Analysis

  • max time kernel
    3s
  • max time network
    155s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260708-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
  • submitted
    11/08/2026, 22:24

General

  • Target
    Roblox.Arceus.X.NEO.2.3.0 (1).apk
  • Size 135.5MB
  • Sample260811-2blhgstamd
  • SHA256 6fd04e99a555b9b7e63d6b1d30346897a3986a0924e0cb75f3f0f2ae41d8008a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 25 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.roblox.client
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Checks CPU information
    PID:4184

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        framework-adservices.jar

        • Path /apex/com.android.adservices/javalib/framework-adservices.jar
        • Size 25KB
        • SHA256 ebf554eca9585be7cc99314e35c844d481ab811456055a1127b3df4641cf2ffb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-sdksandbox.jar

        • Path /apex/com.android.adservices/javalib/framework-sdksandbox.jar
        • Size 11KB
        • SHA256 e71199d47af29d61859792529bfee051ebb23b92747d57e402d6af30c8d2a9c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-appsearch.jar

        • Path /apex/com.android.appsearch/javalib/framework-appsearch.jar
        • Size 145KB
        • SHA256 a77cfbc9d66d3fde22540b2e6a5bee8ce21dbeb3f66c0d9121764513188252f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apache-xml.jar

        • Path /apex/com.android.art/javalib/apache-xml.jar
        • Size 1.2MB
        • SHA256 a592316ce171525b731179a84d91a1f7824d5e7c2c6f713d038163a95f7f3626
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bouncycastle.jar

        • Path /apex/com.android.art/javalib/bouncycastle.jar
        • Size 1.4MB
        • SHA256 b12a49fda7dec105cac09b6d77b083d37b1be5d52f4f265790f2e348e5783f06
        • MD5 SHA1 SHA512 SSDEEP TLSH

        core-libart.jar

        • Path /apex/com.android.art/javalib/core-libart.jar
        • Size 549KB
        • SHA256 eb3b040c7700fccdc6a637ff9628c0867b6f48ebac4b09c2b5bb4dd77baf3d38
        • MD5 SHA1 SHA512 SSDEEP TLSH

        core-oj.jar

        • Path /apex/com.android.art/javalib/core-oj.jar
        • Size 5.0MB
        • SHA256 d9d541d074d858571d60e2964fd39fb74130217fa7c92d74ed1695b0962837cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        okhttp.jar

        • Path /apex/com.android.art/javalib/okhttp.jar
        • Size 397KB
        • SHA256 14d759d0257e1be79263f4ff0bd41548af7f83f7d5f8f5029dae5e58a4687ada
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-bluetooth.jar

        • Path /apex/com.android.btservices/javalib/framework-bluetooth.jar
        • Size 937KB
        • SHA256 9f51175dca7d241cff99acba4f8e29a1b781f3d16a72baebc8ab7434ded1869c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        conscrypt.jar

        • Path /apex/com.android.conscrypt/javalib/conscrypt.jar
        • Size 453KB
        • SHA256 787aa8fdbb20b5a4df8a61213c8df30de929dc610967f32712611b323d89d32d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        core-icu4j.jar

        • Path /apex/com.android.i18n/javalib/core-icu4j.jar
        • Size 2.7MB
        • SHA256 baa7c3b0f8df0cb4e6b925b44ccf99dbe35dbf4be00a0ae33c5e4eeb173ce7f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        android.net.ipsec.ike.jar

        • Path /apex/com.android.ipsec/javalib/android.net.ipsec.ike.jar
        • Size 670KB
        • SHA256 dbf99fd2ecc3f0a085855d9a53881b91132da8f0e85dd11d92ee46db01d6ab83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        updatable-media.jar

        • Path /apex/com.android.media/javalib/updatable-media.jar
        • Size 482KB
        • SHA256 19eb02aed8c826a9a4b74d11a345e8ecbe1fe5562c5b9d13ac1286efaa4771e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-mediaprovider.jar

        • Path /apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar
        • Size 73KB
        • SHA256 6ae5b642fe117238ea95d6f39931c86cc3e784115a0874e8b742dab88ef9629b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-ondevicepersonalization.jar

        • Path /apex/com.android.ondevicepersonalization/javalib/framework-ondevicepersonalization.jar
        • Size 8KB
        • SHA256 f2d356c75b62b631972f29ed268497b3088e80676f34c4f8ea779d30be959b4f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-statsd.jar

        • Path /apex/com.android.os.statsd/javalib/framework-statsd.jar
        • Size 73KB
        • SHA256 22481f2149c6f9b6e8873c4419c8fd33fd72c7dd1ef8e968c63ba3a1c8eab914
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-permission-s.jar

        • Path /apex/com.android.permission/javalib/framework-permission-s.jar
        • Size 173KB
        • SHA256 25c24c41332b5886427c5864067ac491e163a6c729bc219b31183b229e5d3219
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-permission.jar

        • Path /apex/com.android.permission/javalib/framework-permission.jar
        • Size 612B
        • SHA256 e62333a706d04ca49f917826f49770ad089d134580f050567de912ecac31302c
        • MD5 SHA1 SHA512 TLSH

        framework-scheduling.jar

        • Path /apex/com.android.scheduling/javalib/framework-scheduling.jar
        • Size 11KB
        • SHA256 a80d2a1dd96cbfd38ed68d8934611f2294ff8f85fce7378500570814d571ce7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-sdkextensions.jar

        • Path /apex/com.android.sdkext/javalib/framework-sdkextensions.jar
        • Size 5KB
        • SHA256 835e58ff912600ddef1b3fa9adaff5d7e2c4b379fbe8adaac065122777b204a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-connectivity-t.jar

        • Path /apex/com.android.tethering/javalib/framework-connectivity-t.jar
        • Size 374KB
        • SHA256 595956d19b204fce5ae88e02999467cd6bee084158ef209fce06958d76806608
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-connectivity.jar

        • Path /apex/com.android.tethering/javalib/framework-connectivity.jar
        • Size 490KB
        • SHA256 13f8f21e0f6c093ce54e81bbd0e169f605060d68a60070bffb0e1ba2e54a40c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-tethering.jar

        • Path /apex/com.android.tethering/javalib/framework-tethering.jar
        • Size 63KB
        • SHA256 fdabd2584172b86fb29014cb70f61e5995c229db5fe098a80244809bb7bca7cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-uwb.jar

        • Path /apex/com.android.uwb/javalib/framework-uwb.jar
        • Size 102KB
        • SHA256 31ec5ef294c561e6ead889767bd0656714f42998717a947427150d51dbc3b367
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-wifi.jar

        • Path /apex/com.android.wifi/javalib/framework-wifi.jar
        • Size 985KB
        • SHA256 79bb444346e1086292f96dfd8f859fe6e72fb439c1426db6915aaddb5bd30a65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        journal.tmp

        • Path /data/data/com.roblox.client/cache/journal.tmp
        • Size 36B
        • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
        • MD5 SHA1 SHA512

        google_app_measurement_local.db

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 f2ba3a71a078d7727a4cc38bc93a1734b9037666d191b494e6f7e81f8fdf5e60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 dc13fcfdf42ae6d66f0ba7bdb828f1c6ad70d32fa57ec216102297015da7c59a
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 1f3f15e3816e5819b8c7aba882b22a2bcc3ee9371f28fb707e50c5549cdd0e56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 27a65001568600bbc7f788efe4e6bdab61a90d7b14f00133f727ecdf851a8532
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 ad06fa7cc0396b07cef8e51f7d6365133dcde8d36f4e997e0a6c9c2e315a4fae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 88903078c36f8350616c51981b908da68e50dfcd1e8e5a1e8666fe3fe0748018
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation8782235257826607006tmp

        • Path /data/data/com.roblox.client/files/PersistedInstallation8782235257826607006tmp
        • Size 90B
        • SHA256 b9ea727c2d2e7bb1b135980044d1a231253c2b086aced551ed1d79ee3bef3268
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp

        • Path /data/data/com.roblox.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp
        • Size 343B
        • SHA256 6d653abd19a03e708e319ba98c8691442e3f2f38a44ddf230689137489ede82a
        • MD5 SHA1 SHA512 TLSH

        FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp

        • Path /data/data/com.roblox.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp
        • Size 367B
        • SHA256 c8a2af468f49aa57d3d679f9e06ebd346dfe2b7d7702c84255bbb7ea0cc1b6b7
        • MD5 SHA1 SHA512 TLSH