Analysis

  • user interaction
    yes
  • max time kernel
    23s
  • max time network
    33s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    20/08/2026, 03:45

General

  • Target
    mcpro24fps_v043dd.apk
  • Size 7.2MB
  • Sample260820-ebf7fasscs
  • SHA256 052bd5f4bc80e80fa386b44148e62cd51021d3c5edecc7f1390c176e5abe124e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Checks the presence of a debugger

Processes

  • lv.mcprotector.mcpro24fps
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    PID:4763

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/lv.mcprotector.mcpro24fps/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 bfc71c4dae4bc1deb2431d5b639eea63869bf794ea8b9560fdfdeeef220fd31f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/lv.mcprotector.mcpro24fps/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 89d6411d81dbc5316aff2780ebbe3d47b6fe39e30324c9b8c123ab72356e992e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/lv.mcprotector.mcpro24fps/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 df570c8901319bc5779e712fff2b698555ce2e93ac258d75906146eb6d13cfd8
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/lv.mcprotector.mcpro24fps/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 3d1cd8546d73f1b3794d45e011ce0d26488c5301f01b03ff45ce9963968680f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        event0000000000

        • Path /data/data/lv.mcprotector.mcpro24fps/files/.crashlytics.v3/lv.mcprotector.mcpro24fps/open-sessions/6A86789403E40001129B1CEAAA75D56D/event0000000000
        • Size 9KB
        • SHA256 5829b6a47826d54871e1f397ddc094deb0b826b4086d17e8195eb82b33e6eea5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        event0000000001_

        • Path /data/data/lv.mcprotector.mcpro24fps/files/.crashlytics.v3/lv.mcprotector.mcpro24fps/open-sessions/6A86789403E40001129B1CEAAA75D56D/event0000000001_
        • Size 24KB
        • SHA256 91008493f766da1af64a41253d09a032d93fbb8ed2fda589de35627684b204b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        internal-keys

        • Path /data/data/lv.mcprotector.mcpro24fps/files/.crashlytics.v3/lv.mcprotector.mcpro24fps/open-sessions/6A86789403E40001129B1CEAAA75D56D/internal-keys
        • Size 107B
        • SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
        • MD5 SHA1 SHA512 TLSH

        report

        • Path /data/data/lv.mcprotector.mcpro24fps/files/.crashlytics.v3/lv.mcprotector.mcpro24fps/open-sessions/6A86789403E40001129B1CEAAA75D56D/report
        • Size 803B
        • SHA256 44450fa86053814e4e2b5014d87e752496079b3f8fb4d9b0539d3ec617444b1f
        • MD5 SHA1 SHA512 TLSH

        report

        • Path /data/data/lv.mcprotector.mcpro24fps/files/.crashlytics.v3/lv.mcprotector.mcpro24fps/open-sessions/6A8678A701140002129B1CEAAA75D56D/report
        • Size 803B
        • SHA256 42ab1458932522b84799c8253a49243e7e08ecd2cd80418eba198bf06ff72195
        • MD5 SHA1 SHA512 TLSH

        6A86789403E40001129B1CEAAA75D56D

        • Path /data/data/lv.mcprotector.mcpro24fps/files/.crashlytics.v3/lv.mcprotector.mcpro24fps/priority-reports/6A86789403E40001129B1CEAAA75D56D
        • Size 35KB
        • SHA256 4fded3c8aa340799d3e4160bebe3f6c6dd11b8a9769a618ee51d7f5f6943bc8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation9133453624596855942tmp

        • Path /data/data/lv.mcprotector.mcpro24fps/files/PersistedInstallation9133453624596855942tmp
        • Size 90B
        • SHA256 3a9dd97ceb8b2fc07ac5647f5408c04bdaf55b28ec217f7311c7339b3c8b482b
        • MD5 SHA1 SHA512 TLSH

        firebase_session_bHYubWNwcm90ZWN0b3IubWNwcm8yNGZwcw==_data.preferences_pb.tmp

        • Path /data/data/lv.mcprotector.mcpro24fps/files/datastore/firebase_session_bHYubWNwcm90ZWN0b3IubWNwcm8yNGZwcw==_data.preferences_pb.tmp
        • Size 50B
        • SHA256 590bfeba60dc64a5a6bc57f559e74f90b670a49ebac74ab0fb575b47a8f41f42
        • MD5 SHA1 SHA512 TLSH

        androidx.window.sidecar.jar

        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 12KB
        • SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
        • MD5 SHA1 SHA512 SSDEEP TLSH