a18f5428e7da2283b4830473e61c16d43ffe275f9d30dca43f54cb269e1e4c6a

Analysis

max time kernel
31s
max time network
90s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
04/08/2026, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
devidot.apkeditor.mod_2.0.0.apk
Size 16.8MB
Sample260804-cnsd5abd57
SHA256 a18f5428e7da2283b4830473e61c16d43ffe275f9d30dca43f54cb269e1e4c6a
MD5 a958843300a0e589da284e58d3fa9dc9
SHA1 8552b97ee971ffa98beec16724c19073e42098d7
SHA512 1075d832a2efaf01fbf6610900bf5aadf250ee0d03cbdeb7bbaf1218413b02d68da5ba7a561095ddf146b32a7b8e73fe5885af73759e50ceeaecca66028897f2
SSDEEP 393216:6PSMyCXtPfYFAZrszxh/2cWIH4oPgWbei1qHM:6PSvCXtIue/2cWIHpDbeiAHM
TLSH
T1FD071287FB5CD92EC8779032CA660233B1AE9E518A4397737519730C28B39D88F65BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/data/local/bin/su	devidot.apkeditor.mod
/sbin/su	devidot.apkeditor.mod
/system/bin/su	devidot.apkeditor.mod
/system/bin/failsafe/su	devidot.apkeditor.mod
/system/xbin/su	devidot.apkeditor.mod
/data/local/xbin/su	devidot.apkeditor.mod
/system/sd/xbin/su	devidot.apkeditor.mod
/data/local/su	devidot.apkeditor.mod

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

defense_evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	devidot.apkeditor.mod
/dev/qemu_pipe	devidot.apkeditor.mod

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/devidot.apkeditor.mod/files/audience_network.dex	4413	devidot.apkeditor.mod
/data/user/0/devidot.apkeditor.mod/files/audience_network.dex	4647	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/devidot.apkeditor.mod/files/audience_network.dex --output-vdex-fd=180 --oat-fd=181 --oat-location=/data/user/0/devidot.apkeditor.mod/files/oat/x86/audience_network.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/devidot.apkeditor.mod/files/audience_network.dex	4413	devidot.apkeditor.mod

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	devidot.apkeditor.mod

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	devidot.apkeditor.mod

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	devidot.apkeditor.mod

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	devidot.apkeditor.mod

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	devidot.apkeditor.mod

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	devidot.apkeditor.mod

devidot.apkeditor.mod
1⤵
- Checks if the Android device is rooted.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4413
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/devidot.apkeditor.mod/files/audience_network.dex --output-vdex-fd=180 --oat-fd=181 --oat-location=/data/user/0/devidot.apkeditor.mod/files/oat/x86/audience_network.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4647

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db-journal

Path /data/data/devidot.apkeditor.mod/databases/OneSignal.db-journal
Size 512B
SHA256 de3c3791db93a3d1540fd0623e35d2b5ee1def656acf4e015c1fa5edc27fd99a
MD5 0f27608f85afeb4faba942338e59b888
SHA1 da597c07aa887f60a750144b246873525a12d221
SHA512 9e0c380e127595681febd924ab00293a3d4166a90e0aaf4a6143d03c60800f75034df4df4081beb5252031003e1c8c6c23f9cca18d2d2f6bd9772c2781e6ede5
MD5 SHA1 SHA512

Submit Download

OneSignal.db-wal

Path /data/data/devidot.apkeditor.mod/databases/OneSignal.db-wal
Size 64KB
SHA256 cd11b7369297284434be610eebb4f8e3328df92b5c6ac8a801a039707a9302d8
MD5 5b5c0baeb1043a00e5a650e8fd9d469f
SHA1 0a12900993681425c0b8d553605d4c9d01df0269
SHA512 47daac551967b8f3e3793c1f7570fb238c2f09dac5cb9fbca3335c156dfb1a68eac3a9c6e256c1694e7aebde8267d5107ddb1e5d634c51ad4bdf1bd45fe0a392
SSDEEP 48:4zNSP/ooc1qUCrQcrA0oJtqracrObMoOSP/hLIY6oVl:I0PC8oDrbxrPqYdl
TLSH
T10153D8CF47863291EBE651B3108242E49F7FA10EC9538BA72BB620645D42B1DD3A3C28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartApp-d6864f2502af7851-journal

Path /data/data/devidot.apkeditor.mod/databases/StartApp-d6864f2502af7851-journal
Size 512B
SHA256 e90816c4b50b3b6a05468c48601d16bfb88af7926e07b3044a58410830d4a94f
MD5 4199c79f0777a4f9dde0166e6510a51d
SHA1 7de4cd7a5e3c4ce5caa3c0f5319aea1ce39aa797
SHA512 73e3d549f217c7cf68d97bf3fc97d7b50e1f89800146ce61e395224431f124df2fd6801eb555742da4dda733558ac25bde3bc95a14a88b472c450d1a1df8bfbb
MD5 SHA1 SHA512

Submit Download

StartApp-d6864f2502af7851-wal

Path /data/data/devidot.apkeditor.mod/databases/StartApp-d6864f2502af7851-wal
Size 36KB
SHA256 1d93217ec8cfb47ff131a2290a60076da6a4571bb7b63b9bffdbd93c8a7a7e25
MD5 7b1600ebd1171efd07be85a643ad658a
SHA1 0009be65fd0137c70389943bc906e89a8afad2f9
SHA512 e796fc5b8c25e5a8caf03bdcc276f5aa10c0728e5e0e73bb37b13873cfb531214ed096acafff9e453590ba5addac04c1f76f03b264ad3c5c40e71df3283aeb7e
SSDEEP 24:KslzyGSP/LpBHcaZ8ltO0iMncvJRAFyz8b818MM4k0GSP/vo5pbvzx:rlzNSP/Ln8lpn6cFyzgcBgSP/gvl
TLSH
T1F2F2DD8D5B803746C0554273AAE283572EFC72BD0B52530E257048F56C63B26A6B1EA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/devidot.apkeditor.mod/databases/com.google.android.datatransport.events
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/devidot.apkeditor.mod/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 1c464da32a26134de6d459b5623876511a54e2b87bc2fa0bf2f4a2a5718e0262
MD5 496754927ad19182238820531a6bdd6f
SHA1 0903b2829e5d41c7421cf2b9d0ff45480349fd4c
SHA512 c200fa51f68b802d04b1f9072a26a560d726beb05268fc1034494fbf09c3c23c1bc794f156e6be411f0cd6b52f77cf275758527e7aba2cd33ae1ed685a5f2ace
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-shm

Path /data/data/devidot.apkeditor.mod/databases/com.google.android.datatransport.events-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-wal

Path /data/data/devidot.apkeditor.mod/databases/com.google.android.datatransport.events-wal
Size 68KB
SHA256 f5e78144131d163cb900334e02fceec9cd16604f3bd5d7a8ca6dd2ebfd7a273c
MD5 6eb58323e6aa61a0cc774dc844b8ec86
SHA1 3a33b78d26fe45c90548a0656fc88640197c0a6b
SHA512 876ed360fed8b41918d53a0bc2b26b4372ea6e330b5a63710f2f6e3f59026f82e4995d8c113f478fcd180d2b39dcd7ce5acc92b6ce2ef2026f5435361beae86b
SSDEEP 48:xzNSP/123+1g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSP/AVc5ro1:F0PdyMEX0wIyNjaPIIro1
TLSH
T16A63415D9A2C5621C17D143ED3E543732E7CD39F573383623A908CF9BEC21687025959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/devidot.apkeditor.mod/databases/google_app_measurement_local.db
Size 16KB
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
SSDEEP 6:l9FCls1ulO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TgEu9zmzrfRmBEyPbBvOwk3
TLSH
T16772C2CE9F102647C6660377B4CAE3916DA4A12D872BEB472BA50464AE42609A861F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/devidot.apkeditor.mod/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d385070d6113f096d088b8017f6c111ad752563bfbca6882d5860b3d10105d3
MD5 6cd4dc36a5715e693ebd3f2c8be96134
SHA1 63ff230ff0fd2d8e17d5ff67bc29ceee4d63bfc2
SHA512 36031025bf7ab7b25cc976218af8759794726897e083500b09930b5be8b1ca5021f9feff6b17bbd91fd69fd1e7d7f2516041faf79c5cfec8de525e327cb290e5
SSDEEP 3:qqb/NjghzY+/lzyliMlTXmFcc/lwllQzMlklKllgIn:LCM+/lulvl6zGSQlrf
TLSH
T10A7212C23391C702F1378739528BA7F21430B3803F02D11A7805531C5C853C11E3632B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/devidot.apkeditor.mod/databases/google_app_measurement_local.db
Size 16KB
SHA256 91e5aed8eb4942011f81c3b02a9771c57a9b1d49dfa4e33aa6a08f6d4ed81180
MD5 3201db7d51986cf77d3ebfa282422f26
SHA1 bac7c26bbef6f14f541d011f1ff978bbaeb5a8d7
SHA512 dc23ad4f05f75e8c4d7c07b2f2677f4a1e665f287cc4c30e449560d0a56c26a800cec90e5df8593b0b583c127377ec03e660a4401dc98e5daf656956e1a084b7
SSDEEP 6:rLP/gEhV71m/9blDqlrElvlKQlr2JzCM+/lulvl6zGSQlrf:rr/gW49blqYFlhk+/0Fl6q7
TLSH
T1BD725ED23B64C702F6274B3851CBE2D1203972521B03E1157806AB1C188A3C20935707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/devidot.apkeditor.mod/databases/google_app_measurement_local.db
Size 16KB
SHA256 f34004a5805efdf295609dc3c122395fd91c85b16db352f66a676d5dd5c84805
MD5 514b8d51be864e757ee0cb5d58633514
SHA1 a9c11bd03a031bfe5b2dbf96e9f9dfe8b75fb4bd
SHA512 1489363732e90272b5bdcec5252d66bfcbf700ac017543c4c9b7ead66e4654652b8a7641f585a16e8acb1db9e5814506e5dd641b34746b83b0eaf75fb6895962
SSDEEP 12:7RhOLavnOAU7wU7UyWlaXG4tf49blqYFlhk+/0Fl6q7:VhKamNZ2Kbtf499FIlFj
TLSH
T1947292D276B8CA12F2774E3C42DBE6D2303971A31B13E2227C06AB0C19867938531707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/devidot.apkeditor.mod/databases/google_app_measurement_local.db
Size 16KB
SHA256 a51f78b1f8f678f5e60aa8356e49a0cae2ee2110c5369fb35cc37f8df97016d4
MD5 2776ac27b861a6f8f73d470dce654b8a
SHA1 bbbedba9c8ee0653cce29ce50ccc7f44b7261463
SHA512 16cab377adbf061e330c8e9823caf1ac0f24d355644c541f872651c009f7644eb23523ec3cc5a755de6cb3f72bd5560c1b78012606dcb3f723a08ff1bc8742e1
SSDEEP 12:WDRhOLavnOAU7wU7UyWlaXG4tf49blqYFlhk+/0Fl6qv:W9hKamNZ2Kbtf499FIlFH
TLSH
T1A8726DD6B6B8CA12F2774E3C42DBE6C2243A71A31B13E2227C06AB0C19423938531707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/devidot.apkeditor.mod/databases/google_app_measurement_local.db
Size 16KB
SHA256 82561f2414a061fb1151f505c883b3890c63e28bdad0535b6e89eeea0365c139
MD5 6626783af72a0ccdceace420b7e7e50f
SHA1 b902a217ee0cf292c54c17e85c1ae8d11fa8812a
SHA512 793d8e1373c1818fa8baed46f4c2981b29cf2826935602efb825924cfa6534765f0204a7f9217fc87f5d82787e059cc97a2a1e935fe02183f116fbfc0487776b
SSDEEP 3:o1H//XGlX:oG
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/devidot.apkeditor.mod/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 5bf75467db87b7ed7ebf38e8d6ea1585a65e039130428c5dd9ffc1062ed1ebe5
MD5 e7cb7912be9b0c7e9988b36c1e53db83
SHA1 021d287710731b00e14b6f4c50b151691132dcdd
SHA512 d26da95a9ddd4d587de6ea783398b446f783cd9cd7ae58e7a64afd5701cb03111a759d6d128a2b32ef4a355a8a485467315f429a7bcd8e9ef5666db82cb041ee
MD5 SHA1 SHA512

Submit Download