Analysis
- user interaction
yes - max time kernel
49s - max time network
71s - platform
android-13_x64 - resource
android-33-x64-arm64-20260708-en - resource tags
- submitted
16/07/2026, 04:31
General
- Target CapCut ULTRA v26.6.6 @EpicModder.apk
- Size 276.7MB
- Sample260716-e5p2fac16k
- SHA256 dfbcbaa9a56f9c4068057c4710f666c335a7ba4be0ce21d2d05a29eba6edc503
Malware Config
Signatures
- Checks known Qemu files. 1 TTPs 2 IoCs
Checks for known Qemu files that exist on Android virtual device images.
- Checks known Qemu pipes. 1 TTPs 1 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
- Loads dropped Dex/Jar 1 TTPs 37 IoCs
Runs executable file dropped to the device during analysis.
- Queries information about running processes on the device 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Queries information about active data network 1 TTPs 3 IoCs
- Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.lemon.lvoverseas:push1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
-
com.lemon.lvoverseas1⤵
- Checks known Qemu files.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Reads the content of photos stored on the user's device.
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
com.lemon.lvoverseas:smp1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
framework-adservices.jar
framework-sdksandbox.jar
framework-appsearch.jar
apache-xml.jar
bouncycastle.jar
core-libart.jar
core-oj.jar
okhttp.jar
framework-bluetooth.jar
conscrypt.jar
core-icu4j.jar
android.net.ipsec.ike.jar
updatable-media.jar
framework-mediaprovider.jar
framework-ondevicepersonalization.jar
framework-statsd.jar
framework-permission-s.jar
framework-permission.jar
framework-scheduling.jar
framework-sdkextensions.jar
framework-connectivity-t.jar
framework-connectivity.jar
framework-tethering.jar
framework-uwb.jar
framework-wifi.jar
Cookies
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
db_photos_0-0-0-.db-journal
db_photos_0-0-0-.db-wal
db_photos_0-0-0-.db-wal
db_photos_user_0.db-journal
db_photos_user_0.db-wal
db_photos_user_0.db-wal
downloader.db
downloader.db-journal
downloader.db-journal
downloader.db-journal
google_app_measurement_local.db
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
lv_ai_translator.db-journal
lv_ai_translator.db-wal
lv_ai_translator.db-wal
lv_database.db
lv_database.db-journal
lv_database.db-journal
lv_database.db-journal
ss_app_log.db
ss_app_log.db-journal
ss_app_log.db-journal
ss_app_log.db-journal
verifystorage.db
verifystorage.db-journal
verifystorage.db-journal
verifystorage.db-journal
verifystorage.db-journal
benefits.json
epilogue3.mp4.lvtmp
epilogue_anim.zip.lvtmp
Appear.lua
._Appear.lua
._config.json
._content.json
anim.prefab
config.json
content.json
2wr9WIqoKB0UOb70gTE7fmspe_Y.5044873165168569638.tmp
m2xb4z4XUq4mJLl55yO5VoCGOmI.3742349919491900537.tmp
8GbZTLHrMt0qnJAw7JMASuf4a1U.6487577495278737109.tmp
2PRlH04z0US__kw_lIjPC3xyMvU.835329735364131811.tmp
uzlr70sFO3HImZbe64OaCw3Ag7k.8335680713015325051.tmp
WRIalgeVE9Pvr_250AQUgqEntvg.3978521428137273160.tmp
ASUuql4wzjMozE12fb8u80R8dpA.1176732261843254883.tmp
gPdF-YuoZ6QFOLJn8Cx_G-EC1w8.456790910565675939.tmp
na.czl
activity_track.inf
app_memory.inf
common_params.json
dev_memory.inf
gfxinfo.txt
locale.inf
main_stack.txt
process_state.txt
scraps.inf
sys_memory.inf
ai_1784176561221_4342_current
2010.config
1784176518238.aif
hardware.inf
rom.inf
current.aid
current.chn
current.did
current.ver
1784176524776
1784176524776
1784176524776
import_tag_1784176524776.txt
import_tag_1784176524776.txt
import_tag_1784176524776.txt
com_lemon_lvoverseas.times
zoin_load.log
androidx.work.workdb
androidx.work.workdb-journal
androidx.work.workdb-shm
androidx.work.workdb-wal
androidx.work.workdb-wal
com.facebook.sdk.appEventPreferences.xml
com.google.android.gms.measurement.prefs.xml
common_config.xml
itshehzada.xml
push_multi_process_config.xml
push_multi_process_config.xml
push_multi_process_config.xml
goldfish_pipe
goldfish_pipe
goldfish_pipe
androidx.window.extensions.jar
androidx.window.sidecar.jar
anon_inode:[eventfd]
socket:[57147]
socket:[59224]
socket:[59431]
socket:[59729]
socket:[60566]