Analysis
- max time kernel
112s - max time network
153s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
08/08/2026, 12:26
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Teen-Patti-Vungo.apk
Resource
android-x86-arm-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Teen-Patti-Vungo.apk
Resource
android-x64-20260325-en
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
Teen-Patti-Vungo.apk
Resource
android-x64-arm64-20260325-en
6 signatures
150 seconds
General
- Target Teen-Patti-Vungo.apk
- Size 716KB
- Sample260808-pmhvhsfk6v
- SHA256 183949a6041d4e38badce369679d8fc4382df43e561e3fe06cae1fc3115e1b3f
- MD5 d2ae49b035e09564aad04df4862d3337
- SHA1 46d814ab658327238f26b767cd92725b5faacddd
- SHA512 5e3f9bb27182a5f17b0226dc854c465b16ae853a2fc011d7fc538a2f569b614b876eeeef096053e669702df6b9cbd046d626c6918c72c99fb74419b8952d6e84
- SSDEEP 12288:d9+hDLrMhdr0UbaYtYmgIBC4qd+PVuLAhbTCdQmHNHHbn+G0m8a3OicXq81Oy0u6:d9Czgd3Ymgn+eObTCdDNL0m1WP14lB
- TLSH T1B7F423D2F741C878D4B64671BDD42372BF8B2C886930BA2B9220BADC1D3325757856DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.oneceo.game - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.oneceo.game - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.oneceo.game - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.oneceo.game - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.oneceo.game - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.oneceo.game - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.oneceo.game - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.oneceo.game
Processes
-
com.oneceo.game1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5043
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.oneceo.game/cache/.oneceo_system_cache_marker
- Size 7B
- SHA256 406effb1e9c59672c66a598c2b21e331b23b16c54024e96d6df3e7c173549791
- MD5 e2fa538867c3830a859a5b17ab24644b
- SHA1 21c50805b553b7a40e48394a5d77d442587ddee2
- SHA512 96bef095b19c37687474c8191386ae0085da4a6e2ad8ed64851f8fa4e4a6820abffa559a1034b16062f88e2b7cdd1012ee545f2afb6ca0cf5b4d16ccd18a6ee2
- MD5 SHA1 SHA512
- Path /data/data/com.oneceo.game/files/PersistedInstallation6336517450789011322tmp
- Size 568B
- SHA256 e7548e1b16d3378ca8739c269b2091286fdd24c82b3db1a3a4949c4d1747e811
- MD5 0dbbcf75f221c996fb09f6680bcda25b
- SHA1 91ba7f45fe79f0813d316a3ef4b1b806d0a837f9
- SHA512 32721e9961d383aa3044bae3431e9fc7bdd2c29edc611e02d29960fffd8a677fc2cf76d6ca761788059061387864974a00fd6512a6c47ea956556030e5ee8e50
- TLSH T13BF041575B58010AA4A7F983229C3C104C380D956E164EA47F8E501144F49E7810F580
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.oneceo.game/files/PersistedInstallation7921713387007067663tmp
- Size 90B
- SHA256 8a7a71d8c22dc73a1c6418af0be41c875acc5db8c5658d9fe8701c0d40f4004e
- MD5 a860b2c51098a0a24a7ac2d796fab93a
- SHA1 70a2d2b0b10d231c38d2d40e38897a6e75bd066d
- SHA512 5bd991f7290f74c6db7d8b6d0e2ead7fd53fbe38fef56e366599ae4e3b6318f28da2be0141be3c1e6f5be7e041a8754187ac2c5fc4b7df8173f11726c4e569f7
- TLSH T12CB01200CE39C3669585F2021D4DD5406D9028441D099B590E0DE08142D11D081039D9
- MD5 SHA1 SHA512 TLSH