Analysis

  • user interaction
    yes
  • max time kernel
    32s
  • max time network
    155s
  • platform
    android-14_x64
  • resource
    android-34-x64-arm64-20260325.1-en
  • resource tags

    arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
  • submitted
    23/07/2026, 22:22

General

  • Target
    roblox-game.apk
  • Size 12.6MB
  • Sample260723-2aj82ayake
  • SHA256 a7ce7f344d5208100cc6811a676540301351b0b836aba0e6aed233c35c0cd0cf
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.aptoide.android.aptoidegames
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4411

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        base.4411.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/cache/oat_primary/x86_64/base.4411.tmp
        • Size 492KB
        • SHA256 d66e58ad46ee46367b2c9dd765ef012c47c2b01cf804fbc012290d24328023f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aptoide_task_info.db-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/aptoide_task_info.db-journal
        • Size 512B
        • SHA256 dfa9fd76bfdbd2fd2b5689890f56993ce7591d03240b6dc872d5896637813b05
        • MD5 SHA1 SHA512

        aptoide_task_info.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/aptoide_task_info.db-wal
        • Size 40KB
        • SHA256 25765e5cf30964698969c0eb100e3e7f84c72534c81bff0da1d76eeeae0cba05
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aptoide_updates.db-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/aptoide_updates.db-journal
        • Size 512B
        • SHA256 d44a06f9a534df4b00a680a278c19c3bdd021589da550587c9fc192e66cbf749
        • MD5 SHA1 SHA512

        aptoide_updates.db-wal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/aptoide_updates.db-wal
        • Size 36KB
        • SHA256 46514fff863759f4ffe372b1aae3982d56daa3eb549020f8eb48f551e8738600
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.aptoide.android.aptoidegames/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 a73d5faeb9da1ab1721ffa2383dab36f40ed59876d86bef5a065e35bc2c9dbd4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 cab4c033d508a8e217facf904fef21d9d7f26ce3c035f0a4bf07207449089fcd
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 8e5f3425a1b3d9408124be5286fc1d7a295fea1eacc7786739ef05844a6a9785
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 6f2c9beb94f931002746a4eb771e8a9e4741ef4aa09b8bf41ebf3184c5f8e447
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 85ef4b5b9a44e5147d92e43eb960184d1ee71362e0ba1ec338eea00f310c2344
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 f73f2aedfe384fc71c36f9c283808fe29e4fdbcda5e88bc7e636d7b132d22ca2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 db225758499893075d2de2fc54e7bd2e1fd67259eb7dc368097325398ad40366
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2c59e09704a00298e5a231187147d7d7f2e85e78f5335e6dcd6b1f684ba4d0d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 5e270fe86c0c17c59365b9dfb293be237eb0b7fd207bdb4017115bbe6f497a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 77af1283c093a33121ec61752b7a0f15ac7cafe8a449f38d8ed5fded22c0dc86
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 0b87124f14c3ab735fe664e70b9b7e564f47f60c9ff532bf2961e77115a7d9a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 a78a98e2060f2e5b8c0390b59870418b4a61262b3840efd2e9f6bad2fe141388
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 4590f0c952161ab63d17562bba416e731bd7cd3ddcb9d9a2f000e91e0e390930
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 c6ef89b7935e04aefcbfe63c640476d94e6108d527ecf4babe2d1816afe7d21f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.aptoide.android.aptoidegames/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 030d96a22fcf23cbf67c83b43e060dc31d2b5da01d36ac1f7679f7ab0c0c5af0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.crashlytics.settings.json

        • Path /data/data/com.aptoide.android.aptoidegames/files/.crashlytics.v3/com.aptoide.android.aptoidegames/com.crashlytics.settings.json
        • Size 781B
        • SHA256 109fd936c00c5a9c9b31d6b97445cca7edb40c31cdabe7075551650a3f51a79d
        • MD5 SHA1 SHA512 TLSH

        internal-keys

        • Path /data/data/com.aptoide.android.aptoidegames/files/.crashlytics.v3/com.aptoide.android.aptoidegames/open-sessions/6A62944B01580001113B7B7248A3823E/internal-keys
        • Size 207B
        • SHA256 9609293442238e6c722b5615265e3126399e9932408618714496b442f453281b
        • MD5 SHA1 SHA512 TLSH

        report

        • Path /data/data/com.aptoide.android.aptoidegames/files/.crashlytics.v3/com.aptoide.android.aptoidegames/open-sessions/6A62944B01580001113B7B7248A3823E/report
        • Size 812B
        • SHA256 8309480876163b90a63a3f57167d93f8015bf43ea585dbe87d7f7bdc8764936e
        • MD5 SHA1 SHA512 TLSH

        userlog

        • Path /data/data/com.aptoide.android.aptoidegames/files/.crashlytics.v3/com.aptoide.android.aptoidegames/open-sessions/6A62944B01580001113B7B7248A3823E/userlog
        • Size 88B
        • SHA256 e6eac6addd6be4b5aa1d756af1a9a33a6f9aca1256ed529c32f3030a489c86d9
        • MD5 SHA1 SHA512 TLSH

        userlog.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/.crashlytics.v3/com.aptoide.android.aptoidegames/open-sessions/6A62944B01580001113B7B7248A3823E/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        PersistedInstallation5165957864014818823tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/PersistedInstallation5165957864014818823tmp
        • Size 90B
        • SHA256 baf0f1994ea8a8674bffb3bd7970ae3e0efacc6a32927705b77dcd248076904f
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation7332728449118533595tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/PersistedInstallation7332728449118533595tmp
        • Size 570B
        • SHA256 ed5712419b93fb4b9c901bfd2a88316b5dad3df8a14e90418b7f34fac059af32
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MTo4MDg3NTk0OTIxNzA6YW5kcm9pZDo0ZjlhYmYzNzMwNWM5NzA0NTBmMGIz.preferences_pb.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo4MDg3NTk0OTIxNzA6YW5kcm9pZDo0ZjlhYmYzNzMwNWM5NzA0NTBmMGIz.preferences_pb.tmp
        • Size 410B
        • SHA256 09e49b5b01a20d42816c6c18128c45a06cf0997f52dddf41b63906c37a739461
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MTo4MDg3NTk0OTIxNzA6YW5kcm9pZDo0ZjlhYmYzNzMwNWM5NzA0NTBmMGIz.preferences_pb.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo4MDg3NTk0OTIxNzA6YW5kcm9pZDo0ZjlhYmYzNzMwNWM5NzA0NTBmMGIz.preferences_pb.tmp
        • Size 434B
        • SHA256 f9574cfbeda1e7863eb2022dd1f3203e6f846d653c3466512f61ff7ae92c8991
        • MD5 SHA1 SHA512 TLSH

        sessionConfigsDataStore.data.tmp

        • Path /data/data/com.aptoide.android.aptoidegames/files/datastore/firebaseSessions/sessionConfigsDataStore.data.tmp
        • Size 145B
        • SHA256 eb848e35eb5c7fa8848562abd27bc7fe3b2d076967c2583a69d1e595e5ef3f38
        • MD5 SHA1 SHA512 TLSH

        frc_1:808759492170:android:4f9abf37305c970450f0b3_firebase_defaults.json

        • Path /data/data/com.aptoide.android.aptoidegames/files/frc_1:808759492170:android:4f9abf37305c970450f0b3_firebase_defaults.json
        • Size 546B
        • SHA256 54d808d1b66da8025fe1c485cbd8d1002ac166faec987d3a00d76ead04a83c26
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/com.aptoide.android.aptoidegames/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 f8046fb6523b685349e4ceaa5b63d5653f3d4d9bc0291dd9546056bfabd76205
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.aptoide.android.aptoidegames/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 d8b46f358705c4a63b039418da8fc6c2990b1f3b72aff62feac889eb097b29b9
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.aptoide.android.aptoidegames/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.aptoide.android.aptoidegames/no_backup/androidx.work.workdb-wal
        • Size 181KB
        • SHA256 9e36828e55d2145b7b5db42bb96b32dcd3ff523a9e3e7b0df672f126244f2926
        • MD5 SHA1 SHA512 SSDEEP TLSH