General
- Target GoreBox-8-5-4.apk
- Size 252.4MB
- Sample260910-s6rhjsdn6y
- SHA256 752a56a97aa4dd82c5684f0f1b0e91318bb2b5f8125331f1292c9186ea29a936
- MD5 9129c0d441b9849d58b4708ef1b3cb46
- SHA1 c63fd3d399a52b5d6c2225a7b4d68becf71460a5
- SHA512 bdca8f42dfde54d7230998e6c35e55ba4f2543765eafefc228c4ef6a6cac7a2a56bcb7bd577a7d6088f4fd7ef630fa1b49998ebc4f3be61c97a20fb35b88df8b
- SSDEEP 6291456:ToyRCfZ4AaBVlHNBiQVnwKWZmnnlrzMKvP9nZzsf:ToUCSAmxiewKWZmnnWKvVZzA
- TLSH T1E6C81262B7C19E00D7F9C03994A79AB8F8DBCE0195237EEAC912B2F65D367043479721
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
GoreBox-8-5-4.apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral2
Sample
GoreBox-8-5-4.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
GoreBox-8-5-4.apk
Resource
android-33-x64-arm64-20260708-en
Behavioral task
behavioral4
Sample
GoreBox-8-5-4.apk
Resource
android-34-x64-arm64-20260325.1-en
Behavioral task
behavioral5
Sample
GoreBox-8-5-4.apk
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral6
Sample
GoreBox-8-5-4.apk
Resource
android-x86-arm-20260325-en
Malware Config
Targets
-
- Target GoreBox-8-5-4.apk
- Size 252.4MB
- SHA256 752a56a97aa4dd82c5684f0f1b0e91318bb2b5f8125331f1292c9186ea29a936
- MD5 9129c0d441b9849d58b4708ef1b3cb46
- SHA1 c63fd3d399a52b5d6c2225a7b4d68becf71460a5
- SHA512 bdca8f42dfde54d7230998e6c35e55ba4f2543765eafefc228c4ef6a6cac7a2a56bcb7bd577a7d6088f4fd7ef630fa1b49998ebc4f3be61c97a20fb35b88df8b
- SSDEEP 6291456:ToyRCfZ4AaBVlHNBiQVnwKWZmnnlrzMKvP9nZzsf:ToUCSAmxiewKWZmnnWKvVZzA
- TLSH T1E6C81262B7C19E00D7F9C03994A79AB8F8DBCE0195237EEAC912B2F65D367043479721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Checks Android system properties for emulator presence.
-
Checks Qemu related system properties.
Checks for Android system properties related to Qemu for Emulator detection.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.