Analysis
- max time kernel
46s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
10/08/2026, 23:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aviator.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
aviator.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
aviator.apk
Resource
android-x64-arm64-20260325-en
3 signatures
150 seconds
General
- Target aviator.apk
- Size 1.8MB
- Sample260810-27a2ma1clc
- SHA256 839cf0c038811c342d609c840b149682681908e0e29cdaa20631bdf54b9d41b7
- MD5 882d84d9d5c9d256b130a2aae4ef0079
- SHA1 a3c5d11a9f4f99d366c592ce2a66636855194171
- SHA512 be663f40bb0bb237192f3c6ebe4464da75685e11f318806926f49c362621af51df36a8ff293c1c93db4aa2d5e02747de733dc17af1b6f4b1627df45e27e48853
- SSDEEP 49152:izqPGswvl0eifYt73yJORsDfG9f4O/g0O3JGr:iznZvOeiQtfR0fgf4CO3JGr
- TLSH T11F85BE86BF15953FC8B604330BAA527536678D028E839B477588372C6DB76C84F5AFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.tfy.redflight.game - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.tfy.redflight.game - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.tfy.redflight.game - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.tfy.redflight.game - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.tfy.redflight.game
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.tfy.redflight.game/files/profileInstalled
- Size 24B
- SHA256 9c609acab83b30509e4c6f91108ce26f37261f42e437aff5266ad97f8bf7849f
- MD5 5e7a87ff31938d1c56d04b2821055d1b
- SHA1 c491cf37e09e4cdfa7d9ad4e8dc591ce6b6d5279
- SHA512 1cd473aa1fc554bc189e224f2455a7d6442946cfd9e1f4c17b113adeb7f4ccbd958553bb3eda8fe07aec6b6f5a09dca298a50869a886d84fbc6d1c8c80db388f
- MD5 SHA1 SHA512
- Path /data/data/com.tfy.redflight.game/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 f0b3579abc9fe9c3cd19132ca01a5249cf005b9d47e72488e8fa55e46e0ed91c
- MD5 d65ae0b6319742d7c699270930b4eb57
- SHA1 20a67bdcd1df29bc5c30ffe5e3517cb33a4b934c
- SHA512 0d73490507ca99c43f7b21988303630ec6383fd2a2ce3cdef5b1b42bec7239b5fdae3e8236dd8dcd4a343c67f3b464f172385c7648a9ec5aa9dbd3016a621851
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.tfy.redflight.game/primary.prof
- Size 1KB
- SHA256 03954bef55aace839d86caa939b4637ea1e76bacfe24fd4e69e248b4630f5d29
- MD5 63007bf205e95aa236bd61aae0d0b668
- SHA1 b9253a1d8c9e92d1ad1c52ff6b544ba9acba93cc
- SHA512 c7730a17c22d59b08d277407f26d9724cbd4a699bc4fa744f26d8caefcd96a9679125658a3834e4455c562e84a024a3678a5b5bc95d953c04f7c0bfa2412f3bd
- TLSH T1D52163264556EBA30D70003C802C57A5068A55F7A8ABD6F34D20609A8FA54D68BC6AD1
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/com.tfy.redflight.game/primary.prof
- Size 2KB
- SHA256 3fbe22f1d3c00ccd09dd2c0a021c080e260fc20e5f9a357d328754e58534e26d
- MD5 99150f7b08acddb1a8aeaae475cf63bf
- SHA1 505cb4f9af48553e874bc906cef88d449ffa54a4
- SHA512 234ed95a051fd58236ac655b5d19d19abafab4e248ee05a582ce17e73ca22ecba88f9399150ff857bb4b075a389e74b99be1ac81e9aac7e84d66938584ac6a27
- TLSH T157411814AAB109B1B88BD0125E11B79BC4B6E3678111A4F534B9FABC5F0CBC4B74D02A
- MD5 SHA1 SHA512 TLSH