Analysis

  • max time kernel
    6s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    06/08/2026, 23:52

General

  • Target
    among-us-v2026.6.5-mod1.apk
  • Size 789.2MB
  • Sample260806-3w5brsch82
  • SHA256 8ee5d77e3c7bde5e6c66282b170bae411d5e62ab9b4027c83872d48ba7c952d6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.innersloth.spacemafia
    1⤵
    • Checks if the Android device is rooted.
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4774

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        environment.json

        • Path /data/data/com.innersloth.spacemafia/cache/sentry/3de791eea532dea0cb141d1c225eff15c977e5bc/.options-cache/environment.json
        • Size 12B
        • SHA256 80be2eb0944c0453a6ad339a56e1c8f39f8cc57a4e627758246ccfd274176fd8
        • MD5 SHA1 SHA512

        release.json

        • Path /data/data/com.innersloth.spacemafia/cache/sentry/3de791eea532dea0cb141d1c225eff15c977e5bc/.options-cache/release.json
        • Size 19B
        • SHA256 c88c07fe356883971de5f2edf1484c9dd174fbb7cd0e50343079aec2682a2b0b
        • MD5 SHA1 SHA512

        sdk-version.json

        • Path /data/data/com.innersloth.spacemafia/cache/sentry/3de791eea532dea0cb141d1c225eff15c977e5bc/.options-cache/sdk-version.json
        • Size 444B
        • SHA256 fbc6c9daaa1f227878b3571634753cd31226212bfcbfb6c611501b7a07490ba2
        • MD5 SHA1 SHA512 TLSH

        tags.json

        • Path /data/data/com.innersloth.spacemafia/cache/sentry/3de791eea532dea0cb141d1c225eff15c977e5bc/.options-cache/tags.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512

        breadcrumbs.json

        • Path /data/data/com.innersloth.spacemafia/cache/sentry/3de791eea532dea0cb141d1c225eff15c977e5bc/.scope-cache/breadcrumbs.json
        • Size 4KB
        • SHA256 e9d9a0137b52ae19fc2eae0e5e70cbacd5df94d48d5fdc04dd4452d142ac82e0
        • MD5 SHA1 SHA512

        breadcrumbs.json.tmp

        • Path /data/data/com.innersloth.spacemafia/cache/sentry/3de791eea532dea0cb141d1c225eff15c977e5bc/.scope-cache/breadcrumbs.json.tmp
        • Size 12B
        • SHA256 ae1afdb53fc94d62b6862659f839a20634382b65a7354f32b5e81cd29fb4270d
        • MD5 SHA1 SHA512

        INSTALLATION

        • Path /data/data/com.innersloth.spacemafia/files/INSTALLATION
        • Size 32B
        • SHA256 30198555a8c57e8f509bc405da8af24a131f3ad24a89433b378a22821a40738e
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.innersloth.spacemafia/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.innersloth.spacemafia/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 788f839cbd7fedf44075f576c1b0b0426e57ab9e19410ed00d3b68c541245ab1
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.innersloth.spacemafia/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.innersloth.spacemafia/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 3f113a949285dec994aa7281d937472a39bafdffcbd7843e2e679ca93a5730b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.innersloth.spacemafia/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 1c5134f8d54bd579c40f29f081763671842bbba97e3ff37aa1ccfb9459b96d96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        timerslack_ns

        • Path /proc/5014/timerslack_ns
        • Size 8B
        • SHA256 2ddb67b8a8c259ffaff61a5abdd38f5b5d6f1c6e2af4344c85b17b77af2451cc
        • MD5 SHA1 SHA512