Analysis
- user interaction
yes - max time kernel
23s - max time network
33s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
20/08/2026, 03:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
mcpro24fps_v043dd.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target mcpro24fps_v043dd.apk
- Size 7.2MB
- Sample260820-ebf7fasscs
- SHA256 052bd5f4bc80e80fa386b44148e62cd51021d3c5edecc7f1390c176e5abe124e
- MD5 ac7411eaad2f675c30aa5b2e5f4a4bd1
- SHA1 8bca572b9bb01775b2df7c01333d26a6ad6f5ac9
- SHA512 2ada608071c3cb238a6405c359e14d8ee555c463ebbd4d584d44c47ba000dd75a3395050854ebe0e2af96da078580f8c753a1ef83861fd54e4a8c784a06c658a
- SSDEEP 196608:7oLOfBbm+FRHhuPj5OarMmynV+yiwV4z3PMTZfnxUggg:7UetlfhxaojnhR47UTfUggg
- TLSH T1D7761257BB48A83AC477E0379FAB463661698D644E42E7133518B30C68F39DC8F4ABD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /system/app/Superuser.apk lv.mcprotector.mcpro24fps /system/xbin/su lv.mcprotector.mcpro24fps - Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /system_ext/framework/androidx.window.sidecar.jar 4763 lv.mcprotector.mcpro24fps /system_ext/framework/androidx.window.sidecar.jar 4763 lv.mcprotector.mcpro24fps - Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses lv.mcprotector.mcpro24fps - Checks the presence of a debugger
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/lv.mcprotector.mcpro24fps/databases/com.google.android.datatransport.events
- Size 56KB
- SHA256 bfc71c4dae4bc1deb2431d5b639eea63869bf794ea8b9560fdfdeeef220fd31f
- MD5 dd21feab4dfc783f98766fce98c41811
- SHA1 1708709fe96c5489edeac1dfdc7ead22e685dbad
- SHA512 f57fff14a1a2ea9802ff3a2c5901e0e28c0a2caccf164549c85a45e211c156cc482581b6c737a6829b8f1b0f6c75a0657649c67e44d48c1059401a5628ad8fa6
- SSDEEP 48:TG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPS3I:WMEqzAiwIyNja3I
- TLSH T13B43649D5E3C2220C57E283ED7E143635B3C93DF5B2392613D948CFA8DC246974355AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/lv.mcprotector.mcpro24fps/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 89d6411d81dbc5316aff2780ebbe3d47b6fe39e30324c9b8c123ab72356e992e
- MD5 f1abd5d43cc84b2343b11588396944ae
- SHA1 014dbb99f5174d067a7da6ae30518e4a79478be5
- SHA512 856d13fda46d59e82336af3dcbec3d096b2467c148a4f35e8ddb8a0e741e9f55f8f0fd1a80c9617d081371586b7b7249a92615a008f2e7121cdedfeae1e9b4fb
- SSDEEP 6:7+/l9YPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKys//V:7+t6qLJdeWRmBEyPbKV
- TLSH T143022288A3400823C02D27B7B0C883801E20A7289323CB2B2AA108743C8BACCA890E10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/lv.mcprotector.mcpro24fps/databases/com.google.android.datatransport.events-journal
- Size 512B
- SHA256 df570c8901319bc5779e712fff2b698555ce2e93ac258d75906146eb6d13cfd8
- MD5 595d4c00007cf942d019345ebe607590
- SHA1 f300c8318eae6af6ec39b7cf67c45c5ecb329966
- SHA512 0e1f46ba66d44ca6a9b8b1c5d817ae94e4a00b27fe98cc0f1f455c0a0dc79d3993f96deced4a97ea068287a645fcc0d35ac741e686b00bdd12478613f3622784
- MD5 SHA1 SHA512
- Path /data/data/lv.mcprotector.mcpro24fps/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 3d1cd8546d73f1b3794d45e011ce0d26488c5301f01b03ff45ce9963968680f0
- MD5 ccd55832a38cec613edcd0d61a17bc58
- SHA1 da607257f81c86fe3f3a2229bc8e65777d435699
- SHA512 5803567d257b9a7fad785f320e9fb0b2f2e54d2a788f9c97ff1d1702d201dba43a1e8f8ab9ba2aa8700553bee2e84c85b247145b2a5b096b759f836187057845
- SSDEEP 6:7+/l9AWn1oZg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK+M:7+tyxqLiuWdYRmBEyPbPM
- TLSH T16B0222886B802922C82E96BB94D6C3800D14B72881A1CB1B16900C942C0B4CCA4A0E94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/lv.mcprotector.mcpro24fps/files/.crashlytics.v3/lv.mcprotector.mcpro24fps/open-sessions/6A86789403E40001129B1CEAAA75D56D/event0000000000
- Size 9KB
- SHA256 5829b6a47826d54871e1f397ddc094deb0b826b4086d17e8195eb82b33e6eea5
- MD5 cc4582ea7648156e16acd4a4a14f51e8
- SHA1 cc1ffdc02f336b675600217171c6fbe511d6490f
- SHA512 1eac066f4975991ec52ab3c9b010e0381c696027fbb9d7c2d0b24512fc0825ca5932b5fdaec371e9c86d538c3eecee01696d754d1721da920977d3a86385fe25
- SSDEEP 96:fQO/l6I32GI3CaNI3trz0s3hG3il3K353MJzknx/l6I32GI3CaNI3trz0s3hG3iE:fQO5RO5RWKMR40Bc2uw
- TLSH T13022560BAB34782B266DED5F315A5AAB4DF609430D2D0E94F844D3391F4EC8523E72AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/lv.mcprotector.mcpro24fps/files/.crashlytics.v3/lv.mcprotector.mcpro24fps/open-sessions/6A86789403E40001129B1CEAAA75D56D/event0000000001_
- Size 24KB
- SHA256 91008493f766da1af64a41253d09a032d93fbb8ed2fda589de35627684b204b4
- MD5 8838fb4f37f3b390fadfd456cb68a3ff
- SHA1 b74c96516d24e160e6a0c2aa96eaf9e584fa9eb5
- SHA512 57bff7f7ea5ba98143a77a70dddce440a425b8ae1e26b3928c70a3daeea7e8aaa2a72630d6592f9a1fcd18c1d8495a415ae496fd5aa112a80bc195b392b1bd36
- SSDEEP 192:0vGMfmCTZLr6L3C9BCHQOLxkLrrQrL2Gwhk2e:yfthhsB8rQB
- TLSH T11FB2190F9F3968DF2228DC9A21AB1E7B5EB704276A4DAE84E01DD3591B5CC8123C775C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/lv.mcprotector.mcpro24fps/files/.crashlytics.v3/lv.mcprotector.mcpro24fps/open-sessions/6A86789403E40001129B1CEAAA75D56D/internal-keys
- Size 107B
- SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
- MD5 58c6ffd18aab0e3303cd49e1d2fdb9c5
- SHA1 7dd517bc9278addca0e9c229dca834edbe030b44
- SHA512 eba20532172d1bff0a750a5293024efd98c0c5822f3f15b469d1a54ce917ea78cc7f644c3e7d7a59dabac0226a942474c2a481f970ba8b519c24bf0765c799b3
- TLSH T1B9B0126061D5EA3738F6221DAD3244C1A5910D861452C38C6F14741EFE7006E69AF97C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/lv.mcprotector.mcpro24fps/files/.crashlytics.v3/lv.mcprotector.mcpro24fps/open-sessions/6A86789403E40001129B1CEAAA75D56D/report
- Size 803B
- SHA256 44450fa86053814e4e2b5014d87e752496079b3f8fb4d9b0539d3ec617444b1f
- MD5 1704e0e47554637b7bf7a97aa5c7824b
- SHA1 48e71972635b3029396164a7f9b9bdba69507b7b
- SHA512 a13537addd36c3607c59e2d54c89aef9d1d0ba7b04ba8054d48e4a75a2429260cc578821f2d5ff744661507f011b0b1b0133a35e0f23192544880dfae2074aef
- TLSH T10C012578CF76757C5BCE9389E043DE63E2F8027446126B6C54C3616061CE4DCB247476
- MD5 SHA1 SHA512 TLSH
- Path /data/data/lv.mcprotector.mcpro24fps/files/.crashlytics.v3/lv.mcprotector.mcpro24fps/open-sessions/6A8678A701140002129B1CEAAA75D56D/report
- Size 803B
- SHA256 42ab1458932522b84799c8253a49243e7e08ecd2cd80418eba198bf06ff72195
- MD5 4e1e2499c144b04e286de5a1e8b3aad1
- SHA1 8aebcc7c03edb0fc387b967188c41ca57be5bd28
- SHA512 503e36ba766f06ea0b9cf199de22c481841a26248998780d9e182c43e3bdd24876cafb5a220afcb4c0628b80a5c0c4c83f34047ad350d1a2e96b98a9d234a9b0
- TLSH T1D8014138CFB5713C1B8E9389E043DE63E2B402644601276C14C31160A1CE0DCA207076
- MD5 SHA1 SHA512 TLSH
- Path /data/data/lv.mcprotector.mcpro24fps/files/.crashlytics.v3/lv.mcprotector.mcpro24fps/priority-reports/6A86789403E40001129B1CEAAA75D56D
- Size 35KB
- SHA256 4fded3c8aa340799d3e4160bebe3f6c6dd11b8a9769a618ee51d7f5f6943bc8a
- MD5 bd5b73816fbd28e40b32769d07b810e2
- SHA1 8517e395e47bfee0e9a048a853b55afd39c503a9
- SHA512 aee351f759f6e9e52d7205874a644a0c64caf0dc59a094a0bfe8d8e7d2d7b603437b19b821f96713829e1ae9817ed00ef87f17ff857917cf9d8338929023f8e5
- SSDEEP 192:qmyJyKQO5RO5RWKMR40Bc2uDvGMfmCTZLr6L3C9BCHQOLxkLrrQrL2Gwhk2N:qp93S23MfthhsB8rQ4
- TLSH T1B3F2250F9F38689F226CEC9B21AB1A7B5EB704175A4D6E84E448D3291F5DC8123C776C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/lv.mcprotector.mcpro24fps/files/PersistedInstallation9133453624596855942tmp
- Size 90B
- SHA256 3a9dd97ceb8b2fc07ac5647f5408c04bdaf55b28ec217f7311c7339b3c8b482b
- MD5 ddd34f3a49fc4b7b75c12fbd91a998d0
- SHA1 a6123ed5a73771a2ed51269d61534e3213f6542c
- SHA512 4c60002aa9a4d3097e54d8fd5598048bd56282d02bf85ebf0e0286f8590f076c13855fd76fa0e41f67105f31cc90d23891e5f2a79bf6ed1bda7de0a1c91b1ccc
- TLSH T138B012409B304141C4C5A2079D4E91041E901441054D9F1D0A0C909000D12D092039E8
- MD5 SHA1 SHA512 TLSH
- Path /data/data/lv.mcprotector.mcpro24fps/files/datastore/firebase_session_bHYubWNwcm90ZWN0b3IubWNwcm8yNGZwcw==_data.preferences_pb.tmp
- Size 50B
- SHA256 590bfeba60dc64a5a6bc57f559e74f90b670a49ebac74ab0fb575b47a8f41f42
- MD5 697aa52b47b7773c7729bee8e53c89ff
- SHA1 d3b6b62dde493c2627751abcf0255093b2f0f21c
- SHA512 e7ed0a914d760c1dc9a80e5415c7add335b7308f106a360ea70d95e41d32430f65fe467ce6e352b163ebd1029f70a1f5efd8794aeaa1c562b2d446e1f8354e67
- TLSH T1F890040177411CD750075D444037C4401550374CF554301C17D3017375F5FCC0051015
- MD5 SHA1 SHA512 TLSH
- Path /system_ext/framework/androidx.window.sidecar.jar
- Size 12KB
- SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
- MD5 bdf3529e80318eb14e53a5bf3720c10d
- SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
- SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
- SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
- TLSH T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
- MD5 SHA1 SHA512 SSDEEP TLSH