Analysis
- max time kernel
7s - max time network
154s - platform
android-15_x64 - resource
android-35-x64-arm64-20260721-en - resource tags
arch:arm64arch:x64image:android-35-x64-arm64-20260721-enlocale:en-usos:android-15-x64system - submitted
20/09/2026, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
Gov_F48E09F6.apk
Resource
android-x64-20260721-en
Behavioral task
behavioral2
Sample
Gov_F48E09F6.apk
Resource
android-x64-arm64-20260721-en
Behavioral task
behavioral3
Sample
Gov_F48E09F6.apk
Resource
android-33-x64-arm64-20260721-en
Behavioral task
behavioral4
Sample
Gov_F48E09F6.apk
Resource
android-34-x64-arm64-20260325.1-en
Behavioral task
behavioral5
Sample
Gov_F48E09F6.apk
Resource
android-35-x64-arm64-20260721-en
Behavioral task
behavioral6
Sample
Gov_F48E09F6.apk
Resource
android-x86-arm-20260721-en
General
- Target Gov_F48E09F6.apk
- Size 3.3MB
- Sample260920-znq8dsdr6w
- SHA256 ffd0c7aeb3b2a49d19106f12715b1d0f4adbfc49d4e0e36941e52bd2aada970d
- MD5 f632058fbb5f85908e3ca412f549b246
- SHA1 34b1d60c0817b5aa472f24837fb9870471ed8b9d
- SHA512 2e5cebf630372c71eadd84adeea50487fc3949d4f0b3091ed84e4f75baf77fc1acabf145a545d582d3b202023b75c97740d9a5f37985284ea4e890a8c45ffc60
- SSDEEP 49152:X/uamSmrLmwiQCaHDaapEHdHtODStzPwQY3xF7OpKVHmdIZnglh+oTwrmCEFanrl:NmSlwiQHHDJ6mldhNO4+IboTwrmCEox
- TLSH T1C1F5ADCAFBC4A96AC4F75736853552A251474C268B83DEC76D44323C29BBAD01F4AFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 7 IoCs
ioc Process /data/local/bin/su com.arlosoft.macrodroid /data/local/su com.arlosoft.macrodroid /system/xbin/su com.arlosoft.macrodroid /system/bin/su com.arlosoft.macrodroid /sbin/su com.arlosoft.macrodroid /system/app/Superuser.apk com.arlosoft.macrodroid /data/local/xbin/su com.arlosoft.macrodroid - Checks known Qemu files. 1 TTPs 3 IoCs
Checks for known Qemu files that exist on Android virtual device images.
ioc Process /sys/qemu_trace com.arlosoft.macrodroid /system/bin/qemu-props com.arlosoft.macrodroid /system/lib/libc_malloc_debug_qemu.so com.arlosoft.macrodroid - Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
ioc Process /dev/qemu_pipe com.arlosoft.macrodroid /dev/socket/qemud com.arlosoft.macrodroid - Checks the presence of a debugger
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.arlosoft.macrodroid/cache/oat_primary/x86_64/base.3192.tmp
- Size 65KB
- SHA256 db9a09d0cf8dc29accab6e6aad72d7eddb59fafb6ca4d60a13140764c2efd7dc
- MD5 159e96360609ebdc37b903980b1d594c
- SHA1 9900c857503abdf513763f3f93bc67132804eb06
- SHA512 4d89b4607848750aca3a8804e8dacb0acfeb1c08d5b29acddb9e68f5f19abba26355444b98000077e9e9082bbc4871319db256dabee174e25995dbce79d39190
- SSDEEP 1536:3IVDw8905561uKEtOiumq5TDt7YduNU7spkLvF40:4Vx90XguH253sd7/bF
- TLSH T1E8634CDFBE22D050C1FABFF69A4604E5ED728112214728086C66677E9837F18D774FA4
- MD5 SHA1 SHA512 SSDEEP TLSH