Analysis
- user interaction
yes - max time kernel
81s - max time network
106s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20260513-en - resource tags
- submitted
02/08/2026, 14:30
Errors
Reason
Machine shutdown
General
- Target https://apkpure.com/ar/devastate/com.devastate.android
- Sample260802-rt43favdqa
Score
6/10
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
- Changes its process name 64 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 9 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 55 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 8 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/usr/bin/xdg-openxdg-open https://apkpure.com/ar/devastate/com.devastate.android1⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Reads runtime system information
-
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
-
-
/usr/libexec/xdg-desktop-portal-gnome/usr/libexec/xdg-desktop-portal-gnome5⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵
- Reads runtime system information
-
-
/usr/libexec/dconf-service/usr/libexec/dconf-service5⤵
- Reads runtime system information
-
-
/usr/bin/gedit/usr/bin/gedit --gapplication-service5⤵
- Reads runtime system information
-
-
/usr/libexec/gvfs-udisks2-volume-monitor/usr/libexec/gvfs-udisks2-volume-monitor5⤵
- Reads runtime system information
-
-
/usr/libexec/gvfs-gphoto2-volume-monitor/usr/libexec/gvfs-gphoto2-volume-monitor5⤵
- Enumerates kernel/hardware configuration
-
-
/usr/libexec/gvfs-afc-volume-monitor/usr/libexec/gvfs-afc-volume-monitor5⤵
- Reads runtime system information
-
-
/usr/libexec/gvfs-goa-volume-monitor/usr/libexec/gvfs-goa-volume-monitor5⤵
- Reads runtime system information
-
-
/usr/libexec/goa-daemon/usr/libexec/goa-daemon5⤵
- Reads runtime system information
-
-
/usr/libexec/goa-identity-service/usr/libexec/goa-identity-service5⤵
-
-
/usr/libexec/gvfs-mtp-volume-monitor/usr/libexec/gvfs-mtp-volume-monitor5⤵
- Enumerates kernel/hardware configuration
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
-
-
/usr/bin/xpropxprop -root2⤵
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
-
-
/usr/bin/unameuname2⤵
-
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr4⤵
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
-
-
/usr/bin/xpropxprop -root3⤵
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
-
-
/usr/bin/unameuname3⤵
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/whichwhich firefox2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/firefox/usr/bin/firefox https://apkpure.com/ar/devastate/com.devastate.android2⤵
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox https://apkpure.com/ar/devastate/com.devastate.android2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 1703 9 /tmp/ 113⤵
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{6d3e1774-5563-4479-bed0-f4ee3287d3a3}" -parentPid 1703 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/crashreporter/usr/lib/firefox/crashreporter --ping-cleanup "/root/.config/mozilla/firefox/Crash Reports" false3⤵
- Reads runtime system information
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f1⤵
-
/bin/sh/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=\$\$; exec \"\$@\"" sh file-roller /root/Downloads/Devastate_1.0_APKPure.apk1⤵
-
/usr/local/sbin/file-rollerfile-roller /root/Downloads/Devastate_1.0_APKPure.apk1⤵
-
/usr/local/bin/file-rollerfile-roller /root/Downloads/Devastate_1.0_APKPure.apk1⤵
-
/usr/sbin/file-rollerfile-roller /root/Downloads/Devastate_1.0_APKPure.apk1⤵
-
/usr/bin/file-rollerfile-roller /root/Downloads/Devastate_1.0_APKPure.apk1⤵
- Reads runtime system information
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/usr/local/sbin/unzipunzip -ZTs -- /root/Downloads/Devastate_1.0_APKPure.apk2⤵
- System Network Configuration Discovery
-
-
/usr/local/bin/unzipunzip -ZTs -- /root/Downloads/Devastate_1.0_APKPure.apk2⤵
- System Network Configuration Discovery
-
-
/usr/sbin/unzipunzip -ZTs -- /root/Downloads/Devastate_1.0_APKPure.apk2⤵
- System Network Configuration Discovery
-
-
/usr/bin/unzipunzip -ZTs -- /root/Downloads/Devastate_1.0_APKPure.apk2⤵
- System Network Configuration Discovery
-
-
/usr/local/sbin/unzipunzip -ZTs -- /root/Downloads/Devastate_1.0_APKPure.apk2⤵
- System Network Configuration Discovery
-
-
/usr/local/bin/unzipunzip -ZTs -- /root/Downloads/Devastate_1.0_APKPure.apk2⤵
- System Network Configuration Discovery
-
-
/usr/sbin/unzipunzip -ZTs -- /root/Downloads/Devastate_1.0_APKPure.apk2⤵
- System Network Configuration Discovery
-
-
/usr/bin/unzipunzip -ZTs -- /root/Downloads/Devastate_1.0_APKPure.apk2⤵
- System Network Configuration Discovery
-
-
/usr/local/sbin/unzipunzip -d /root/.cache/.fr-CYkhAr -o -- /root/Downloads/Devastate_1.0_APKPure.apk AndroidManifest.xml2⤵
-
-
/usr/local/bin/unzipunzip -d /root/.cache/.fr-CYkhAr -o -- /root/Downloads/Devastate_1.0_APKPure.apk AndroidManifest.xml2⤵
-
-
/usr/sbin/unzipunzip -d /root/.cache/.fr-CYkhAr -o -- /root/Downloads/Devastate_1.0_APKPure.apk AndroidManifest.xml2⤵
-
-
/usr/bin/unzipunzip -d /root/.cache/.fr-CYkhAr -o -- /root/Downloads/Devastate_1.0_APKPure.apk AndroidManifest.xml2⤵
-
-
/bin/sh/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=\$\$; exec \"\$@\"" sh file-roller /root/Downloads/Devastate_1.0_APKPure.apk1⤵
-
/usr/local/sbin/file-rollerfile-roller /root/Downloads/Devastate_1.0_APKPure.apk1⤵
-
/usr/local/bin/file-rollerfile-roller /root/Downloads/Devastate_1.0_APKPure.apk1⤵
-
/usr/sbin/file-rollerfile-roller /root/Downloads/Devastate_1.0_APKPure.apk1⤵
-
/usr/bin/file-rollerfile-roller /root/Downloads/Devastate_1.0_APKPure.apk1⤵
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AndroidManifest.xml
user
events
nimbus-targeting-context
26b0215c-f7f2-4fb4-80e9-9a3794480de2
3126f690-f6a6-4823-b305-ded345c26944
3c384132-aa9a-425f-a0d4-c5b79c324e9d
3fb7467c-d82f-476c-b6a9-768872bb2e63
46f883f6-e6ee-4a89-a98c-f9612fa473e2
477f354a-b9f7-4116-b8f0-40d4c0aedf48
4ed50bf7-a85b-4830-8deb-639e97a2b2c9
8b1f0e91-295c-4c51-b160-c9e432be0eb0
c14cd22c-64d5-401e-ba93-9e9e824abde9
e46d8a30-6bf8-48ad-9d06-46a1d5a312e2
fb92ab33-e796-4fbe-aaf9-881530346ca9
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
protections.sqlite
serviceworker.txt
.metadata-v2-tmp
.padding
caches.sqlite
caches.sqlite
{512d1533-3f0b-44fd-8062-51f211f50ca6}.tmp
{6a68fe50-ac30-4996-8440-a06cddc436db}.tmp
data.sqlite
usage
usage
1
2
webappsstore.sqlite
crashping.pid
tmp-nkk.xpi
tmpaddon