4a40103e62dc47f499cc05423118737f4e9a98850ccf7b408f677fe7468e59e0

Analysis

max time kernel
29s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
05/09/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
maxludo.apk
Size 7.0MB
Sample260905-pnngdsvbka
SHA256 4a40103e62dc47f499cc05423118737f4e9a98850ccf7b408f677fe7468e59e0
MD5 f8ffc71b10598a710334b9cab5bafb13
SHA1 7015c68cc939094f599d4c41a3fff9fb9afb20e9
SHA512 046575a74a4bbe6cd48600cd29d18ad9a0677c3e24fa86d177d63eb75f464d17ac555caae57d403ff819a9670d1a016b93af048cf5dd2bea33e7b8ccc5cf218a
SSDEEP 196608:3R5OeC8AsjtmEtvjJCpXmHByhVbiLS6nR:vOKRtRvj0aBIVbiLv
TLSH
T10F760185FB58E52BC47BB03606AA6722514B4D5A8E83E74369483E4C6CB79D40F4EFCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.MaxLudo

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.MaxLudo

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.MaxLudo

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.MaxLudo

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.MaxLudo

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.MaxLudo

com.MaxLudo
1⤵
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4388
- logcat -c
  2⤵
  PID:4421
- logcat
  2⤵
  PID:4436

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.InstanceId.properties

Path /data/data/com.MaxLudo/no_backup/com.google.InstanceId.properties
Size 2KB
SHA256 72ee3ff35a439b32f4a4206c8f0ec055c5e63abadef961b50243795da5cca837
MD5 7901dfc4d34cc17da91f0b73d6356407
SHA1 70a338503724576002facefffd7f4ef69e2621fb
SHA512 2be1a89639f6a20f85364cfeb38f8cb33be6750d59cc5b4778e1a426c59a759afa1ea6580eed99cab25baf5732236ddb79f538fa88602a39fed692ae3e1121c8
TLSH
T11C413A3213EB5D5A091A9B360A2E29EFA66DB5C366F4D06D43A09A00AD4D489E77CB10
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads