Analysis
- max time kernel
3s - max time network
152s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
- submitted
24/07/2026, 09:17
General
- Target beetv-2.2.3.apk
- Size 15.3MB
- Sample260724-k87csabl8x
- SHA256 690bee06fe3dd170def13a6ea6a44477bb9de06fbf1d49726da92a4a58316ff0
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 8 IoCs
- Checks Qemu related system properties. 1 TTPs 2 IoCs
Checks for Android system properties related to Qemu for Emulator detection.
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.battlenet.showguide1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks memory information
-
getprop2⤵
- Checks Qemu related system properties.
-
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
2.2.3-0.stacktrace
google_analytics_v4.db
google_analytics_v4.db-journal
google_analytics_v4.db-shm
google_analytics_v4.db-wal
http_auth.db-journal
http_auth.db-wal
presage.db-journal
presage.db-wal
session_analytics.tap
session_analytics.tap
session_analytics.tap.tmp
sa_43a129eb-5a82-4b9c-b095-9d89b17b48e1_1784884656682.tap
gaClientId
shared_prefs_sdk_ad_prefs
dso_deps
dso_manifest
dso_state
dso_state