Analysis

  • max time kernel
    46s
  • max time network
    65s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260325-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
  • submitted
    07/08/2026, 01:12

General

  • Target
    1719950.apk
  • Size 50.4MB
  • Sample260807-bkv56sysbx
  • SHA256 83c45ef7a55af599225a7b98b8717131fb8cb8aacf499b20552ad27083c3c3f9
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Requests dangerous framework permissions 2 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Processes

  • com.dotemu.neogeo.kof97
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4289
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dotemu.neogeo.kof97/app_container/bemobi-drm-service.apk --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.dotemu.neogeo.kof97/app_container/oat/x86/bemobi-drm-service.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4316

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        bemobi-drm-service.apk

        • Path /data/data/com.dotemu.neogeo.kof97/app_container/bemobi-drm-service.apk
        • Size 1.4MB
        • SHA256 de400d67ac74f6de579482fefb22b09f6071e89a9b165c8d7fc2734554b129d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bemobi-drm-service.apk.tmp

        • Path /data/data/com.dotemu.neogeo.kof97/app_container/bemobi-drm-service.apk.tmp
        • Size 34.4MB
        • SHA256 6d8fc6e6dbd1a24b1bc35a8a31996cb44fc8d1bf4bbc9a4bb52123000cc97fce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bemobi-drm-service.apk.cur.prof

        • Path /data/data/com.dotemu.neogeo.kof97/app_container/oat/bemobi-drm-service.apk.cur.prof
        • Size 1KB
        • SHA256 0ee39d9bfc90c6d4263d60a8926a3aa7c79358d382620bf3806ebd1bcf70146b
        • MD5 SHA1 SHA512 TLSH

        ads.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/ads.png
        • Size 7KB
        • SHA256 f0070a814bafc1d4e56582de551df13124673bdb407b694323fc84ab72452eb6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appsclub_logo.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/appsclub_logo.png
        • Size 3KB
        • SHA256 2baabae625bde1813d75715d5dbb4de514af03e613eb3c9414865769988df370
        • MD5 SHA1 SHA512 TLSH

        billing.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/billing.png
        • Size 7KB
        • SHA256 6e1a7317a10c97bfbfc0fdb62f3841489f753d06ca31188fb5909a4d112d168e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        blocked.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/blocked.png
        • Size 4KB
        • SHA256 0855cc890d5a6579a5bd1874faf20e1d23a2c537dc4128385f03051e8239b3a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        checked-parentalcontrol.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/checked-parentalcontrol.png
        • Size 1KB
        • SHA256 bbc3449a3acfb0eeac4528e1a202f77db1518ce10609dced7060d4e5979d62c1
        • MD5 SHA1 SHA512 TLSH

        checked.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/checked.png
        • Size 1KB
        • SHA256 5be514b266bbddad5982a24a84084cd044133a48fd4a0c5107e371a7eb40234c
        • MD5 SHA1 SHA512 TLSH

        cloudheader.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/cloudheader.png
        • Size 42KB
        • SHA256 95ed84f1147920f37159cd69ada241747659ebb10842fa02f526c3bbd19da10a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default_logo.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/default_logo.png
        • Size 14KB
        • SHA256 5413fed88fb45c5f0de31f1229f4ce3057089cc2c41e8ff43da64135c905968f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gift.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/gift.png
        • Size 5KB
        • SHA256 5becd6760a6f0b93ba30ace255964d25c3e441a779e11561624f0418d5b27a58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        overdue.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/overdue.png
        • Size 5KB
        • SHA256 ba9e3f76228461a20368b182eec73eed02299ec97f53d8c7f9d533228f5211dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        parental.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/parental.png
        • Size 10KB
        • SHA256 5092dbfb46909afe785652455b88893e53f4eed16e4177cc81d4bcec5bdae3cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        progress_indeterminate.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/progress_indeterminate.png
        • Size 3KB
        • SHA256 44d2ab9ad27a33837ac43172baf386ec9f99a3a51b44ef1248af6e9f336ddd5c
        • MD5 SHA1 SHA512 TLSH

        safety.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/safety.png
        • Size 9KB
        • SHA256 7cf07ebb68ab57421985dde3dad262214ff431a974d4db22e21c5b498968be33
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sync.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/sync.png
        • Size 9KB
        • SHA256 602b1a08e321810cd55a460fbcb25aec89f808e3fe9fbe60224d704c64bbf82e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        timeout.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/timeout.png
        • Size 110KB
        • SHA256 013e1c7a81fc042b7cddd73077b11318cd1e98350d1e581154b219871fbe7893
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unchecked-parentalcontrol.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/unchecked-parentalcontrol.png
        • Size 1KB
        • SHA256 b4947c62228ca094669052574e08be8e394dfde05f08197e06c22892c0056b15
        • MD5 SHA1 SHA512 TLSH

        unchecked.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/unchecked.png
        • Size 144B
        • SHA256 967d60cc1e8f3a3759f25cb0c49851b47735f63c9b88401c9923f3a23e7f73e6
        • MD5 SHA1 SHA512 TLSH

        update.png

        • Path /data/data/com.dotemu.neogeo.kof97/app_drm_images/update.png
        • Size 3KB
        • SHA256 44cec954c399e97d976555970d9be7b6b67159ecb2aa913778b69bcd6ffbbbb6
        • MD5 SHA1 SHA512 TLSH

        bemobi-drm-service.apk

        • Path /data/user/0/com.dotemu.neogeo.kof97/app_container/bemobi-drm-service.apk
        • Size 2.3MB
        • SHA256 00d68de6e60916b7d9e2d2b574b6367c7111a6c5afeafe0dfb8039c37729a255
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bemobi-drm-service.apk

        • Path /data/user/0/com.dotemu.neogeo.kof97/app_container/bemobi-drm-service.apk
        • Size 2.3MB
        • SHA256 30ec14bbaebcacb088834452bc01fded41a174174cbbd468f21c897bd46c463d
        • MD5 SHA1 SHA512 SSDEEP TLSH