6a552ee16e7eb57dca2b1ebc55c43148710a4231c3bd12d2bec89acec8849be5

Analysis

max time kernel
149s
max time network
156s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
14/08/2026, 13:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Play_Clash.apk
Size 25.0MB
Sample260814-qg2acathnd
SHA256 6a552ee16e7eb57dca2b1ebc55c43148710a4231c3bd12d2bec89acec8849be5
MD5 5e2c12961712828a92b30291867f1f8e
SHA1 33a8aaaaa08ebdf7c86e5b8b41624dc4814daea1
SHA512 ff612187a450fbe98bae2762d472b5c576f0b9001a98ef68fc277fefe7b9d5fe334aa18ace0b44cf33d6e66237d9bdfc6a6c7daed4b4ff7bc0062836cc915ab4
SSDEEP 393216:hAP2FbGJe1gDs1sz7SBnmf1YELaA2Ew73raS2G6y/BPGT+Cbc5:zH6z7SdmmPA2taS2G6y/B+qec5
TLSH
T1F4472383F7689E1ED8B311724D5E13366E6A4D16C743A7876A44332D7873AE80F887D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.play.clash
/data/local/xbin/su	com.play.clash
/data/local/bin/su	com.play.clash
/data/local/su	com.play.clash
/sbin/su	com.play.clash
/system/xbin/su	com.play.clash
/system/sd/xbin/su	com.play.clash
/system/bin/failsafe/su	com.play.clash

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.play.clash

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.play.clash

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.play.clash

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.play.clash

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.play.clash

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.play.clash

com.play.clash
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5044

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

CFPGCore

Path /data/data/com.play.clash/databases/CFPGCore
Size 28KB
SHA256 a4feccd5666316055adf7c7612df476c210b78e0f65225a87edc5dbeb04aa673
MD5 ef9650627a35f169c276082cd6c9ae61
SHA1 c8a9cec5ae5e3b2a0026d225bb1cfa63dfe5820b
SHA512 1edcbfba742311ddff823b98be6eb263d68da584038875aa3fde86224f1af2b84cbe08d4f0dad3f8552a541743a2ff1b8ef1ecf8d87a3eba53a9a7802ebc0248
SSDEEP 24:TLP+sig0EZFib3FTilviiMN8gZ6GSiIQ:TzjGTsqlS
TLSH
T1EED2E0DE8F103752D1E61070D89023E31E3CAF2D9B4D67DB479444F7B8812766621938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.play.clash/databases/CFPGCore-journal
Size 12KB
SHA256 25719db177f60247992d29639c009b28a7910ed6d2007cdcae84e489ec0eef18
MD5 f47553a131cc703ca546655fc0cd6c35
SHA1 6081657b32a01675ca456c3ad09e16db77bdcbbb
SHA512 6c41ba858f6ea8967d5a79e53d0dee48db7be3287c5968dd20f47f4632ce13b6e3fc8777b458e468be57aa6eb80a16eea6fcf6c86a5dc9b8c2720400778c9fea
SSDEEP 24:7+tNqLf+sig0EZFib3FTilviiMN8gZ6GSU:7MNqDjGTsqlSU
TLSH
T10F4220DE8F113712E1E66071D8D022D31E3CAF1DD74D67DA07A445F7B8823766212834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.play.clash/databases/CFPGCore-journal
Size 8KB
SHA256 f3fe47a03e004632fda04296b3f2d2c5dc81601be7868fd2bb93c2e9ce305a67
MD5 ef3ee29ac9025283aa4ec2d3c0fd1b73
SHA1 355af486183470ec3772e55d7c0c20ed60b8a7f0
SHA512 b496f1ab548eaa7c41f630cf916ef3e4c4342ad310dd1106fce99f67b53288e008e9d227f1dd73869724b810e6b50466d9c414967476003866948eb1f10b1436
SSDEEP 24:7+tbqLEaX+sig0EZFib3FTilviiMN8gZ6GSN:7MbqoaXjGTsqlSN
TLSH
T1060202DE8F113752E1E62071D8A022E31E3C7F2DD74D67DA179844F7F8812B66212938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.play.clash/databases/CFPGCore-journal
Size 8KB
SHA256 35feedb4ae504bda7a126b2466296ad3a896ac032c71eb4f0aa54a1907aec2ad
MD5 9b915e4f8bcce1ccb2078fdea88768d6
SHA1 cc5674ffc6eb729ae4362b7906353d32109eaa2c
SHA512 54e61c18c743b6e62f5cad69a9993634d0aeeca9e8f47221f8bdf881d7e5fc023fbe09f381f866fdf0a9594419f67f976e9cc7adda6e42e16ec348762b82602c
SSDEEP 24:7+tEqLCY+sig0EZFib3FTilviiMN8gZ6GSwy:7MEqjjGTsqlSH
TLSH
T11E0202DE8F113752D1F62070D8A022D31E3C6F1DDB4D67EA479445FBF88227A6212938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.play.clash/databases/CFPGCore-journal
Size 512B
SHA256 f76a0c16801ef920cc1323327686c317750b676ca2fe35e84ce6f5a163e53ff1
MD5 8856a425928db1e1720d87339dc50a48
SHA1 81b8932b9895287eaf6de5bc12efcf3e107369fa
SHA512 b706ba5b274ecac0ae2148f320b1a034456b62553ab9a95bf519605112aa8b073a4ecd52f2e47ed391e55caf50b9e1aad8eb3662f230163aa3b3bbc461702682
MD5 SHA1 SHA512

Submit Download

CFPGCore-journal

Path /data/data/com.play.clash/databases/CFPGCore-journal
Size 8KB
SHA256 df5f19ea44901f39c27e2add80f1362056a106db730d394ae9be50091ad7b040
MD5 e611fafcbcb8f5fae6d2b4461b39ae56
SHA1 ba6f70d0b36b56f6d3b1e364e6f6c1baad8a9156
SHA512 9f8d788b24968c8ed557de38c67079883d7e94272bd8b2473ae825464da839639fb2f23b34af218a160bc13b51167d9e488a2b4299e8f53d725d435889d93497
SSDEEP 6:7+/l9v8FGn1M/pg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK0PUn:7+tNMppqLiuWdwRmBEyPbS
TLSH
T17202228DABC40822D89916BB90E483441D00EB198161CF0729A008983C434CCE4E1D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFPGCore-journal

Path /data/data/com.play.clash/databases/CFPGCore-journal
Size 8KB
SHA256 bee361cf8cefc043d8d2793fec5c338df788e1b52156f4df02e35cdd4ef68627
MD5 54e1b261530bcd4359c63aa7d1c77c14
SHA1 39eac358db0138a8f12d451c9d2bba743afd2354
SHA512 7d8f8ef5302318b28e0b43ecc0e91e7de0b4f7d8d7430ac7ca1291e022b545b2586ea0c490249edb9caa436951ac50a5771241ae44cea223a0c8a710a9619a83
SSDEEP 6:7+/l9ibjgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKkEM/wJ:7+togqLJdTRmBEyPb3wJ
TLSH
T12202128A67810913C51B57B7A0E983552F50E7158263CB5736610A98BE467CCAC90D59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db

Path /data/data/com.play.clash/databases/OneSignal.db
Size 52KB
SHA256 ab03de5564295f5ec34e2fccba9811cff818911b07798e9e456a58309deeb3a7
MD5 e1941e84ac2269c7b1b8bb7041b14001
SHA1 aed569ddb068a94e893702c297683c233d841f6f
SHA512 99124fc5347f6a7e19e0e30330c4e2f0f2d9074a0fc6a0ab7be25c5bd90d8dfdc66e8abeb1852be871dadb7a5945d7046d2e72ffb4f179c385ed7ffded33c2b7
SSDEEP 24:TLLSRZBUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvJqrEqjUix5+xGTrOPjwV+x:TeAcrA0oJxqrKcrObMoOS
TLSH
T11E338BCF4A862191EFC765B3155252E44E3B610E889317A63BF760245E83B16D72387C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.play.clash/databases/OneSignal.db-journal
Size 512B
SHA256 b67abc4c657259ec3d659c2c5e910c085807c69123d7fe4ff62ab247923c0720
MD5 903fe586667eaf343ea639a0519d83da
SHA1 5517ad7ba56d12095bf2419e0122681ac5abaff6
SHA512 eca1416955f1ba868705b0fd4d2ee85982112a2890eb02e805d0872af8534fcb414d9cc01d10f919016e4d8b16b24a5b6ead08a284abec2d482c53b3682123a2
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.play.clash/databases/OneSignal.db-journal
Size 8KB
SHA256 76b589fa5353b967b71cc510a5eff807e77d15792c34368f8b5468925535b1c3
MD5 02c51e5dbec1dde7ce0ce473a200e904
SHA1 b51a5b7b89eaedacf5cec3f819678bab6ba02186
SHA512 4f2e39dae8da9a006254585c35b749d86015234377b3223f47af0770a6620a0e5f114a0c9ca782c03b89fd5c3e778b9afd4ea0b1a93967deaac538c63784c266
SSDEEP 6:7+/l9c8Hn1U+2vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKJ:7+tax+2vqLiuWdwRmBEyPbi
TLSH
T15502228D73800922C8191EF790D483410D90EB99D561CB0736A20898BC034CCA4E0D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.play.clash/databases/OneSignal.db-journal
Size 8KB
SHA256 8f63479a9c9442d3362913bedc06e724e334e8002e9ea836346d810b672ec7b6
MD5 11210f682f2d8d9731231bc3e99eedba
SHA1 56415ba3c5f604923e00991b6cd76925d7e9df4e
SHA512 dbd4ee83f2e5ef2ee0fc351970f631584f12e3b78f20ace6c889b0ff542a1a91ccf28a618703d25ec193e577a6047c40387c159241e9857b3859100b14a1d8db
SSDEEP 6:7+/l97gAOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKgc//B:7+tZFiqLJdTRmBEyPb2B
TLSH
T1B502228B63410823C03A57B7B0CD83502E20EB15C223CB07167008983C036CCA890D10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation5787779906098176118tmp

Path /data/data/com.play.clash/files/PersistedInstallation5787779906098176118tmp
Size 569B
SHA256 cf53a3e1507d0a2c732cc07a6137a036e25b9ae66c067fb1073eb7bdaf7277ce
MD5 d4352ad2d2edeeec0a0f199efa12ceaa
SHA1 4dc90f71cdb3e6db66a223fc45e253d2fc6f92b7
SHA512 b33df9c01522cbdc19a321c996b918c4695ddd847bd36a4eb3895f27491eb35b63ca0708f36bf59a2376c2f5177c416de820aab1a0f03d155a90ef7c368898b4
TLSH
T1A2F0EB5A1A228A4CC8957243605CBE4A1E4C0AD0786781883FCF44AC4AE6C36612B09A
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation6101344196410351985tmp

Path /data/data/com.play.clash/files/PersistedInstallation6101344196410351985tmp
Size 567B
SHA256 910538b25c00c7256e6c5e5579da3e89ac3a836f7e7f2113c2a5bba8e37ee1a0
MD5 5985090583f7f4200e28ce24e7ce2cfb
SHA1 669bfe01a41380010eddd6f0e021640c08c1e34a
SHA512 7578d80df1f1291a8127861b07bebe503642e9062888a6b6267df476da3cf86fa80fb608287201703c81d75da81a1476683512baa117daa0f8d89b1a5a953759
TLSH
T15BF0961E96210529E446C24E68CEDC00B9851044334A0581FD45CE60BCF096E721B490
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation6296285589035680642tmp

Path /data/data/com.play.clash/files/PersistedInstallation6296285589035680642tmp
Size 90B
SHA256 5ba0e7a0ca9e495012705d00ea4768ea01aa9c94732b9617b363cd5d4a7b7c65
MD5 aa93eb622cf35b939c46707e7b077240
SHA1 ccff2ac9371484419dc36e816b77528316eaae0d
SHA512 cbc1f5adfa77ef33d5433950ae896059eca4efdb924cdfc52ef46ce4dd0294a77a5123a0f1fc981f6b59b38fbdfb0da4efd18b2ddcd2ef8ace228cc085386f16
TLSH
T171B012006E3281D1848AB3032E4C96003DD128500859CE5C0F08E48001831D5D103AE8
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation6370088040484522624tmp

Path /data/data/com.play.clash/files/PersistedInstallation6370088040484522624tmp
Size 90B
SHA256 b87aac6e80d64fc6d87372b01b5b10c0cf07c25a271c7255597cf48db0c3cfd1
MD5 37cfcfaf3f5d4923390c7ba5d32d4002
SHA1 77cd3e0486221640cd6815302adccf633fc040c9
SHA512 878be47b8ef39c632ac6c1782b91e8059703be761af712da3bee0763af8713980f5d94919db9ddc974f70a3e2fb5c0c89ea629ba0cb02346559854196e118ab6
TLSH
T174B012009A70819184E6F6071C4CD2809F862440854A8E944B09D85040D12D08257994
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.play.clash/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.play.clash/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 3a0d5fba410e52c8169c985dbedcf5d3f319dac9f362d3e62f24873c5b5fc4f3
MD5 75580547d7c031a93ac3bf6fad975a6b
SHA1 bd81bf2b4d05b01395268b4fc91602d140e019ff
SHA512 5858c56541adec5ebafcd165f08248e4e1d4c62f3d179843d1d59b42522999fe6977a8ba3756cb33fb58e9995782d49bb6448ef5bb52949960e23807e40cecd5
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.play.clash/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.play.clash/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 be9242f6bca3dd1f1091c24657fecfbde8ccf40a3703a8c75c66f9a91469872a
MD5 7dba75f44d5dba94f9b67549d807656a
SHA1 1c11c3247825022f5a8491d897b1c8a8b5e7e9ff
SHA512 a7068f7ee0a7b1199a6cb6147e73f30f40aef7c590ef60755460961440dd5bb735db0f3f98bba85a86c8f1cc745ea03513440e96c051feb192f0b13fda1fec30
SSDEEP 96:gGX2WmQDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:gGmlAndjnHt9S/f8JzSV+6D86T0ED
TLSH
T134B3F08E0F592900C0AA68B0D9900FA1797E473ED793F3D365914076ADD6921ED2ACFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.play.clash/no_backup/androidx.work.workdb-wal
Size 193KB
SHA256 cf5c4a10f679a48772b656860e08631af796d4416abfe730e477cf17550885d3
MD5 4cb645a9d6d8175e9b38c7ad802ecd8a
SHA1 1a90e8e12bca9e3feae594b6c6703893903ea03f
SHA512 03a60007e47a3235e58fcf25db1050a8139527467e391e7b0aa1e823f8cd2b710b551f36c2a92dbe4d4f6456c9c168427854496a95b00e498478a8ba2374fa9e
SSDEEP 96:KE21DtYPUEiEX5Uu5uhE21DtYLJVKE21DtY9wE21DtYY:a1DtYP95o1DtYa1DtYq1DtYY
TLSH
T129147CDA221F85A0FF8B0A3AFDA361A30DB781F64BC32653D55F836691C6241835371B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.play.clash/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 7ff40fe6980abacab69bb4ce59624161e84f2ddc0eec0531753be76348aad412
MD5 c1142ddc9c560b4fe2f660ec444f7180
SHA1 0f016a4a739b9c5257401188ff9152726a972a40
SHA512 61f54cc83b351ee8789d2220f703e376ca3a76f9e8030e4cddebc9b6787cbe1416f2fd6d1a8933250a4e1b4341ce0b9ae0819b4872d3ab584962ccada8f1d9af
SSDEEP 6:KA3ntZl/ChCl9FZdrlOERX4PBX4ogLugMBX4suuK+/Eff/If7o1CfqqiOw2:KA0hIzdTRmBEyPbP/aTJOw2
TLSH
T1B0722B4CA3400D52E31A4377DCC4C3410D60933EC762D70B1621143A3C017D8B262E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads