQ+kyaKFO:DWTCZu5qF0GebHGzoKg
- TLSH T178B612C6FBE9D92FC8731072CC5B52F1265A4C268E82AF476448375C28B36E84F59BC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Checks if the Android device is rooted.
-
Acquires the wake lock
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network
-
Listens for changes in the sensor environment (might be used to detect emulation)