General
- Target pocket_option-release.apk
- Size 5.7MB
- Sample261002-pmfedswves
- SHA256 e6d57d4e79182dc9ea9dca4ad2d33bf2c4bb2155c5bf866658271155d60c9123
- MD5 79335fd55c62765431ade182cf56b06a
- SHA1 015e2f782d7b114482ec25dcb47c924493dc6344
- SHA512 7073063bb11296ef035b7f233719f73b83acdb202511b37f5e1fb5ad30960415a5e81931b340ee2c5ce65e7e08ab1ce6c19ef375068bd8b20dcf838a41a55c37
- SSDEEP 98304:orsygeQrGngl7Zdoa5JZDj6a4iV78oQwpZ8Vs8IJpokWF++l23qY2N1wDrKdAjej:PRek0gtZma5Oa/V4oQwpZ8Vs/o++cbKp
- TLSH T18A56F186F7585B2EC87650734DDA2635229A4D678F82DB877844372C38B36F80F49BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
pocket_option-release.apk
Resource
android-x86-arm-20260325-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
pocket_option-release.apk
Resource
android-x64-20260325-en
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
pocket_option-release.apk
Resource
android-x64-arm64-20260325-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target pocket_option-release.apk
- Size 5.7MB
- SHA256 e6d57d4e79182dc9ea9dca4ad2d33bf2c4bb2155c5bf866658271155d60c9123
- MD5 79335fd55c62765431ade182cf56b06a
- SHA1 015e2f782d7b114482ec25dcb47c924493dc6344
- SHA512 7073063bb11296ef035b7f233719f73b83acdb202511b37f5e1fb5ad30960415a5e81931b340ee2c5ce65e7e08ab1ce6c19ef375068bd8b20dcf838a41a55c37
- SSDEEP 98304:orsygeQrGngl7Zdoa5JZDj6a4iV78oQwpZ8Vs8IJpokWF++l23qY2N1wDrKdAjej:PRek0gtZma5Oa/V4oQwpZ8Vs/o++cbKp
- TLSH T18A56F186F7585B2EC87650734DDA2635229A4D678F82DB877844372C38B36F80F49BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Checks Android system properties for emulator presence.
-
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock
-
Queries information about active data network
-
Reads information about phone network operator.
-
Checks the presence of a debugger
-
Listens for changes in the sensor environment (might be used to detect emulation)
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2