Analysis

  • max time kernel
    7s
  • max time network
    154s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260721-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260721-enlocale:en-usos:android-15-x64system
  • submitted
    20/09/2026, 20:52

General

  • Target
    Gov_F48E09F6.apk
  • Size 3.3MB
  • Sample260920-znq8dsdr6w
  • SHA256 ffd0c7aeb3b2a49d19106f12715b1d0f4adbfc49d4e0e36941e52bd2aada970d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 7 IoCs
  • Checks known Qemu files. 1 TTPs 3 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Checks the presence of a debugger

Processes

  • com.arlosoft.macrodroid
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    PID:3192

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        base.3192.tmp

        • Path /data/data/com.arlosoft.macrodroid/cache/oat_primary/x86_64/base.3192.tmp
        • Size 65KB
        • SHA256 db9a09d0cf8dc29accab6e6aad72d7eddb59fafb6ca4d60a13140764c2efd7dc
        • MD5 SHA1 SHA512 SSDEEP TLSH