c049afa6f13b45f33b0e4f41808f32db3374906cc5c79212caa7fc091a2ff8ee

Analysis

max time kernel
29s
max time network
33s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
07/09/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bde526e1ba9846cdb00d714d38770cca_Minigore 2_signed(Fawaz).apk
Size 54.3MB
Sample260907-fx5mlaeh47
SHA256 c049afa6f13b45f33b0e4f41808f32db3374906cc5c79212caa7fc091a2ff8ee
MD5 22510e454a2075fc63ef71db597b2afa
SHA1 e742e0ad6ec8651e85c2d5296ac013c6b607c6a5
SHA512 98347af7816604a2d425cb5dd79ec8e4d8c76b5e86995452d6757f001924fc8bfd94912969a8fb993e199870e237c676d90cae5a69cd91dea88a1b5d8278afc0
SSDEEP 1572864:PjP8V4ooWTMCsdcPXS4FEohSdlEEQqaZzt:L0VTo8MCwKpFRhelEzXZzt
TLSH
T1FCC723C5C9B094D9FC1794B733861BB017A9BE65864A81C7BB2CBA461FF36523C0C9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	net.mountainsheep.minigore2zombies

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/net.mountainsheep.minigore2zombies/cache/1582435991586.jar	4728	net.mountainsheep.minigore2zombies

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	net.mountainsheep.minigore2zombies

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	net.mountainsheep.minigore2zombies

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	net.mountainsheep.minigore2zombies

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	net.mountainsheep.minigore2zombies

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	net.mountainsheep.minigore2zombies

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	net.mountainsheep.minigore2zombies

net.mountainsheep.minigore2zombies
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4728

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1582435991586.jar

Path /data/data/net.mountainsheep.minigore2zombies/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
TLSH
T1C412AEB4BF77093CD0DB0DB8CA67E800A05F25841AA7D514E0656066BFD47B5F1E315A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_analytics_v4.db

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_analytics_v4.db
Size 28KB
SHA256 2e36148d6b01e64fcaac67996f702bbc70248e40c30fd7874e6a9fb57bf75ecb
MD5 700dd2cf8911e5fc8acacf6115090fea
SHA1 c282152942d2ab0f1badc2a46c341d347d3c6387
SHA512 5304fe6fe755377a154fd5b6eb1f80568ec9217424c6295ec3667f890a9841caaf23c41fc93dad76f61b7f9814ffe3f348216bbcd8c01b8cbd7a659537fc17a5
SSDEEP 24:TLOLVXixByqQWWEqrUhCafBGBGSiGUBW3wyD:TChX9hWfqrUhnBZS13wM
TLSH
T183D221CE8B10BA25C7E00438E9A152E34D6C590E9B2707D3AFF51073ACC31207851C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_analytics_v4.db-journal

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_analytics_v4.db-journal
Size 12KB
SHA256 25b5b40defe9e340672d297ac78b62aad07479eff41cfbd7fdd83d5af11177a2
MD5 4343a6d81e5450bd208c98ac7ad7d740
SHA1 14c2344dff6b68c35db9c9b5773d08fb635e2882
SHA512 3d6a24db99089bb0b73a85b3eecf2341b58982ed2b5df319e7f274e6343198592561c3196cf400308310a753e2941d9a4bf8fe08518b4ff0f26d4f38f88089d2
SSDEEP 24:7+tbbgDfqLuPLVXixByqQWWEqrUhCafBGBGSS:7MP4qCPhX9hWfqrUhnBZSS
TLSH
T1FC42498E9B24BA12C2E10476FCE101935C3C225EE7735AD1AEF015F3DC422646552C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_analytics_v4.db-journal

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_analytics_v4.db-journal
Size 512B
SHA256 38742b5014b249d7d7e1d296db57ebda30a09d546055f4bbbf001431486bccd2
MD5 02f5bbd1a3800f54d720435368e73404
SHA1 fd8c5d25b29a3edfd9584a0b3e6d761101c46d84
SHA512 afc7c1360ccb17e57b9664469e9b367c599e528ab0ff961be1dcddc4a48b618538d786151e2b133a72c5849dfce9212850f61c8af89aa381c094d5ac212e88e5
MD5 SHA1 SHA512

Submit Download

google_analytics_v4.db-journal

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_analytics_v4.db-journal
Size 8KB
SHA256 208b8082821865e13dd895a01c106719edb2ce4080ffc30ebdf711f95493635a
MD5 fdc25a9d47c5fdd885ebe3d3255e1078
SHA1 9e31b2a13494ff0acb361849d297e6117d5c505e
SHA512 7958cff60ed5e06cabbf5d41db1c318c1a2ca288e9fbe5c727f58b6ea7836383c2b8d187ceee6dd39747be1c00e63d8828a83810241aa833c05c059904152d41
SSDEEP 6:7+/l97KOn1Sfg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKg9A:7+tZyfqLiuWdYRmBEyPbbA
TLSH
T15402C08C63800B23C82D17FB90D583402D00EB2F9B71CB9717900CA43C075CCE4B0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_analytics_v4.db-journal

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_analytics_v4.db-journal
Size 4KB
SHA256 4a6d8163491554a77a30c539b4196fdae4fd4eadc5f7b860cf6dd6e929ce3320
MD5 398debf787e86bae531dd5e4e9264cf4
SHA1 7686761fa7fdf006dd935c1a23118d55dfbacc90
SHA512 5ebd2363b5479715d008bc2fc096238e81cd1630acd4fcdda6765a3a8cb400c7e58f6976a68fb9c1219feb2b7d88cbbe8149e2171198fcbd8aeac29a54155dfa
SSDEEP 6:7+/lTzPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK4:7+tPqLJdeWRmBEyPbX
TLSH
T18591809A67411913C5395F77A0D783541D5567399373CB5B269108547C476CCE4F0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_analytics_v4.db-journal

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_analytics_v4.db-journal
Size 8KB
SHA256 e049d8ed5e0565f90cc93724137cbe6c0ad3190cdb6e7d8fd124d77f8ee82fd1
MD5 99b59432c5b66773ec5234911dea18bd
SHA1 6698d9fa779f4c3ac9e89b18dd13a901ad9f4ede
SHA512 e5644a28a89587fb20a7ec67657b7d05ac39f7117f982374640ffa1d550afa0c82f85afe488972ca078013ed451230b8b9df0f1c8e4d3cb2b119808f79a5af2a
SSDEEP 6:7+/l9r5Pg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuKxM/Cg6:7+tRlqLmqKRmBEyPbpG
TLSH
T14102228A63830C23C22A6A77E0C8C3400E00E3358321CB071AA108A42C0F4CCA8A0D40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_analytics_v4.db-journal

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_analytics_v4.db-journal
Size 8KB
SHA256 9e65f4dd38a64527c3df3c4cde56a3bb314b7f58850c8b12b07902483215e9c9
MD5 6759c44cd63afa9546401dac263faab6
SHA1 d2f234c839bc13cdef7f6d8edcc00b0f1504596b
SHA512 f43bda08207ce65d4846f846a5154adf62c19e8dcebd04e4606cdbb7622c52e1bd2eb97e41cd59f6a0dc576741d330126204758f65ba74db31406ad594dae92e
SSDEEP 12:7+t78nqLyKP8yNTSFbyYrrQXxFgjOt97aXJjzjkGyRmBEyPbnlJV:7+t7kqLy2JqrUhCafBGBGSnlX
TLSH
T1AE02528F5B21AA02C0A44535ECE942C31D3CA25E93634AC22AF01463AC83288A0E1CB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_app_measurement_local.db
Size 16KB
SHA256 6d73a9c89f4636126dfd443c0a137231c2451a9e4804f3acd6b30443f213b726
MD5 d1eaed65856ab030462c4e0df1c30fbe
SHA1 78671ebb0bd29d893f8e57c95f6712db89e6d4b6
SHA512 450291b14d83ce55c44e8a61118f1a3fa85a5080037cc46281f82639b689e3ae4200481223bcabeae50c68c59cf2cae6e1485af82663e4fcb29edc148ceb402f
SSDEEP 12:TLWuEmO9zmzrfRmBEyPbBvOwu06iDLax1HBy61yWl9G9:TLROpmzr0GSNu0vix7fxTG9
TLSH
T19D722E99DFA4DA07E1370B3BB8D5D3D07DB4725A4327DB07375429286D43284A150F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_app_measurement_local.db
Size 16KB
SHA256 f022a9179a3894edc03363e271057e48932fc85afba45a928e387c1e7e82ae9c
MD5 dc1d95042cd02169ad92982a500ab6ed
SHA1 02d9c432b115ee9a97ad5d431087812e3c4ec6e0
SHA512 185b019217b71c6a9bbb3d64109e34e5a13b5a95dc87e5ab3a9f838851d818b93703322638cf6a22bdc617dafab8e3e2f849f16dda3077d03ff8da6d3288e192
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WblE:TLiEq9zmzrfRmBEyPbP/W
TLSH
T170722BCD9F102603C1730777B8CE93915C14A22D83779E472BD90870ED43449A091F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_app_measurement_local.db
Size 16KB
SHA256 8e2e3491a911187c6aa275979cbe658c3531e3f6856aa68965c2ae933d1e83f0
MD5 accd219a31b2791a31d6a0d76f47f3c2
SHA1 35670c877e5416266665934c9e2fb9ef326ed339
SHA512 7af1389c00ad83b58e185f49962d0a463bdb22374a482b49490dd42311edb477ec770068c1e688c21b9c3b29baaf44314e6e2a2aeecd066178fdc40d994c22f4
SSDEEP 12:TL1E39zmzrfRmBEyPbP/n06iDLax1HBy61yWl9t9/:TLopmzr0GSP/n0vix7fxTt9/
TLSH
T19B725C8D9FA4DA03F2730B3A74CAD3D07C7472578727DA073B542A286E83284A151F64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_app_measurement_local.db
Size 16KB
SHA256 712082bc7b2a95ba9c42b37b3ffc01643b0762ff533122f63819b2a635a2c2e3
MD5 3de5ae44297c1e34483b95186d71bd82
SHA1 d52db1987461c878588ec6a42d1d47acccab9244
SHA512 683d4db2e7c37e48e8e7d38a116fadff6ff1d633ace7fea28ef6f86efcc39e361c049574cb06ce9af349466e101405770721b4e294aff411e80bb240f00723f8
SSDEEP 6:l9bNFlils1InlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WblE:TLIEU9zmzrfRmBEyPbP/W
TLSH
T117722BCD9F102607C1770773B8CD93A15C14A22D83379E472BD90870EE43449A151F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_app_measurement_local.db
Size 16KB
SHA256 860d6ca0081d5fd55779a0cce8e09166ebde21e7346f3268dfe2cb34f15564bb
MD5 e5fa33576386edd80d31ccf3e1e9ad66
SHA1 ff8b361a09c515c7dc22e63da70b6712e62c08e8
SHA512 031ae2ed5dbd6e3466be9a53fc21f4717b018176aa93937c3c40225a5310a1a61bfa92cd9d99e3ed9f93b0b898e367d7a128578433d85f1b9f75bf3942612bbd
SSDEEP 12:TL6uER9zmzrfRmBEyPbP/n06iDLax1HBy61yWl9CnE:TL6vpmzr0GSP/n0vix7fxTCnE
TLSH
T1A7725C899FA4DA03E1330B3B78C9D2D16C747246472BDF0B3B5429286D832C5A151F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/net.mountainsheep.minigore2zombies/databases/google_app_measurement_local.db
Size 16KB
SHA256 2309a060a288d420ea78401097fdb0948167bf3a55cbf9582333dd9d7c7297d2
MD5 4b3c666b55e57714ac6efddd60bc55e6
SHA1 7b5208acab2288ffc9429f451847cec20acaa0ca
SHA512 be5de063b137bc352832e5b2beefecec4e47dff75e1ec163168129aa9898043c94c6fe2ff2a071ae7e17bdb73c9edaed4e2938eed1f12fdc44b270572525b714
SSDEEP 12:TLIWEf9zmzrfRmBEyPbP/n06iDLax1HBy61yWl9oc4:TLopmzr0GSP/n0vix7fxTob
TLSH
T13B725C899FA4DA03E1370B3A74C9D3D06C6873874327DB0B3B942928AD83284A160F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download