Overview

overview

8

Static

static

6

BitLife Li...ub.apk

android-13-x64

8

Analysis

  • max time kernel
    12s
  • max time network
    162s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260708-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
  • submitted
    30/09/2026, 17:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BitLife Life Simulator v3.25.1 Mod Oyunindir.club.apk
  • Size 262.5MB
  • Sample260930-vr6d9sdg72
  • SHA256 19e67478cb9a86f603adfc07c1b2e8cf81a48e2e978dad8fa01163a4763c72d6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped Dex/Jar 1 TTPs 8 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Checks the presence of a debugger
    defense_evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.candywriter.bitlife
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4121

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events
        • Path /data/data/com.candywriter.bitlife/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 fbce3afcc75ee08911d8a6c97043f978262533f54e6eb0518806814d17f2ecb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.candywriter.bitlife/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 5b76887c370935099be14d8271380bd64a67c1fdfffef5008f0082029a9d5c1f
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.candywriter.bitlife/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 1f09422859e46100f1c3bd3669a0012e3eba625c68f2e61fb61b6d58d0978b3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.candywriter.bitlife/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 82f877434033723f9cd55a4d0d1337ce7999bcc28e9ee4d98df904a0c73756b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.candywriter.bitlife/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 0e7bcc9d486c27c8e3c1622ce1ac0a3acfb1780210f991fbc88118811b1a0582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.crashlytics.settings.json
        • Path /data/data/com.candywriter.bitlife/files/.crashlytics.v3/com.candywriter.bitlife/com.crashlytics.settings.json
        • Size 772B
        • SHA256 f2732ea1ab64f6427d8b4a975e9527331987143f96ea661554699ebabd17f90b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        internal-keys
        • Path /data/data/com.candywriter.bitlife/files/.crashlytics.v3/com.candywriter.bitlife/open-sessions/6ABD43CC019A0001101952420DA4D5E7/internal-keys
        • Size 107B
        • SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        report
        • Path /data/data/com.candywriter.bitlife/files/.crashlytics.v3/com.candywriter.bitlife/open-sessions/6ABD43CC019A0001101952420DA4D5E7/report
        • Size 877B
        • SHA256 a99017e500f9b8aaa02c0b7dcdb767ec9a29c823aff942b03c587fc1e4186239
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FIREBASE_CLOUD_MESSAGING_LOCAL_STORAGE
        • Path /data/data/com.candywriter.bitlife/files/FIREBASE_CLOUD_MESSAGING_LOCAL_STORAGE
        • Size 188B
        • SHA256 cbd86d32759d46901dfd9abf0aa15da555327a4bdeb5886156edbe3603ad2b80
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation2713872911815501676tmp
        • Path /data/data/com.candywriter.bitlife/files/PersistedInstallation2713872911815501676tmp
        • Size 90B
        • SHA256 dd196763fd20c04df665689b5ee6d7ecd0f8477f5ab3e1ac9cba26845725cdc5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation4306787300968538980tmp
        • Path /data/data/com.candywriter.bitlife/files/PersistedInstallation4306787300968538980tmp
        • Size 569B
        • SHA256 1db796293f7aca1f7ddc80af0f6925d8b589c31d516b09ab5455f0aaa9f201fd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        1790788556341.trace.json
        • Path /data/data/com.candywriter.bitlife/files/bm/quality/startup/1790788556341.trace.json
        • Size 65B
        • SHA256 9b1bb713ec4dbeacb5b324f023227460a1e2dccbf131eaba8fd2da5fad4c085c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        1790788556341.trace.json
        • Path /data/data/com.candywriter.bitlife/files/bm/quality/startup/1790788556341.trace.json
        • Size 64B
        • SHA256 70f37591663738832a23334c8ca3ef5480685f31ba61c6940daf47d02ec775ec
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_data.preferences_pb.tmp
        • Path /data/data/com.candywriter.bitlife/files/datastore/firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_data.preferences_pb.tmp
        • Size 50B
        • SHA256 6c07b1cfa96bcd901bb3f7cca8cfad20ced95c38daaf5d936658d3ef06b55be4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Path /data/data/com.candywriter.bitlife/files/datastore/firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Size 33B
        • SHA256 a4aaa2a4e0cb12123b405a9d33bdd7edf8cbb41ea92e75deb1ba21bf1db5b2a6
        • MD5 SHA1 SHA512
        Submit Download

        firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Path /data/data/com.candywriter.bitlife/files/datastore/firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Size 75B
        • SHA256 1e58e88b20702d0a80025c1fbacc9ad5fe2565311e2230d581d669fbd7e8b0ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Path /data/data/com.candywriter.bitlife/files/datastore/firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Size 121B
        • SHA256 232f9626cbee2e063e25f61a08f46575d019b62f02a6753c1325957a95e1c513
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Path /data/data/com.candywriter.bitlife/files/datastore/firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Size 163B
        • SHA256 7495b9faf55ff02d0a2906ca3e3f4b356abd96e421815f9d07f893682da6eaf2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Path /data/data/com.candywriter.bitlife/files/datastore/firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Size 212B
        • SHA256 e0a525d813df9b98dcd3e9275bb6f053b824a0f62ad8947dc5e332594b5bc61c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        fcb8bdd0
        • Path /data/data/com.candywriter.bitlife/files/fcb8bdd0/fcb8bdd0
        • Size 264KB
        • SHA256 3da34a05437dbaf17725fd034cdf5a1333d66631a146cd0a0ae3fccdc4fb9882
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        installationNum
        • Path /data/data/com.candywriter.bitlife/no_backup/.flurryNoBackup/installationNum
        • Size 100B
        • SHA256 01d633b7c364b2be5674c8ab692afede19cc85add9848ea7cd641a877ec5989a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb
        • Path /data/data/com.candywriter.bitlife/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/com.candywriter.bitlife/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 26ad9d417f03a6e3e285988506635127a692e67f429cddb92dafd36752c28117
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/com.candywriter.bitlife/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.candywriter.bitlife/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 5d7d6c6e3cb59b9b11fa018b7a9fe9bb61767a9903d01369e8d747cf0e249615
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.candywriter.bitlife/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 9974af16bb3fcf1dc36bb5641ea8be283d9828daad95e02fc1d8e48087333847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        [email protected]
        • Path /data/data/com.candywriter.bitlife/oat/x86_64/[email protected]
        • Size 272B
        • SHA256 01b84eda8e83f0a18433cf35ff051aff488bc2f7fb5cab349b9e35aa0cb24fcc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        [email protected]
        • Path /data/data/com.candywriter.bitlife/oat/x86_64/[email protected]
        • Size 69KB
        • SHA256 17da7ef5cb29c63a147f9c3b9bf35812de284efe9bf9d5f3fda4507df0473b72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        [email protected]
        • Path /data/user/0/com.candywriter.bitlife/[email protected]
        • Size 5KB
        • SHA256 ee4e74515cec02d4e83aa89be64c215dec080300fc40ac273cf81ddaf4b67d52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        [email protected]
        • Path /data/user/0/com.candywriter.bitlife/[email protected]
        • Size 55KB
        • SHA256 e17201bb7419b8dc8cb6bc5a6b20a751fd82c244b9413dc76da8f46fa8032dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        [email protected]!classes2.dex
        • Path /data/user/0/com.candywriter.bitlife/[email protected]!classes2.dex
        • Size 5.0MB
        • SHA256 a710fe4a5b7136be1ef29889eb3a6597a41493bc1b1bef0be49e083e85e338cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        androidx.window.extensions.jar
        • Path /system_ext/framework/androidx.window.extensions.jar
        • Size 123KB
        • SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        androidx.window.sidecar.jar
        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 25KB
        • SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        anon_inode:[eventfd]
        • Path anon_inode:[eventfd]
        • Size 8B
        • SHA256 7c9fa136d4413fa6173637e883b6998d32e1d675f88cddff9dcbcf331820f4b8
        • MD5 SHA1 SHA512
        Submit Download