Analysis

  • max time kernel
    3s
  • max time network
    66s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260708-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
  • submitted
    02/10/2026, 22:32

General

  • Target
    com.mojang.minecraftpe-1.26.52.3-free-www.apksum.com.apk
  • Size 352.9MB
  • Sample261002-2f7aravang
  • SHA256 b0389408ea16f19e77ac75b75fbd1101d49c7ad7670f1c537b74e3e96726dae7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Hides multimedia files using a .nomedia file 1 TTPs

    Android's media scanner ignores any directory that contains a .nomedia file. This hides your photos, videos, and audio from the gallery and other apps.

  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.mojang.minecraftpe
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Queries information about active data network
    • Checks CPU information
    PID:4177

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        journal.tmp

        • Path /data/data/com.mojang.minecraftpe/cache/appboy.imageloader.lru.cache/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events

        • Path /data/data/com.mojang.minecraftpe/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 64dc64a2d9974f0586718439655f393d30c920daf8ba463a95c6f0b8d4575449
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.mojang.minecraftpe/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 768a12831003a472611ddd3d0d10a1acabd82062c9b33a22e6a4f501800d0385
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.mojang.minecraftpe/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 f609a3d928c4559c5a0dac53499566c21628a2bb30178ad78472e6deda86fecc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.mojang.minecraftpe/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 4a1ec8f28c31caf3b846fa85e8851a78131241d3f308d76af5fb0b402b355600
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation6775357226857920777tmp

        • Path /data/data/com.mojang.minecraftpe/files/PersistedInstallation6775357226857920777tmp
        • Size 90B
        • SHA256 e81fadc10e6a34347155706217b3a989f3e59411742eaa51d5eda31a0941e15d
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8553185421229298954tmp

        • Path /data/data/com.mojang.minecraftpe/files/PersistedInstallation8553185421229298954tmp
        • Size 570B
        • SHA256 015b94ddae7c459237d3428e09297195da8b6be2d7977d449a565e12964efe7a
        • MD5 SHA1 SHA512 TLSH

        external_servers.txt

        • Path /data/data/com.mojang.minecraftpe/games/com.mojang/minecraftpe/external_servers.txt
        • Size 383B
        • SHA256 33e15907dc11002171fd7720e6be74b37b67cbc4c2c5cb05e55d2cc9a11ec025
        • MD5 SHA1 SHA512 TLSH

        options.txt

        • Path /data/data/com.mojang.minecraftpe/games/com.mojang/minecraftpe/options.txt
        • Size 32B
        • SHA256 5682e4367b106fa65afbf57daac85d3002163bee03ad7218c93db10622169201
        • MD5 SHA1 SHA512

        pe_world_servers.txt

        • Path /data/data/com.mojang.minecraftpe/games/com.mojang/minecraftpe/pe_world_servers.txt
        • Size 299B
        • SHA256 2dbd0314b63ff96ef1a685aa1462c92c8e75c3883afc0ab76e0ee3f533a88260
        • MD5 SHA1 SHA512 TLSH
        • Path /data/data/com.mojang.minecraftpe/oat/x86_64/[email protected]
        • Size 404B
        • SHA256 8f95d75700810f1d8960e2a2ee693d44cfc9a2dc6c99363fbaeb80beaa2e6acd
        • MD5 SHA1 SHA512 TLSH
        • Path /data/user/0/com.mojang.minecraftpe/[email protected]
        • Size 8KB
        • SHA256 460af80321f8410e688a8a3975b94c629e78b50f7d170894e41e3005b6b296af
        • MD5 SHA1 SHA512 SSDEEP TLSH