ffd0c7aeb3b2a49d19106f12715b1d0f4adbfc49d4e0e36941e52bd2aada970d

Analysis

max time kernel
6s
max time network
158s
platform
android-14_x64
resource
android-34-x64-arm64-20260325.1-en
resource tags

arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
submitted
20/09/2026, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Gov_F48E09F6.apk
Size 3.3MB
Sample260920-znq8dsdr6w
SHA256 ffd0c7aeb3b2a49d19106f12715b1d0f4adbfc49d4e0e36941e52bd2aada970d
MD5 f632058fbb5f85908e3ca412f549b246
SHA1 34b1d60c0817b5aa472f24837fb9870471ed8b9d
SHA512 2e5cebf630372c71eadd84adeea50487fc3949d4f0b3091ed84e4f75baf77fc1acabf145a545d582d3b202023b75c97740d9a5f37985284ea4e890a8c45ffc60
SSDEEP 49152:X/uamSmrLmwiQCaHDaapEHdHtODStzPwQY3xF7OpKVHmdIZnglh+oTwrmCEFanrl:NmSlwiQHHDJ6mldhNO4+IboTwrmCEox
TLSH
T1C1F5ADCAFBC4A96AC4F75736853552A251474C268B83DEC76D44323C29BBAD01F4AFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Checks known Qemu files. 1 TTPs 3 IoCs

Checks for known Qemu files that exist on Android virtual device images.

defense_evasion

System Checks

T1633.001

ioc	Process
/system/lib/libc_malloc_debug_qemu.so	com.arlosoft.macrodroid
/sys/qemu_trace	com.arlosoft.macrodroid
/system/bin/qemu-props	com.arlosoft.macrodroid

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

defense_evasion

System Checks

T1633.001

ioc	Process
/dev/qemu_pipe	com.arlosoft.macrodroid
/dev/socket/qemud	com.arlosoft.macrodroid

Checks the presence of a debugger
defense_evasion

com.arlosoft.macrodroid
1⤵
- Checks known Qemu files.
- Checks known Qemu pipes.
PID:4328

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

base.4328.tmp

Path /data/data/com.arlosoft.macrodroid/cache/oat_primary/x86_64/base.4328.tmp
Size 60KB
SHA256 8991afbfc8726ff8cf3bacc8915084308173fd24dddd41f73c9bd1d55803c3f4
MD5 d3b7873b809f69f6de9507fc44f3f013
SHA1 cdd55db0e5bcc31ece1b0a6899c9490fe0f2232f
SHA512 51f3ab248ac9db4ab42856c705b9d1503b2d5a856fddbecfe9a709cfc3951ecd3888a17e86ad256ba66a72b1c8a6695d9fb881b44ae38adf4671effeabbc16b4
SSDEEP 1536:Fby6LO5PPkboO29GRYceitDEdrg+gXNOBhOsg7vwHt:FbyFlPfORqOKrK9OBhOsgjwHt
TLSH
T12A536CDFB922C064C2A7BFF69A4600E5E976C01165432C08A866537D9837F68EF74FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads