General
- Target 7aa5119bd63999655bd48ecde33ba601f4992e94e6c704e705ce87b22d2ac521.apk
- Size 7.6MB
- Sample260807-pl5b5adq8v
- SHA256 7aa5119bd63999655bd48ecde33ba601f4992e94e6c704e705ce87b22d2ac521
- MD5 f44aaea399ab073c5a2898fc3e2e11c2
- SHA1 5652e7ee1dcfba935c8618cfb660595e9381c193
- SHA512 b9399a49bb1b22b5ac32143b0faa66f5c2092f6824c22e59c22fe06f7d39b9f1844c813bf130650257d8371cf87379d52918324056f665c7d71c70b2923936a0
- SSDEEP 98304:K/dzbV0Sjsiv0iFvP+wgbl/RmSf233/39VXzro3uusu/vcK+6ir3hZ/A3XgY+VmC:qX4iv9+wg7mX/asG+xr3xx9wK3L
- TLSH T1EE861248BF08952EC9BB11320F5B4772769A9D5A8F829347A648371C2C376EC8F59FD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
7aa5119bd63999655bd48ecde33ba601f4992e94e6c704e705ce87b22d2ac521.apk
Resource
android-35-x64-arm64-20260325-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 7aa5119bd63999655bd48ecde33ba601f4992e94e6c704e705ce87b22d2ac521.apk
- Size 7.6MB
- SHA256 7aa5119bd63999655bd48ecde33ba601f4992e94e6c704e705ce87b22d2ac521
- MD5 f44aaea399ab073c5a2898fc3e2e11c2
- SHA1 5652e7ee1dcfba935c8618cfb660595e9381c193
- SHA512 b9399a49bb1b22b5ac32143b0faa66f5c2092f6824c22e59c22fe06f7d39b9f1844c813bf130650257d8371cf87379d52918324056f665c7d71c70b2923936a0
- SSDEEP 98304:K/dzbV0Sjsiv0iFvP+wgbl/RmSf233/39VXzro3uusu/vcK+6ir3hZ/A3XgY+VmC:qX4iv9+wg7mX/asG+xr3xx9wK3L
- TLSH T1EE861248BF08952EC9BB11320F5B4772769A9D5A8F829347A648371C2C376EC8F59FD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Family: Rokarolla
Rokarolla is an Android banking trojan first seen in 2026.
-
Checks if the Android device is rooted.
-
Checks known Qemu pipes.
Checks for known pipes used by the Android emulator to communicate with the host.
-
Queries information about active data network
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Checks the presence of a debugger