Analysis
- max time kernel
6s - max time network
150s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
06/08/2026, 23:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
among-us-v2026.6.5-mod1.apk
Resource
android-x64-20260325-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
among-us-v2026.6.5-mod1.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
among-us-v2026.6.5-mod1.apk
Resource
android-33-x64-arm64-20260708-en
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
among-us-v2026.6.5-mod1.apk
Resource
android-x86-arm-20260325-en
0 signatures
150 seconds
General
- Target among-us-v2026.6.5-mod1.apk
- Size 789.2MB
- Sample260806-3w5brsch82
- SHA256 8ee5d77e3c7bde5e6c66282b170bae411d5e62ab9b4027c83872d48ba7c952d6
- MD5 5fcec11bdd2bb1fd094fc1f2de0f2b38
- SHA1 e71fa3c4bbd922dad3e9073e4dc663a3695d4497
- SHA512 1eb2ce1b47e8f08ec48ea2bb7fde7176b6cd085fba7efc81ae4ef54799ffaf0b2aed0782ac0b13d90f2ef730fbdd0d19285da8d9cd0466abc7a33ae33074d39c
- SSDEEP 25165824:spEgBQ6C68jaqWtDU6R4WH2aTG4zXPgOt/84oLNmadFiI8:spEgBQ6C68jX0U6R4WH2aTGIXPgOt/8C
- TLSH T1478923B7718DCE75C5F57232D0AB1B3F66F74C80AA6A6A0C8625BA1F3DBB3401616311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 9 IoCs
ioc Process /system/bin/su com.innersloth.spacemafia /system/xbin/su com.innersloth.spacemafia /data/local/bin/su com.innersloth.spacemafia /system/sd/xbin/su com.innersloth.spacemafia /data/local/su com.innersloth.spacemafia /sbin/su com.innersloth.spacemafia /data/local/xbin/su com.innersloth.spacemafia /system/app/Superuser.apk com.innersloth.spacemafia /system/bin/failsafe/su com.innersloth.spacemafia - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.innersloth.spacemafia - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.innersloth.spacemafia - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.innersloth.spacemafia
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.innersloth.spacemafia/cache/sentry/3de791eea532dea0cb141d1c225eff15c977e5bc/.options-cache/environment.json
- Size 12B
- SHA256 80be2eb0944c0453a6ad339a56e1c8f39f8cc57a4e627758246ccfd274176fd8
- MD5 dedcf97dec548910cc8edae172ab5bec
- SHA1 a37f222f2a89b4098cf681951ee75d76bd1f75e5
- SHA512 5e0d2b9be27ce24d6baa109ec8b2cb7e7ed3deb5622bd87ea621428857a8b8cbda98871552eb7e26df145485e83b2b3397cdbeaa4d806e955b4eeafb4a85d13a
- MD5 SHA1 SHA512
- Path /data/data/com.innersloth.spacemafia/cache/sentry/3de791eea532dea0cb141d1c225eff15c977e5bc/.options-cache/release.json
- Size 19B
- SHA256 c88c07fe356883971de5f2edf1484c9dd174fbb7cd0e50343079aec2682a2b0b
- MD5 49cb63b5088b04f06fbaefe03bea03eb
- SHA1 f7bd4bd085165a7b28f2c4206fea6645ad9094b9
- SHA512 e249601b03fba8f2f80e46f897dd43449f171c15f64ab77fc29048e7fcc658440fa1782abbeeacdb7127d72d5126fcc14efc9a19056f9df75083c24a397e78ce
- MD5 SHA1 SHA512
- Path /data/data/com.innersloth.spacemafia/cache/sentry/3de791eea532dea0cb141d1c225eff15c977e5bc/.options-cache/sdk-version.json
- Size 444B
- SHA256 fbc6c9daaa1f227878b3571634753cd31226212bfcbfb6c611501b7a07490ba2
- MD5 ac734577c7ce15d2550d480f6ec780dc
- SHA1 024e120a48bce765caf6de4990f2be77429807e9
- SHA512 7d987dc46c69a4c10e9b45240d0fa5340aa083b1c6ec60d186894d7d20bfc29ae6c67d611677700e225ac72545af0cea498b30ae85ca4e70f43792d221298d0c
- TLSH T1A1F0E5D851BD4FB686FD0F3CAA166C88A7FADA9351DA87830C829B13235445D8062087
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.innersloth.spacemafia/cache/sentry/3de791eea532dea0cb141d1c225eff15c977e5bc/.options-cache/tags.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path /data/data/com.innersloth.spacemafia/cache/sentry/3de791eea532dea0cb141d1c225eff15c977e5bc/.scope-cache/breadcrumbs.json
- Size 4KB
- SHA256 e9d9a0137b52ae19fc2eae0e5e70cbacd5df94d48d5fdc04dd4452d142ac82e0
- MD5 e4a14f370fb612ca3f8198fabee1f8a2
- SHA1 b3c3c4819cfc8ce9b909e116acc28f13af044115
- SHA512 8ec07d5e9c4e82b1558f3636480ecd2a64f87b7e3a8670a53aa2cc6e415403dd910094bcfcfd37671c14ca90a7d49836fe8b7a4df036d4117f82c3cc6f3ce085
- MD5 SHA1 SHA512
- Path /data/data/com.innersloth.spacemafia/cache/sentry/3de791eea532dea0cb141d1c225eff15c977e5bc/.scope-cache/breadcrumbs.json.tmp
- Size 12B
- SHA256 ae1afdb53fc94d62b6862659f839a20634382b65a7354f32b5e81cd29fb4270d
- MD5 305870f2c91f74c396d515743715455b
- SHA1 0524908ae61945d6241f026caf17aa195d66f06a
- SHA512 1456b4dc0cebb87b18007e4fce0a8a68b41434eed0cf9965c6a1e002e2072b00596a4bcd64cc2a8ae8cd0cfb74f295fd838e67ef9f8bd4555afda2ea40d7a4fa
- MD5 SHA1 SHA512
- Path /data/data/com.innersloth.spacemafia/files/INSTALLATION
- Size 32B
- SHA256 30198555a8c57e8f509bc405da8af24a131f3ad24a89433b378a22821a40738e
- MD5 3a172c5b4c30fac89e04f2c545a922ea
- SHA1 e8f190b647fe4f5741d73b24ff781f8d8fb8077b
- SHA512 4564459035e098d5e2d978d0c467b7ebc066e4b51ad71f4ef3db645f2676725f29570c55b415ee1419235e618db1a158dc4aabf77c886c9975fc995d6a99df4b
- MD5 SHA1 SHA512
- Path /data/data/com.innersloth.spacemafia/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
- MD5 7e858c4054eb00fcddc653a04e5cd1c6
- SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
- SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
- TLSH T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.innersloth.spacemafia/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 788f839cbd7fedf44075f576c1b0b0426e57ab9e19410ed00d3b68c541245ab1
- MD5 fde5cd30beb8c25a8590c221f6812990
- SHA1 8ce6dde0ee4eb0ac03994eb9a968edec59550ad5
- SHA512 6bfbf93b4c369ba1185af381acd3a63d37d1a63aa6bb75499885e89e7cccc55f49f0de1dd616afbd0a4c68c64c06068283b40d18cb4bc015373a63f6b29b515a
- MD5 SHA1 SHA512
- Path /data/data/com.innersloth.spacemafia/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.innersloth.spacemafia/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 3f113a949285dec994aa7281d937472a39bafdffcbd7843e2e679ca93a5730b2
- MD5 134cdba4f2f5591273cdb20f809b5470
- SHA1 0b5dfae792820ff90aa7c6a518d2ea3eb6c586f5
- SHA512 6d26b3014b1534c08d53f8c9a421d2dac82cc654bc259f7cdd6c2af5fbffa6b7fc1decd407ddc097091c029048916ff4a3d40cb268d222a9d2bc43448091b911
- SSDEEP 6:Karv8n9kv9FZde/kPlOERX4PBX4ogLugMBX4suuK+/GRvq9evRjgOw2:KS8n2lzdeWRmBEyPbP/HFOw2
- TLSH T12C72C29E97400A92E0CDE37258A4C3800F60D639A35ACB07A2A318517C827CAA160D0C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.innersloth.spacemafia/no_backup/androidx.work.workdb-wal
- Size 108KB
- SHA256 1c5134f8d54bd579c40f29f081763671842bbba97e3ff37aa1ccfb9459b96d96
- MD5 b3d5e516760764bd8516d9ba21d3cbaa
- SHA1 d80672ea7010140791e919c9e58d7d644b7eef3a
- SHA512 9a735611b72710632041654e01343c58520787764b6bcf49cd1e60b428d5df44db5866157eb7351b7beb376b8464454f8f447706efac51a02b340d444088a8ae
- SSDEEP 48:mFY66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI9B:k6+hdjnHtDRMpf8UzS6+BD8q0ExP30
- TLSH T1EBB3FF4F0F192540C4DDB8F0A5E00FA1793E852EC797E3E169914075AEC6932DA29CFE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /proc/5014/timerslack_ns
- Size 8B
- SHA256 2ddb67b8a8c259ffaff61a5abdd38f5b5d6f1c6e2af4344c85b17b77af2451cc
- MD5 d46bf94e9eb1d22281a71504685082ac
- SHA1 e4e0629aef7425ba63e897bc471f8625de44edd3
- SHA512 68a1a1fd4de784e3a2e0e956d0a63ac4ca540ef90e7fd9a2ddc92cf68e52e29792db64f6615054a6e5460467f0b7abe055c899136d98ce6ebab3d580bc55ec86
- MD5 SHA1 SHA512