593f906db142979af228f2c267240ea5226d5d481eadad6c6a836d5cc5bc1e02

Analysis

max time kernel
123s
max time network
303s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
03/10/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hill Climb Racing v1.72.2 Mod Oyunindir.club.apk
Size 120.9MB
Sample261003-nnzzrays2l
SHA256 593f906db142979af228f2c267240ea5226d5d481eadad6c6a836d5cc5bc1e02
MD5 a074230647ff0156318b2548e7a94a78
SHA1 6f06c767c6f0b2abeefe7de77c59132e2cb5b032
SHA512 ff947c12051ddc99cffab05b3397f503c7f27c371c9d9fac7f252269415ea94610570408f6cd601c3451821fc80533fd41ac8226cc920b861e76d0d629330b95
SSDEEP 3145728:ry1AbFpMThOp6lB0LSt9Cs3tGPTKOdBhlcWsIwaz3QKNn20:rkdAAKLQ8bKOdBhbZw+3QO
TLSH
T14B583355FAB0F966C43B903209E911211D270F47DA82DE8A7A8C751E2FB3BD44E477CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.fingersoft.hillclimb
/system/xbin/su	com.fingersoft.hillclimb

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.fingersoft.hillclimb

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.fingersoft.hillclimb

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.fingersoft.hillclimb

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Enumerates files in the device's shared storage. 1 TTPs 1 IoCs

Queries the system media store to list files across shared storage, letting the app discover what documents and media are present without opening them.

discovery

File and Directory Discovery

T1420

description	ioc	Process
URI accessed for read	content://media/external/file	com.fingersoft.hillclimb

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.fingersoft.hillclimb

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.fingersoft.hillclimb

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.fingersoft.hillclimb

com.fingersoft.hillclimb
1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Enumerates files in the device's shared storage.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:3397

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

File and Directory Discovery

T1420

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3397.tmp

Path /data/data/com.fingersoft.hillclimb/cache/oat_primary/x86_64/base.3397.tmp
Size 914KB
SHA256 ac2524260b4ca5992e22b1cae469819af07c3b6ddb734fae9bdf06a7c1311598
MD5 7482813691ae953215d093ce277e5549
SHA1 af56fdfb9006e1d988ab5a633cd101e634e5512e
SHA512 d7d88f8e97c1a04573623f792771b4bee1faa3e5f0edd0d4a16d67f5466033e461f482ef73601b04cef144254b33d2c2b9cd13aa5f3fdb984e8e9e66adf55bc0
SSDEEP 12288:rpNMQi395N4WOjJi88L6Z6Ek2rcpCfqXoy6Bmn2Gn2:rvG395Gd+L6QEk2rLfAoZBmNn
TLSH
T17A157C9FBA228061C1EEBFF7AF4A45E9F925C0112257190494A5637DE433F28E770FA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.fingersoft.hillclimb/databases/com.google.android.datatransport.events
Size 56KB
SHA256 15a68978d670d54d71513d355cd147637f46f4d205d0310196c59bd8111476ca
MD5 fb0e59ddf45673fba706ae4ea8fae5d6
SHA1 9ff4873ee4b20c1737cecc39f3e82f08eb30a7b1
SHA512 cb68589d09d5f7bf7e4b75a15c339cad6be3844484096776bdb6f5f23709ca3cf9ebbc13e1b908e8cf02592bdd4cc4a22cc975ebd0c20dfc7836f8405d790590
SSDEEP 48:TX59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSGhavF3oabFXfbGFXfb7FX:DMEqzAiwIyNjaOsoGb8bZ
TLSH
T1124362895A3C2320C26D647DD7E34FA32A3C82DF532693ED39945CEA9CC20657C259AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download