9df3efb005d0f4b5864cdb40f399c58591f342c716c82ab4fd257889f1deb2f3

Analysis

max time kernel
106s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
18/08/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nate Hand Gesture.apk
Size 86.4MB
Sample260818-ryhp1avyew
SHA256 9df3efb005d0f4b5864cdb40f399c58591f342c716c82ab4fd257889f1deb2f3
MD5 1d9e826deae05f1d5733e36a3420483d
SHA1 021f761aede9b9d870703a4414aab2b864d742e3
SHA512 cdfc1a96a4dc6fc7b7f886a78db3cceb97db838cbb2bec8a5f2399fc62403bd590bbe833e502c2cc12e388df6f89d40552fd87541575c63e5990f8dccd2e8136
SSDEEP 1572864:/4iAain52NN02FAr6bEKfmsqxiuVN/iw0Iqx8:/4zt540GZOXb7/iwyW
TLSH
T104183393D708AD0AE29141F7D9E50AB565E34C01AB13164FC727773E5CB2F88A936B38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 6 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.bootmode	com.gilangcumihitam.natehandgesture
Accessed system property	key: ro.bootloader	com.gilangcumihitam.natehandgesture
Accessed system property	key: ro.hardware	com.gilangcumihitam.natehandgesture
Accessed system property	key: ro.product.name	com.gilangcumihitam.natehandgesture
Accessed system property	key: ro.product.model	com.gilangcumihitam.natehandgesture
Accessed system property	key: ro.product.device	com.gilangcumihitam.natehandgesture

Checks Qemu related system properties. 1 TTPs 10 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.kernel.android.qemud	com.gilangcumihitam.natehandgesture
Accessed system property	key: ro.kernel.qemu	com.gilangcumihitam.natehandgesture
Accessed system property	key: qemu.gles	com.gilangcumihitam.natehandgesture
Accessed system property	key: qemu.logcat	com.gilangcumihitam.natehandgesture
Accessed system property	key: vendor.qemu.dev.bootcomplete	com.gilangcumihitam.natehandgesture
Accessed system property	key: init.svc.qemu-props	com.gilangcumihitam.natehandgesture
Accessed system property	key: ro.kernel.qemu.gles	com.gilangcumihitam.natehandgesture
Accessed system property	key: ro.kernel.qemu.vsync	com.gilangcumihitam.natehandgesture
Accessed system property	key: qemu.hw.mainkeys	com.gilangcumihitam.natehandgesture
Accessed system property	key: qemu.sf.fake_camera	com.gilangcumihitam.natehandgesture

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.gilangcumihitam.natehandgesture

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gilangcumihitam.natehandgesture

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gilangcumihitam.natehandgesture

com.gilangcumihitam.natehandgesture
1⤵
- Checks Android system properties for emulator presence.
- Checks Qemu related system properties.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4215

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

global-metadata.dat

Path /storage/emulated/0/Android/data/com.gilangcumihitam.natehandgesture/files/il2cpp/Metadata/global-metadata.dat
Size 4.8MB
SHA256 8429f7884a1e21fb5f1aa52256110aec9939eb48bf541055501fa2a6bcfc5e18
MD5 69767ed73498f0430f50274ba0434137
SHA1 ac89037bb2041b28f95c79684a745be6b1935434
SHA512 b900194b8a598ab0782eb72be29e286da8dadbdc1173d2b02348af86a44622eae2e84a7140ae52207b3c943c039ab8c78bf10d6ab4f879b4aa2316bea0328401
SSDEEP 49152:5fVaUbChUrqgUBzs6vBQCct4kHCtTCyLvadtnLIiXw:AUruJvBstVgby/u
TLSH
T12436E952BE68D6ADC01DE171584BE6F10B216C3BAE11DB177368F3AEB4B53046E0B2D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscorlib.dll-resources.dat

Path /storage/emulated/0/Android/data/com.gilangcumihitam.natehandgesture/files/il2cpp/Resources/mscorlib.dll-resources.dat
Size 329KB
SHA256 c5baa176a5b72cd545266340e42102d393a5e43d38c95796bc828918bb95277f
MD5 21d06dbc8af6432b2b49536ed30609af
SHA1 11a1c0e2ab2f8c06fe4507535ed47e0dd279a60d
SHA512 2971f54eaa14c3ce6e2352e5a1aea5b044f0894bf4eac92de8cd92515b6473b5ca56ebfcad4369a9d4935cbefea2540a83f332fd4d832c37768310e8776ceb5e
SSDEEP 3072:c5j+evAPQ48RhHkXKSmLZsumnWpevI1kMqXkD3by+BEL:crvS8rHXSmJmnjvXkSr
TLSH
T1F7746CD8B5728E76FE57A9BCE85E928D43D9C1E2C182523B3D75C2E04D52386181EE3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unity.ver

Path /storage/emulated/0/Android/data/com.gilangcumihitam.natehandgesture/files/il2cpp/unity.ver
Size 36B
SHA256 b415fa969f09adf0a493d45fd68d9312377270447f2f4abd295efa066cdf4ff5
MD5 c256ce9231d571bd49217be75d2306ad
SHA1 63d6efc340b2f37e9e2307b3e8de864ba2a83ae5
SHA512 d66401fe96ab69e8580798085b3994eb74cd37784a414622732742e9c9cc9ce92684f19680ab4a4d0f385738f09905821d8c5d78c1e0e30b5ed970e07a7ab382
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads