c049afa6f13b45f33b0e4f41808f32db3374906cc5c79212caa7fc091a2ff8ee

Analysis

max time kernel
29s
max time network
32s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
07/09/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bde526e1ba9846cdb00d714d38770cca_Minigore 2_signed(Fawaz).apk
Size 54.3MB
Sample260907-fx5mlaeh47
SHA256 c049afa6f13b45f33b0e4f41808f32db3374906cc5c79212caa7fc091a2ff8ee
MD5 22510e454a2075fc63ef71db597b2afa
SHA1 e742e0ad6ec8651e85c2d5296ac013c6b607c6a5
SHA512 98347af7816604a2d425cb5dd79ec8e4d8c76b5e86995452d6757f001924fc8bfd94912969a8fb993e199870e237c676d90cae5a69cd91dea88a1b5d8278afc0
SSDEEP 1572864:PjP8V4ooWTMCsdcPXS4FEohSdlEEQqaZzt:L0VTo8MCwKpFRhelEzXZzt
TLSH
T1FCC723C5C9B094D9FC1794B733861BB017A9BE65864A81C7BB2CBA461FF36523C0C9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	net.mountainsheep.minigore2zombies

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/net.mountainsheep.minigore2zombies/cache/1582435991586.jar	4433	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/net.mountainsheep.minigore2zombies/cache/1582435991586.jar --output-vdex-fd=119 --oat-fd=120 --oat-location=/data/user/0/net.mountainsheep.minigore2zombies/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/net.mountainsheep.minigore2zombies/cache/1582435991586.jar	4320	net.mountainsheep.minigore2zombies

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	net.mountainsheep.minigore2zombies

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	net.mountainsheep.minigore2zombies

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	net.mountainsheep.minigore2zombies

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	net.mountainsheep.minigore2zombies

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	net.mountainsheep.minigore2zombies

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	net.mountainsheep.minigore2zombies

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	net.mountainsheep.minigore2zombies

net.mountainsheep.minigore2zombies
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4320
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/net.mountainsheep.minigore2zombies/cache/1582435991586.jar --output-vdex-fd=119 --oat-fd=120 --oat-location=/data/user/0/net.mountainsheep.minigore2zombies/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4433

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

1582435991586.jar

Path /data/data/net.mountainsheep.minigore2zombies/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
TLSH
T1C412AEB4BF77093CD0DB0DB8CA67E800A05F25841AA7D514E0656066BFD47B5F1E315A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_analytics_v4.db

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_analytics_v4.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

google_analytics_v4.db-journal

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_analytics_v4.db-journal
Size 512B
SHA256 dba26bd79cc9c5e57e8b5e5f4edb9dd7b0f4b041b1901cb14cc5f018e6d9e090
MD5 9b416f07cf0c7cb1541c5d4ede4f617a
SHA1 914225073df1e21ecccc8fe4bd33619a31d00b3d
SHA512 2b76bbe3c97c8f7210c3d9f136b4fa48e2fe0adf99bd80852c151d3c2d16db8ca75ad8ab0dd30a16d9abc7d74faf08e3a18015c935023b03a55af833c8d0e31a
MD5 SHA1 SHA512

Submit Download

google_analytics_v4.db-shm

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_analytics_v4.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db-wal

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_analytics_v4.db-wal
Size 60KB
SHA256 d89d2655ec12563184bda07872852997176d3fd14cadf552c757238a2e572f24
MD5 d000f9ceb54fc3410f106cf92112c2a7
SHA1 88ad8a491a1817dbbe38baa7c0ae05aff1831c07
SHA512 79482231a15fd0917af0d49e757cc2c055781dd83fe048820731c6c2ede1a852899b6655b2567160b776fbcc221d681b3de9064f49bdf40b47672f3f95191862
SSDEEP 48:gTzNSP/T8pz6SP/grqrUhnBZSP/zlghX9hWfqrUhnBZSP/13n:u0Pg9/PPr6YP7uB9ICr6YPBn
TLSH
T1D653DFCEAB00FA5EC1D6027AFCE643831D78561D932387C76EB41463AC82258F4B1DA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_app_measurement_local.db
Size 16KB
SHA256 7edce77336280a2fac0240d13a49e92b8b6efff3896a35579b8e676ce527e260
MD5 c0e95017f2937236b20ec342825970b7
SHA1 98c9d05d98ce4ca0f8cce98612d619c01264bb33
SHA512 b4fb7c0aa9cf98f2655586b92aa2d6c6147b0e6a18d0dd32814035d19610a47555b2bc70d396cd66710f06f54c99022dff164108527ff31fb0fb1119b882018a
SSDEEP 12:TgEu9zmzrfRmBEyPbBvOwu06iDLax1HBy61yWl3aQm:Tqpmzr0GSNu0vix7fxxaQm
TLSH
T13A722E899BA4AA07E233073AA4C5E3C06DA4315A4317DB4B775425286E837546511F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_app_measurement_local.db
Size 16KB
SHA256 948857509670cefe069fa77951ae8d08c66c6b87d6ee01fdb67732fc01fef2a9
MD5 7b664782fb50a7db8e043239f398863b
SHA1 a9f6dd09aeae2958f2eeb9c190361bd093877628
SHA512 c22c409ee7d0e47348896681630162bce44cc851f504917e893d82f824fed4b8964a9232ffad28add48e9052d997917d127db1931e654ba9e57a562e462fcefb
SSDEEP 3:o1blE:oblE
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_app_measurement_local.db
Size 16KB
SHA256 afdc948e1a5b16a9190fda9b3c986a1684e1869e0829ef21730f8bb3ed1b5372
MD5 975f8112b07d3056f92f583d2a9551b4
SHA1 0f0ce301c6b0f303cb297c3b37c2cd06e0146444
SHA512 1a00562c9974c4c81f9908a93a5b3fda3b0be406ba502df85df5bf5579a8d2dd96fcb49e105933c4b4ae7c47ae36729b1f18bac63f23607f7baaf3055bc2a7fe
SSDEEP 6:pqo09AiiOlhaHR1HdDyclKG1yWl3lMnvh4C/:V06iDLax1HBy61yWl36p/
TLSH
T19D72C95265E8CA16F1221B3E45F1E5C5649832C30753864A7614771C26923D06225BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_app_measurement_local.db
Size 16KB
SHA256 de7b406452f2c2efbc9ec1f04190ad5f6fcfca8f714d85f2b2e8d624255c9694
MD5 b42218702e87e286abe3ae645bb5a044
SHA1 e50e0001f4ddcfe13048b82c2a26e375ad7a7ed5
SHA512 bda5039f2e2988812f8c198810c9b8bfec8540d83454d5d010b37fcdc2dfa41bdbcc6b44d5fe711c405db3140c83078b646cc3822fd66c270e8f510119c3344b
SSDEEP 6:pqo09AiiOlhaHR1HdDyclKG1yWl3lMTevh4S/:V06iDLax1HBy61yWl33V
TLSH
T1E4722252A5EDCE13F1321F3E44E1D5C0309C32C30343820A7204330C22D23C03124BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_app_measurement_local.db
Size 16KB
SHA256 683203ce5b06a1c9bfd06c994ce5f32cc469a0a6c36f4abed5089a3db59b8c2c
MD5 17750a81540e72136f3084c76e4339fb
SHA1 e9b7f87cc6ccee369078ea4b344d923696a9f847
SHA512 d0f62f290dcd042cfa18e272d0723a68d9829a640e670c2ed3f6d4b5294cfc178c4f7aa822809391c226c219a572747672510cf5e3df3900cde24c57aa1fd9d1
SSDEEP 6:pqo09AiiOlhaHR1HdDyclKG1yWl3lMDevh4Nol:V06iDLax1HBy61yWl3nB
TLSH
T1B972C99265E8CE16F1322B3D85E1D5C5649936C30743864A7614771C259239061257A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db-journal

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 c6c9153d3f4673418e51879fbb05082a1595a0a5f12882c26c1d346f395b75fa
MD5 c2f6f8be0de97a90fc7a73094251b357
SHA1 1f03ebddb8a3bb131ce40315931cfcf6e402ed46
SHA512 b2510b19b91de34e799a8120fd24c54841e2ad770f73a184af5e306a31ee89e762bee1af985114ec2c154bcb258f99098bd82717e94053028b29473e2895ff52
MD5 SHA1 SHA512

Submit Download