Analysis
- user interaction
yes - max time kernel
45s - max time network
44s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
08/08/2026, 22:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Moonlit.apk
Resource
android-x86-arm-20260325-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Moonlit.apk
Resource
android-x64-20260325-en
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Moonlit.apk
Resource
android-x64-arm64-20260325-en
0 signatures
150 seconds
General
- Target Moonlit.apk
- Size 137KB
- Sample260808-2ttltafg23
- SHA256 9a07ecb2b7eae19319115ec8cd9ffc9bfc4bd5fc89e9a4f06800ec3ed4321c18
- MD5 128cb99fc93971a913ca2b8b4e9073f5
- SHA1 1c4ae5f8bdb5f11fd05133b1a6299b7439e5fe80
- SHA512 5265f11d34e6e02fbe73f5cbfcf9a8993cbf8bc50dc80acc66aac2fe476b26226768b33a1da9a5b205c1b07ac913ae21b26b41dab08f861f84a7cdcdbe2e7cbc
- SSDEEP 1536:eOo7VGW4ROGqFEClc2JOUXxC4KWIi47rLmrayDF4MsV5xzwkbaFsa54tS9G91Hu9:0GROG8bDJO4Afr/FyDFZs5EmRuFB/DR
- TLSH T150D38D42F6A0AE91FE2F8335B8978312233BD9967303DB231695E5767D833C48752B81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground dev.moonlit.quest - Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener dev.moonlit.quest - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver dev.moonlit.quest
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/dev.moonlit.quest/files/adb_priv.key
- Size 1KB
- SHA256 0900af5a8511fc11d9fdd3b7ecc35eb63ce7a004ee0fce313afa74f37937d1f3
- MD5 b460bdd10ebe1e0ed36f6e9c4b612ad4
- SHA1 10f147ccbf81ec081c4d49c64deb36fbc1ae2409
- SHA512 abbc3eda1e733d6df29017e8d53821f21d211ca5d500b69aeda65ed465d056039abe049b181c9491af06bfcb3351e9cacdd277056487b08dfd268e09e902a29a
- TLSH T1A921B768BB8EC82AACA5CC73F51738C52254E7EF3162D259C4591B1D4290B50608EE53
- MD5 SHA1 SHA512 TLSH
- Path /data/data/dev.moonlit.quest/files/adb_pub.key
- Size 294B
- SHA256 9be9aa3849742deb013ba490958bb79efd977f54ef06fc43c510c0894612d774
- MD5 111209d66e2a23251752185b01e57dc9
- SHA1 36848d652e7b911807cd6321fdd339916f56f385
- SHA512 ff2d45215fe2ce2f8e5c54c91ac41bf95f55f2456f7bffbe039444bba6b728704cfce984204c04a775ad290413f6f60656a0a3bdb6a547fa67f75b3c29ca0366
- TLSH T1D5E0E734FF88A4011993CDBD3707D8073042F71759D1C07504191B595952B4090C85BD
- MD5 SHA1 SHA512 TLSH