Analysis

  • max time kernel
    5s
  • max time network
    91s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    04/08/2026, 02:13

General

  • Target
    devidot.apkeditor.mod_2.0.0.apk
  • Size 16.8MB
  • Sample260804-cnsd5abd57
  • SHA256 a18f5428e7da2283b4830473e61c16d43ffe275f9d30dca43f54cb269e1e4c6a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 8 IoCs
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • devidot.apkeditor.mod
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu pipes.
    • Acquires the wake lock
    • Queries information about active data network
    • Checks CPU information
    PID:3253

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OneSignal.db

        • Path /data/data/devidot.apkeditor.mod/databases/OneSignal.db
        • Size 52KB
        • SHA256 373b5463b48928aed647e0887a4586a0ae27775877d089a469559567e59e3045
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/devidot.apkeditor.mod/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 d7236cc9796ef2bba3fb0ec224aa92488bdaf999976d0d65028f320927534e8e
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/devidot.apkeditor.mod/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 9df61eb2103290143fe8c7a4d148d35a8f792bf3cf1d88cdbab8872cf3d139a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneSignal.db-journal

        • Path /data/data/devidot.apkeditor.mod/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 ad2bf9b04b78225439496a3ddd95c7c8f055d3d377de62c05bb9ec9b8f6eafba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StartApp-d6864f2502af7851

        • Path /data/data/devidot.apkeditor.mod/databases/StartApp-d6864f2502af7851
        • Size 16KB
        • SHA256 36a4146c58fff294cf714b728d75632995a2ed9a9a07fbc536a092bf93880d53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StartApp-d6864f2502af7851-journal

        • Path /data/data/devidot.apkeditor.mod/databases/StartApp-d6864f2502af7851-journal
        • Size 512B
        • SHA256 fb31c317f06628c9248439b7cbbe9e5735de85ba7d733867eb6dc9e023342e83
        • MD5 SHA1 SHA512

        StartApp-d6864f2502af7851-journal

        • Path /data/data/devidot.apkeditor.mod/databases/StartApp-d6864f2502af7851-journal
        • Size 8KB
        • SHA256 165cac274290b0e6bf84ca5bfa7d0823f8068af1c2d70c58a52f736a3a0a372e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StartApp-d6864f2502af7851-journal

        • Path /data/data/devidot.apkeditor.mod/databases/StartApp-d6864f2502af7851-journal
        • Size 8KB
        • SHA256 d8a40b668ddd65a8cad0fb36bcf3a713f684ba9927890a87a88088ace0d66264
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/devidot.apkeditor.mod/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 ae0b6f342f697d66fb967e0be1e80755620e2f9a6808e5df7e55b99530cb10c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/devidot.apkeditor.mod/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 772b1a22a22749412e2d4ab88307b00fc1ef48d5f5cfcd4eb896d777a6290aa9
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/devidot.apkeditor.mod/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 cfa0da16b928925c2d4a533dea2dcf319942e2d21acd35350967f2ef16c74dde
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/devidot.apkeditor.mod/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 ab598c942284875e9172b5f96ad0b4f318abcc3ea56fabb0568f1744be8d5cd9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        stories.db

        • Path /data/data/devidot.apkeditor.mod/databases/stories.db
        • Size 20KB
        • SHA256 95b5da0e4d8e3045bbf68bc8584c0f62c558f0b9b82a13db3b1975b91d029658
        • MD5 SHA1 SHA512 SSDEEP TLSH

        stories.db-journal

        • Path /data/data/devidot.apkeditor.mod/databases/stories.db-journal
        • Size 512B
        • SHA256 034599dcd19fffb6036077bd71a0e72361eebfa261d4dfc9d2870195b3eb768a
        • MD5 SHA1 SHA512

        stories.db-journal

        • Path /data/data/devidot.apkeditor.mod/databases/stories.db-journal
        • Size 8KB
        • SHA256 303ea00d2a77bf33c057f9db97d348409ac94fa90fb25f1d91502ae0198c9501
        • MD5 SHA1 SHA512 SSDEEP TLSH

        stories.db-journal

        • Path /data/data/devidot.apkeditor.mod/databases/stories.db-journal
        • Size 8KB
        • SHA256 f2236fbde8e2edb82568c06f6d273679f3c1e0fc7f9a70a222d337318e07d098
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation606623757486249293tmp

        • Path /data/data/devidot.apkeditor.mod/files/PersistedInstallation606623757486249293tmp
        • Size 90B
        • SHA256 14f123cbf7438a7f67234c3c2092b29704a4c3d271acf2223d7d5d7c4c42aa11
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation6158285359665559887tmp

        • Path /data/data/devidot.apkeditor.mod/files/PersistedInstallation6158285359665559887tmp
        • Size 570B
        • SHA256 56ba4f2aa5d39fb4cb9c8df08b7aa258e69751d90212ce47834637b88e824a49
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/devidot.apkeditor.mod/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/devidot.apkeditor.mod/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 b38de4c4b45830804905869194214145e6088ddef6f9007b0bd0bb6432fc5c83
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/devidot.apkeditor.mod/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/devidot.apkeditor.mod/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 5af4e5ff38636d23e05eca39a4f854a322e308c60aaa0e93ea225b0ecce766d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/devidot.apkeditor.mod/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 3b97614f3639ecef59812482e8b43a1645583322c24ea3026878e695a1ff7109
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/data/devidot.apkeditor.mod/oat/x86_64/[email protected]
        • Size 59KB
        • SHA256 2249c39a9def752cf00d17c2f469446ec6bb96257f30908f21ed2525653de787
        • MD5 SHA1 SHA512 SSDEEP TLSH