d8704f43f1ab7ebd9e2234def7ec5ee55bbe7e509ffd1421fac59347a9ec6ba0

Analysis

max time kernel
123s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
15/08/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xjskw002.apk
Size 4.4MB
Sample260815-aramdada45
SHA256 d8704f43f1ab7ebd9e2234def7ec5ee55bbe7e509ffd1421fac59347a9ec6ba0
MD5 b32a57a1d7e3bc3d903d9eb4fe0e5e1a
SHA1 f921cbc41fd374ceea5fd893f3cf1dc684ae6fab
SHA512 fba07f046a08ac17cc45a7f532cde9991d8184b3ece5e48795139e3b17b13760e9215039e46e249e045ef0f1a50ae1768bf2135e3e6744f09955d6897799dedb
SSDEEP 98304:XCc5DrKdAkXZP64FhJ9KJ8NK/TeISMioAOAZWeJ7UHGEjOBM62:XCchrKikXZP64FhuJ8CLSMZAOttjKi
TLSH
T1E9261242FF69D92FC87781330A9A523522268E1EC683A74724DC372D68776D80FD9BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 6 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.gameswin.id.s16
Accessed system property	key: ro.product.device	com.gameswin.id.s16
Accessed system property	key: ro.product.name	com.gameswin.id.s16
Accessed system property	key: ro.hardware	com.gameswin.id.s16
Accessed system property	key: ro.bootmode	com.gameswin.id.s16
Accessed system property	key: ro.bootloader	com.gameswin.id.s16

Checks Qemu related system properties. 1 TTPs 12 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: init.svc.qemu-props	com.gameswin.id.s16
Accessed system property	key: ro.kernel.qemu.wifi	com.gameswin.id.s16
Accessed system property	key: qemu.hw.mainkeys	com.gameswin.id.s16
Accessed system property	key: ro.kernel.android.qemud	com.gameswin.id.s16
Accessed system property	key: ro.kernel.qemu.gles	com.gameswin.id.s16
Accessed system property	key: qemu.gles	com.gameswin.id.s16
Accessed system property	key: vendor.qemu.dev.bootcomplete	com.gameswin.id.s16
Accessed system property	key: ro.kernel.qemu.vsync	com.gameswin.id.s16
Accessed system property	key: qemu.sf.fake_camera	com.gameswin.id.s16
Accessed system property	key: qemu.logcat	com.gameswin.id.s16
Accessed system property	key: init.svc.qemud	com.gameswin.id.s16
Accessed system property	key: ro.kernel.qemu	com.gameswin.id.s16

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.gameswin.id.s16

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gameswin.id.s16:remote
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gameswin.id.s16

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gameswin.id.s16

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gameswin.id.s16

com.gameswin.id.s16
1⤵
- Checks Android system properties for emulator presence.
- Checks Qemu related system properties.
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4762

com.gameswin.id.s16:remote
1⤵
- Queries information about active data network
PID:4826

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

AdjustAttribution

Path /data/data/com.gameswin.id.s16/files/AdjustAttribution
Size 428B
SHA256 768347c1af7a5c3004c396ae0fbb52dd57cace0d13bb39967bd0a2e1716239bc
MD5 6da71993c45f84be49fd7498d41d05d5
SHA1 a46264423d6e66872ef98e219310509ad5faebc6
SHA512 146f7a0d5c7c07eb0f986b0f2694a36a28c5c00214df38bc10c64b49c0910d59be2f01099d12a40816f0992d00da27cfa83a18fd32754879889e152335a335e4
TLSH
T1CFE0A30EEE411F4DE1006EF940F5F421CE702C32910AF48929C08415C178C35CD4C547
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoActivityState

Path /data/data/com.gameswin.id.s16/files/AdjustIoActivityState
Size 1KB
SHA256 a3b3148e3f03a33e43ee9c31be88567f550badaa858495cb02f32335f79b7128
MD5 9fc4d7641c542177d63229a43cfa7ff4
SHA1 b591f078acff4a4d43427625296168ca6f507f18
SHA512 75cbf3f5f30b3826a060a4daccedb5cd1d145645cb7bb2e267d0d0f6d2f5a687f66b920257db2a716fe63642134082db33533be944cd8d74da493479a6fb1782
TLSH
T1D8216D199C01AA38F84147F86133822A237089C78B99C1BD76E364870A57A95C4FBB63
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoActivityState

Path /data/data/com.gameswin.id.s16/files/AdjustIoActivityState
Size 1KB
SHA256 bffa5c56417c74b0b882eca08b29f0d37b0e4d7bd1c3bb458d4932ff158879df
MD5 e779ce24fb79c91ff4d4ae490a48ca11
SHA1 0145989d0b02fda389161f1d9e256d2d14c2e8bc
SHA512 661702c0101ec1bc54fefbd1de45e724f159fffff9db6853decfd1e27cb01a498e287a6a45cd423fb9b70594b69a9c808c29d43082314c998bc8a3be4653d32e
TLSH
T1EA216D159D01AB38F84147FC6133822A237089C68B9DC1BD76E324870A47A95C4FBF63
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoActivityState

Path /data/data/com.gameswin.id.s16/files/AdjustIoActivityState
Size 1KB
SHA256 4d1386defc425eefcc4ba3b7f3c0030eeb7b5b31e3071f5809fb9e390e6436cf
MD5 d30b49c2026f106802618dfb5b379836
SHA1 011d3922afec7ab41bb4df800147cb4ae09fb7b0
SHA512 01073bd62011dce19e4341abca5466401f01e3128e9f6d720e3cd3d23b31e503c260c3a35168b14a09328b60e1da6d50a5df6ff8134d740bbe6c047b4965f0f2
TLSH
T1DE216D159D01AB78F94147F86133822A237089C68BADC1BD76E324870A47A95C8FBB63
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoActivityState

Path /data/data/com.gameswin.id.s16/files/AdjustIoActivityState
Size 1KB
SHA256 3fd71ce6fe775c5cfc7d5b9eceaf8fa141291cbfb4873d1fe4ecad1e7fa13f0e
MD5 3d33e068121a605ea348bf93deb696b4
SHA1 8a8dad4679b043d1b85aaf678996477803099738
SHA512 40a91a987b3001b11e255d2c63e98dc7ce023f3e791d20db068e60843dc6160a74497db7bec02eb51ebaf6df83c8e547b7b0280bf44eb67b435bfdcd3fa02e1d
TLSH
T13F2150199D01AA38F84147F861378229337089C38B99C1B976E364861A57A95C4FFB63
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoPackageQueue

Path /data/data/com.gameswin.id.s16/files/AdjustIoPackageQueue
Size 1KB
SHA256 967395c4814b9a1e30cd85c105d107d1e648bce8d48446a36b40bec6a6222db6
MD5 c53d63821a369048ee2a8520113d9631
SHA1 efdda36d30e34f739cd4bf4e9fdb817e86ee5324
SHA512 470fcc90a26f087ce65358ce37b22ea485cfdd1a62c9435a88c968e254bc0e51b5aa054f07b3f62ede14edd2595abf33a7d6d5534bc39d0a860512f2747e268c
TLSH
T19631977B7640A172DD23847C6C1DC71C59B830A3E634B0656FA10C416B13DD98931B0E
MD5 SHA1 SHA512 TLSH

Submit Download

AdjustIoPackageQueue

Path /data/data/com.gameswin.id.s16/files/AdjustIoPackageQueue
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
TLSH
T109A00475D5417C71D351113C5415440C50505570C107D57CD7415470310D0D0477FD7C
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.gameswin.id.s16/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.gameswin.id.s16/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 d981b8d8b1d5a42d2be0a7d52577aad5e6dc31e322563deb1cb5700232f04aef
MD5 cd18b89b46562b01c607c32d7abfb08c
SHA1 c191f00e39b8a47dc0f18b730a79d1c00a075371
SHA512 2c0d3a4a7f4deefec186e44236c6997f072e6beefadc6e6a852db5d68b3f1ab69976c67139a3bc207dcf3f8b9bb9c55ff6c351b7305e5f2ef1525bc4c87e4c53
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.gameswin.id.s16/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.gameswin.id.s16/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 1a27686e077b5e6071921340ef9828cbf052caffbc886e923315ea18f1162cf1
MD5 0b8c0db2f1e94aeb93afa8f164e1712d
SHA1 95151943269f57767ccf6d53fd1282c663e8d1bc
SHA512 7490f34c76bfc71bc38fec56dad4abf59022d57f24b842d921b2c5f5730b9e5be142c2fbd678aef9ef70f66d445d9d332874bac9469b32d321a32adbac044111
SSDEEP 6:KalClUlbRl9FZde/kPlOERX4PBX4ogLugMBX4suuK+/Ql6btATHo9Yrj4Ow2:KbyRTzdeWRmBEyPbP/0HoQ4Ow2
TLSH
T1DE72C2546B821D63C115823764C783400E50961D5353C7079DC3346BAD077CF9850D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.gameswin.id.s16/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 0483822673f106fa2af9abcec29c3767ecb60f2e5e13155396285bc9a4056a66
MD5 dffd62a17661037025dd985bce9c49c8
SHA1 39fbeb751af1587eb6814f3760bf34cfee00c527
SHA512 db578f0bc471a865ed7787d347511737562fcea4827f231f09aaa4291497abbf1e592734aac429eba51e6ee4d91969f3f5ae0a36aa273d9fc8829de3484820f2
SSDEEP 96:R5L/wR5W8DP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:0bJndjnHt9S/f8JzSV+6D86T0ED
TLSH
T135B3318D0F1A2904C0A9A4B195910FF17D3E412E9793E3D1A4D3107AADC7B26DE29CF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads