Analysis
- max time kernel
31s - max time network
156s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
- submitted
16/07/2026, 03:08
General
- Target com.fontkeyboard.cute.emojikey.apk
- Size 23.5MB
- Sample260716-dnaprafv2t
- SHA256 78ce94948996344acdf31c7232f7c762680e22fccc875b0be66fe90184726ffc
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 9 IoCs
- Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
- Checks the presence of a debugger
- Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.fontkeyboard.cute.emojikey1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
55409fe964d95bf88aca998a91942a7e0cf8fd35c3628363c5e110178d05c691.0.tmp
571f1f88c1d1d0ab210d1945850da73c635f275e5f390ac968d77006ab6b2456.0.tmp
663aafff976bf64d6b93f766801dd42a922b4573339a1a19bc294509761061ff.0.tmp
journal
journal.tmp
tmp_.nomedia
tmp_dapi.js
tmp_index.css
tmp_index.html
tmp_index.js
tmp_jquery-1.9.1.min.js
tmp_mobileController.html
tmp_mobileController.min.css
tmp_mraid.js
tmp_sdk_controller.min.gz.js
com.google.android.datatransport.events-shm
com.google.android.datatransport.events-wal
component_data.db-journal
component_data.db-wal
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
mbridge.msdk.db
mbridge.msdk.db-journal
mbridge.msdk.db-wal
supersonic_sdk.db
supersonic_sdk.db
supersonic_sdk.db
supersonic_sdk.db
supersonic_sdk.db
supersonic_sdk.db
supersonic_sdk.db-wal
supersonic_sdk.db-wal
supersonic_sdk.db-wal
supersonic_sdk.db-wal
supersonic_sdk.db-wal
supersonic_sdk.db-wal
traceback.kv.db
traceback.kv.db-journal
traceback.kv.db-wal
traceback.kv.db.analytics-journal
traceback.kv.db.analytics-wal
traceback.kv.db.analytics-wal
traceback.kv.db.remoteconfig-journal
traceback.kv.db.remoteconfig-wal
traceback.kv.db.remotedb
traceback.kv.db.remotedb-journal
traceback.kv.db.remotedb-wal
track_manager_metrics_sdk.db
track_manager_metrics_sdk.db-journal
track_manager_metrics_sdk.db-wal
ttopensdk.db-journal
ttopensdk.db-wal
internal-keys
report
userlog
userlog.tmp
1784171356820
1784171357466
1784171358165
1784171358781
1784171358949
1784171361715
1784171361973
1784171362032
1784171367630
1784171368188
1784171368297
1784171376645
1784171376795
1784171376936
PersistedInstallation4276465491221522139tmp
firebase_session_Y29tLmZvbnRrZXlib2FyZC5jdXRlLmVtb2ppa2V5_data.preferences_pb.tmp
firebase_session_Y29tLmZvbnRrZXlib2FyZC5jdXRlLmVtb2ppa2V5_settings.preferences_pb.tmp
firebase_session_Y29tLmZvbnRrZXlib2FyZC5jdXRlLmVtb2ppa2V5_settings.preferences_pb.tmp
firebase_session_Y29tLmZvbnRrZXlib2FyZC5jdXRlLmVtb2ppa2V5_settings.preferences_pb.tmp
firebase_session_Y29tLmZvbnRrZXlib2FyZC5jdXRlLmVtb2ppa2V5_settings.preferences_pb.tmp
firebase_session_Y29tLmZvbnRrZXlib2FyZC5jdXRlLmVtb2ppa2V5_settings.preferences_pb.tmp
profileInstalled
profileinstaller_profileWrittenFor_lastUpdateTime.dat
primary.prof
share_kv_date.tmp
share_kv_date.tmp
share_kv_date.tmp
0d0bff08032ae2c151f5341ddddb259f
3cc25e0c4992a14be59876ab4548322b
726e6f7111d5cf479384162b2b72848c
90e870c77346cf509e90790926c1c8f1
afd1707ad76c449f9c1ce4de75dac80e.zip
confirmDialog.html
confirmDialog.js
m.bundle.js
c74dea63ed41b6c2217f01cdc3d5facd.zip
dynamic-loader.js
mtg-offline-package.js
mw_config.js
package-loading.js
web-audio-check.js
m_en_MI_3Xok9a9a1_p_an_ty.html
mbridge_reward_end_card_layout_portrait_v1.xml
mbridge_reward_end_card_layout_portrait_v1.xml.zip
mbridge_reward_layer_floor_904_v1.xml
mbridge_reward_layer_floor_904_v1.xml.zip
11c8350c06bbedde6f3c5c93715e18b6
54db1d52f8134dc789f1e570f981e459
Anonymous-DexFile@0xc2bb4000-0xc2bb962c
Anonymous-DexFile@0xd8678000-0xd867b664
Anonymous-DexFile@0xd88fb000-0xd88fddc4
Anonymous-DexFile@0xd8a71000-0xd8a7a290
Anonymous-DexFile@0xd8aa7000-0xd8aa9d00