Resubmissions

16/07/2026, 07:56

260716-jst7vafz3k8

16/07/2026, 07:50

260716-jppg7afy7r8

16/07/2026, 05:44

260716-gfg1msht7w8

15/07/2026, 00:49

260715-a6m61sgx2j8

15/07/2026, 00:18

260715-al32qsgs4k8

14/07/2026, 08:11

260714-j3bs9abw2z8

14/07/2026, 07:55

260714-jser6ag13q8

14/07/2026, 07:35

260714-jeyywabt2y8

14/07/2026, 07:31

260714-jctalsbs718

14/07/2026, 07:25

260714-h81h5abs4t8

Analysis

  • user interaction
    yes
  • max time kernel
    3s
  • max time network
    151s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    14/07/2026, 07:31

General

  • Target
    com.honeygain.make.money_1.2.1-LP-UJ-81_minAPI21(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk
  • Size 10.5MB
  • Sample260714-jctalsbs71
  • SHA256 e82e4e524e7b659b6a13ee51997738f7d75e6a4a33b2937591058d0f994d9bae
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Acquires the wake lock 1 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.honeygain.make.money
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Schedules tasks to execute at a specified time
    PID:3235

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7d9f47fb28c3c8fcb9cdeb2f0c4a33ec.0.tmp

        • Path /data/data/com.honeygain.make.money/cache/7d9f47fb28c3c8fcb9cdeb2f0c4a33ec.0.tmp
        • Size 3KB
        • SHA256 dd8d6fcd19edeab7f1fd6aa552e5eb9fd64f9c23794b9a2f7e1b248a47058af4
        • MD5 SHA1 SHA512 TLSH

        7d9f47fb28c3c8fcb9cdeb2f0c4a33ec.1.tmp

        • Path /data/data/com.honeygain.make.money/cache/7d9f47fb28c3c8fcb9cdeb2f0c4a33ec.1.tmp
        • Size 964B
        • SHA256 afc95910e284a6b6a3b2e9181a9fc361f56ffdfd058fc9c067c9c96cc62feef3
        • MD5 SHA1 SHA512 TLSH

        journal

        • Path /data/data/com.honeygain.make.money/cache/journal
        • Size 123B
        • SHA256 786ce4dda8d10c599ba77b99ea4320acddf90adf3e762d918b7b71a40e08bace
        • MD5 SHA1 SHA512 TLSH

        journal.tmp

        • Path /data/data/com.honeygain.make.money/cache/journal.tmp
        • Size 36B
        • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
        • MD5 SHA1 SHA512

        environment.json

        • Path /data/data/com.honeygain.make.money/cache/sentry/e9dcf26a139bd3091e36ec8a2b6c408da3b2c29a/.options-cache/environment.json
        • Size 9B
        • SHA256 847dbd914599c4e12e39663e80a07a220b686f10c6d24132ba1c964980541456
        • MD5 SHA1 SHA512

        proguard-uuid.json

        • Path /data/data/com.honeygain.make.money/cache/sentry/e9dcf26a139bd3091e36ec8a2b6c408da3b2c29a/.options-cache/proguard-uuid.json
        • Size 38B
        • SHA256 5ce474bdeba6c38e6b8ac0449536e40eb5954fa505ed6edc21d7fe2578b665fa
        • MD5 SHA1 SHA512

        release.json

        • Path /data/data/com.honeygain.make.money/cache/sentry/e9dcf26a139bd3091e36ec8a2b6c408da3b2c29a/.options-cache/release.json
        • Size 41B
        • SHA256 245aa601634b64001935ce2e134ade135fb810622faeb8eea998aa58cea01cc9
        • MD5 SHA1 SHA512

        sdk-version.json

        • Path /data/data/com.honeygain.make.money/cache/sentry/e9dcf26a139bd3091e36ec8a2b6c408da3b2c29a/.options-cache/sdk-version.json
        • Size 902B
        • SHA256 87194a2c840cd485820ae07a3f920b9466e6cb7480e511d736c96a6da3963e96
        • MD5 SHA1 SHA512 TLSH

        tags.json

        • Path /data/data/com.honeygain.make.money/cache/sentry/e9dcf26a139bd3091e36ec8a2b6c408da3b2c29a/.options-cache/tags.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512

        breadcrumbs.json

        • Path /data/data/com.honeygain.make.money/cache/sentry/e9dcf26a139bd3091e36ec8a2b6c408da3b2c29a/.scope-cache/breadcrumbs.json
        • Size 4KB
        • SHA256 f473837a98bb17801a5aeb7b2ee53d49b9c5faeab49a0f316c61006bbba23b58
        • MD5 SHA1 SHA512 TLSH

        breadcrumbs.json.tmp

        • Path /data/data/com.honeygain.make.money/cache/sentry/e9dcf26a139bd3091e36ec8a2b6c408da3b2c29a/.scope-cache/breadcrumbs.json.tmp
        • Size 12B
        • SHA256 ae1afdb53fc94d62b6862659f839a20634382b65a7354f32b5e81cd29fb4270d
        • MD5 SHA1 SHA512

        contexts.json

        • Path /data/data/com.honeygain.make.money/cache/sentry/e9dcf26a139bd3091e36ec8a2b6c408da3b2c29a/.scope-cache/contexts.json
        • Size 69B
        • SHA256 95ff3f8ad29a85623d748cf81a2d2668a17b663ab236782f1b6b07995f255d50
        • MD5 SHA1 SHA512 TLSH

        trace.json

        • Path /data/data/com.honeygain.make.money/cache/sentry/e9dcf26a139bd3091e36ec8a2b6c408da3b2c29a/.scope-cache/trace.json
        • Size 156B
        • SHA256 00f2ed97eed90626c0658ba9f12900870f6cd9f62bf6cda8ef6626b82bba0b51
        • MD5 SHA1 SHA512 TLSH

        e32ea5e1-37be-4f74-ce74-09373779af9e.envelope

        • Path /data/data/com.honeygain.make.money/cache/sentry/e9dcf26a139bd3091e36ec8a2b6c408da3b2c29a/.sentry-native/29cc1d28-8354-42f6-9aaa-51ccfabfd9b0.run/e32ea5e1-37be-4f74-ce74-09373779af9e.envelope
        • Size 77KB
        • SHA256 1db14dcc4529f5b6733eedf0d6e0e56973b956bbb2be510f6d2c77fd78136ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        last_crash

        • Path /data/data/com.honeygain.make.money/cache/sentry/e9dcf26a139bd3091e36ec8a2b6c408da3b2c29a/.sentry-native/last_crash
        • Size 27B
        • SHA256 9a1544ed81a17ccaf1ba815930b21558ddf4430835f1dd85bef098c1bddf6297
        • MD5 SHA1 SHA512

        8e1e2818c80f4312bc276ac954c9f15c.envelope

        • Path /data/data/com.honeygain.make.money/cache/sentry/e9dcf26a139bd3091e36ec8a2b6c408da3b2c29a/8e1e2818c80f4312bc276ac954c9f15c.envelope
        • Size 1KB
        • SHA256 8095a387639b6b06aff1671bb21480e9f86a2f7d8eed37914d818b9cc026e09a
        • MD5 SHA1 SHA512 TLSH

        session.json

        • Path /data/data/com.honeygain.make.money/cache/sentry/e9dcf26a139bd3091e36ec8a2b6c408da3b2c29a/session.json
        • Size 282B
        • SHA256 73a9c60393f753b472b4840f90534d4e8665959d98c04d73e297f26d061aaa6f
        • MD5 SHA1 SHA512 TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.honeygain.make.money/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 db72f8725f61a58eb1b21ad2c2b68cd174ae3b759713d37104ba7d6a029a3325
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.honeygain.make.money/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 33b1786d4b7b1c7cb24392efc367c65ec12258cb667ad3f73c8cc4cca3d72148
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.honeygain.make.money/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 fcd18f37610bd3cb067da6cc6338ac8fd7b32d96b83c2a15b7aebfd0e0e74378
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.honeygain.make.money/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 6c317f07105bb0a938d7da65de777325f28d8304f711414d977bc62b4bf522b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.honeygain.make.money/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 591045bfe8c2fc8e5276da9de09c69f54fc6e0110f050e398310ccedf5f88530
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.honeygain.make.money/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 a4776bbdf69842cff0dadd9216cb919193c655f1d695ecf82a144ce93507d66b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.honeygain.make.money/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 62b4601999970d4d22f627200d2e21979bd2396d21d2e866b9689277a4b5c07c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.honeygain.make.money/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 827cbc2999f6f9a93fb231fc41fcd8d8f39ea4d878f37be4fa67cc1cf3c0728a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.honeygain.make.money/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2acbbaaef37e662a3c5e7c367042dad0548b0ca94a9dd04092ffbfc3e0bf85d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.honeygain.make.money/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 157f7c68936d6ad98ee5c7a7dcf9a7b431bca76cb270904923146e31d4175337
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.honeygain.make.money/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 9c06dda970bcbfcd0cc1b442f831314bc9466dc13bdd578cf2c8bae76a573ce0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.honeygain.make.money/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 7224281e5202988e893393bafd529330c0be1de23022639fa1e95406a08ab5f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.honeygain.make.money/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 d1ffdca7ba8c0925bec4d10295b7c355bc1cace5e6b44d6efe9f812023f9e772
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.honeygain.make.money/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 3b4de8dd0a4d3ec5d4bfc495012d2d3986be4024a91d5f14f141b79357f4944b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.honeygain.make.money/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 8ac318c614ca5ec6ccf618eb5c327f3197f40d543513bc200b52f5cd8b2b62f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.honeygain.make.money/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 ec891643ec58b833da384402e853e98a6a06712b540e37d83d7165bf62d5c390
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.honeygain.make.money/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 b2293202759fbef3ba9249847ecd1af18ded28265fc6b141c324bc47d9b4f771
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.honeygain.make.money/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 54fab2a4f9dfc87ef58e858d09139f2a37d375118fa8b73eabeb37e581f91c78
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.honeygain.make.money/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 2dc52f004ab1a8a7ff6427e14cb8fbe179edbbc3bb40978032897fa6cb6f657d
        • MD5 SHA1 SHA512

        FeatureCache.txt.tmp

        • Path /data/data/com.honeygain.make.money/files/GrowthBook-KMM/FeatureCache.txt.tmp
        • Size 4KB
        • SHA256 0573b1687c10b4a5ae0ef8b6eceb48f0a0bbac5085051e4fc2f6c27f1ca6f204
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INSTALLATION

        • Path /data/data/com.honeygain.make.money/files/INSTALLATION
        • Size 32B
        • SHA256 2e43e5a780c577cabf6a3c2b5172566071a5841238e3857f09489570784e93b7
        • MD5 SHA1 SHA512

        PersistedInstallation1021537765997982287tmp

        • Path /data/data/com.honeygain.make.money/files/PersistedInstallation1021537765997982287tmp
        • Size 90B
        • SHA256 278cdbd821a6c40d2bf092a5f0a8ca4452894e67b560c1d3288505a96f8bb59d
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8566779291354081894tmp

        • Path /data/data/com.honeygain.make.money/files/PersistedInstallation8566779291354081894tmp
        • Size 562B
        • SHA256 147b061d8080ebb2628cedb1f41af1b5858aff5e5e00ef44699bfca93fee7876
        • MD5 SHA1 SHA512 TLSH