Analysis
- max time kernel
46s - max time network
153s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system - submitted
24/08/2026, 01:57
Static task
static1
Behavioral task
behavioral1
Sample
Mugacrypt-1-debug.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral2
Sample
Mugacrypt-1-debug.apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral3
Sample
Mugacrypt-1-debug.apk
Resource
android-33-x64-arm64-20260708-en
Behavioral task
behavioral4
Sample
Mugacrypt-1-debug.apk
Resource
android-34-x64-arm64-20260325.1-en
Behavioral task
behavioral5
Sample
Mugacrypt-1-debug.apk
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral6
Sample
Mugacrypt-1-debug.apk
Resource
android-x86-arm-20260325-en
General
- Target Mugacrypt-1-debug.apk
- Size 29.2MB
- Sample260824-cdnm7asbmd
- SHA256 cbe19a7222bc062fc802d0df9f9d4b5dc726d9812e84c9226e84a051a3811a04
- MD5 7f078c5deba4184cb830fa665f723f0d
- SHA1 faae91b9a919a1b0db96ace9b283a2b98c9ba0a5
- SHA512 23bc79e2108c3b848f522604bea835a5c140e9d20893b47c5b75c069e6e304bd4b179c234942e6e66257decb932dbda2696793589fa8bc15d4e1d38e309566f9
- SSDEEP 393216:OPUzK0ca37sMJdyrgacadeuN87vv13uFnCPw5Yv3upJXTx+Rv13uFnCPwPv3upJ+:YUzK8VJQrQgh8qd0IZ
- TLSH T13D67BE02FB194836D9EAAE7451AB433176362D55539393D71A08F6282DB32F88F7D3C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
pid Process 4304 com.jumpgames.rswrb - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.jumpgames.rswrb - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.jumpgames.rswrb - Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.jumpgames.rswrb - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.jumpgames.rswrb
Processes
-
com.jumpgames.rswrb1⤵
- Removes its main activity from the application launcher
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4304
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.jumpgames.rswrb/files/encryption_log.txt
- Size 66B
- SHA256 10f3d6f5a86a03b7fb22600e51b06bf62195e5cbba4cd98af75a499b890324a2
- MD5 239fb01f70138870a4d80bc24ba3576e
- SHA1 74a8da736f44fda93febbfea8c51b5450e323ae6
- SHA512 a79de25678b232cad8bad20eb725ac48dd7082fab6a37ed14e199b31a9b28ecfacfc3b623debc0eb7add9eb6c77b3fd56759af36c3597146eee86a411043f2e8
- TLSH T18CA022EB00E88B2280C0808CB008B2333B8C38C8300080000B3822C00A003200F3AA02
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.jumpgames.rswrb/files/encryption_log.txt
- Size 62B
- SHA256 44eab3e632d702616b40da81507182d92e68ecac9ce5049d91c98dfb2acb9e0a
- MD5 67e1cf6b184f60e2810c14fa5c41388d
- SHA1 2fbd8edf8718dec04eb137f2eecd99e03eaa1a05
- SHA512 d621fc5598536a144b44121e7b73b5b47dbb9b55fa9138a8cb1856fd78f4fd125443b39549a1381244475f041e14dabecf50932b72aa2303e79754a4f5cb668a
- TLSH T1DBA00279E4F037351855812CB103B66A7648F486C4559903027C34D5C5E1C62CC93115
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.jumpgames.rswrb/files/encryption_log.txt
- Size 60B
- SHA256 a20208cbc0d11062bec4b9da083d0e13123f2f6636d9a1719d0e6e133fe20c42
- MD5 236c3631eadc38cc5865ff67f631c6cd
- SHA1 176a6483177260de279e9e8fb4fe8d43d2108597
- SHA512 2434bd98d30d76a982956a3c6ff1d9f3f2fb83a1d3c1e9c0cae39c486913bb5770cca059d2751f919a010a99357826f9f1028f0e3810fc71a83295721ae243e7
- TLSH T117A0020541A8297649321B6A51CED7727808B4542095661A05464940D7C1D54C8E1328
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.jumpgames.rswrb/files/encryption_log.txt
- Size 64B
- SHA256 18a344fd902bdfca270f103dcaf45e92ab8d3ca00caed1d37eff88ddbf98ed6f
- MD5 c24f2ab215a7949bad40de1d2d9a2264
- SHA1 43efa0c827b5e81ecbac630b24466c86e6b2fc82
- SHA512 d3bd57b9411eafe4c0d6447bc21b007c223054463e5c0be82e507995fe5cf627398b5a9faaf80ee79cb5b035244f8a7e2ecf9953eb2e0620c757a7f6b0b3bfc3
- TLSH T147A0220002E00CB2E002220CA00F2B208B2C30C8300022002A0803C202C0E28ACA0C0C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.jumpgames.rswrb/files/encryption_log.txt
- Size 52B
- SHA256 b4bd17e8ff317c33614bf3a7cd478e4e23acfd7a9eea182cf5dfde810cbf8b9e
- MD5 efdad247e6e5e01884a863f0b8fb5ca4
- SHA1 b3047b51615bc73db3932430575319296087b2b3
- SHA512 6180d585fe83f8e083c809941297e7e35059ad3fd6d52bcf1e2bb21c204d377d879acc01b0404904b5bae20bd9d369bec9be1ad690da6fa78ac898592ecfac2c
- TLSH T1219002E650E12C919461425DF5021AF2E514B08046055640176610930DEC9284850547
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.jumpgames.rswrb/files/encryption_log.txt
- Size 80B
- SHA256 499002dd031eed6db56dd1b070cf0eab8efc8bb6b21ee4c274d5fe4e95b5923c
- MD5 92c4039a1f0062d80c583b06c2a9ae63
- SHA1 0bad876b6d9963236b66a1055e8126080bb9f814
- SHA512 0d999820e13350f65db8bdc0017cf3e9e8f991e27a15a5d058fd4b31f3884c5f010675e35a5c04f263aafb16ec600e9ff94a720b2a2414c33b502cab8b3bb33d
- TLSH T13BA0243010F445100C40507C703D7173374CFF5430037C5045FD0041D5C0D105C55F04
- MD5 SHA1 SHA512 TLSH
- Path /storage/emulated/0/Download/a4bRMCvMugacryptfnEGyu.tmp
- Size 9B
- SHA256 296d25842c27d7824bcc49df369732a603a457d9a2e31f5947e35459ba229003
- MD5 8528097127acc64feb81c9eba97574cb
- SHA1 9a0ea7d089dc79cb89c660ed1ef6aca0742a7fb4
- SHA512 76e1dcc9e106d0fbcdb24b5b252fe0649c1d89957fed78838fcc648853ffb0e12f36fd807bb10d42b6d465a53c23a237e04d744545dbd5b12c942f8aa0baccef
- MD5 SHA1 SHA512