Analysis

  • geolocation tags

    asiadelhiinindia
  • max time kernel
    862s
  • max time network
    880s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260325-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
  • submitted
    04/08/2026, 22:39

General

  • Target
    Zone+Modding+Minecraft_1.0.3_APKPure.apk
  • Size 9.2MB
  • Sample260804-2lcckasbph
  • SHA256 1b8d5b68803f4e27bb0ffdbbc383b2d9b1630cd20a289ea9ce8400649a808261
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Hides multimedia files using a .nomedia file 1 TTPs

    Android's media scanner ignores any directory that contains a .nomedia file. This hides your photos, videos, and audio from the gallery and other apps.

  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.zonemodding.minemaster
    1⤵
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks memory information
    PID:4312

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.zonemodding.minemaster/databases/com.google.android.datatransport.events
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zonemodding.minemaster/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 e2664aafbfcce2d956ea3bfcf877ca9154b20b6b2bb23da2a35528a51a3e1ee4
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-shm

        • Path /data/data/com.zonemodding.minemaster/databases/com.google.android.datatransport.events-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        com.google.android.datatransport.events-wal

        • Path /data/data/com.zonemodding.minemaster/databases/com.google.android.datatransport.events-wal
        • Size 44KB
        • SHA256 661e90b72d3a66bddce27092da437b6baa4b4d18702079ffeca5fc57596b3d4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_analytics_v4.db-journal

        • Path /data/data/com.zonemodding.minemaster/databases/google_analytics_v4.db-journal
        • Size 512B
        • SHA256 93a15d43ce258bf8ce44e09516d1b9ee462cc17cba4625092f7f6ac49465730d
        • MD5 SHA1 SHA512

        google_analytics_v4.db-wal

        • Path /data/data/com.zonemodding.minemaster/databases/google_analytics_v4.db-wal
        • Size 92KB
        • SHA256 9072a27eda1e31a7eb8b26b9519b3bace615c1b2a3bf1ab23910d5bf4e39a864
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.zonemodding.minemaster/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.zonemodding.minemaster/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 6280cf44484b6d8259e22990c60c96b7e009c5569c03e605f60df1c28d741953
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.zonemodding.minemaster/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 06c9ec32c46533cb218bccff8661c62cfb310763d4de33764a8fac4247392681
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.zonemodding.minemaster/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 e8b2d9ff79362e23e7307119d2bfd8c63875951c967853bdf4b692cf7b8bfeee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.zonemodding.minemaster/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 84da1428191a6867a3a08b63cad18e2b5159592dc47fe00ec7e768e5a1e67109
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.zonemodding.minemaster/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 a4ed6289914ef4ad933b53573a22e8da38af0cffce050c55a4225924e079126e
        • MD5 SHA1 SHA512 SSDEEP

        google_app_measurement_local.db-journal

        • Path /data/data/com.zonemodding.minemaster/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 069da213a1fc8db15226d914c443281a0bde2f65685bda85c205461ff44d1f27
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-wal

        • Path /data/data/com.zonemodding.minemaster/databases/google_app_measurement_local.db-wal
        • Size 36KB
        • SHA256 09267b8d5a7b388afa1ddf431d2fcc2a923a5e4140bf1d8784aa662ca3d6dae0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-wal

        • Path /data/data/com.zonemodding.minemaster/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 424f7696f4356558e0c972441afab1d700ed42d74811673c3970001f6cf4a0a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-wal

        • Path /data/data/com.zonemodding.minemaster/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 9c175dd190d827f44511d17c2b52aeb44c0e457c0043eb5ece85ddcea637cdb2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-wal

        • Path /data/data/com.zonemodding.minemaster/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 220f7506f9d0f5255fc628ff5068c2ddbdae58dc21682256606352e4ac8b963d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-wal

        • Path /data/data/com.zonemodding.minemaster/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 84868947e55b91e06b54c9c596d06133886770dca0af3248746a3c2f7428af60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-wal

        • Path /data/data/com.zonemodding.minemaster/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 bdec762e17f9e1fa0f36b0115fd05883338a3539251c31304f334009efd1cf80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation3551150945113925267tmp

        • Path /data/data/com.zonemodding.minemaster/files/PersistedInstallation3551150945113925267tmp
        • Size 569B
        • SHA256 1d420b3a198a08e967867f5f1931d763639263e2f2464926e19304044b702bc2
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8787728550935553675tmp

        • Path /data/data/com.zonemodding.minemaster/files/PersistedInstallation8787728550935553675tmp
        • Size 90B
        • SHA256 4a9625e2b828baab6207e1da6bd90870702ef0c76e94cf9092dcfb7f0a69e9eb
        • MD5 SHA1 SHA512 TLSH

        gaClientId

        • Path /data/data/com.zonemodding.minemaster/files/gaClientId
        • Size 36B
        • SHA256 828dfa2576c88233777e82c01e3548fa043155fdff2308718c425f664ae04028
        • MD5 SHA1 SHA512