Analysis
- max time kernel
12s - max time network
57s - platform
android-15_x64 - resource
android-35-x64-arm64-20260325-fr - resource tags
- submitted
07/10/2026, 19:52
General
- Target IdleSlayer.Mod.apk
- Size 121.5MB
- Sample261007-ylhb2ad16w
- SHA256 9335772c43f1ddee3918a3ba5859c5a88b87e6ac1d2447029a993620f42d42e0
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 9 IoCs
- Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Checks the presence of a debugger
- Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Hides multimedia files using a .nomedia file 1 TTPs
Android's media scanner ignores any directory that contains a .nomedia file. This hides your photos, videos, and audio from the gallery and other apps.
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.pabloleban.IdleSlayer1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
app_resources_lib.jar
auth_resources_lib.jar
google_api_resources_lib.jar
app_resources_lib.vdex
auth_resources_lib.vdex
google_api_resources_lib.vdex
remote_config_resources_lib.vdex
storage_resources_lib.vdex
base.3481.tmp
remote_config_resources_lib.jar
storage_resources_lib.jar
tombstone_1791402799090_6.7.6_com.pabloleban.IdleSlayer_.native.tacrash
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
google_app_measurement_local.db-journal
thinkingdataclone
thinkingdataclone-journal
thinkingdataclone-journal
thinkingdataclone-journal
thinkingdataclone-journal
thinkingdataclone-journal
thinkingdataclone-journal
com.crashlytics.settings.json
internal-keys
keys
keys
app.json
device.json
os.json
session.json
report
userlog
userlog.tmp
PersistedInstallation6237571213693355071tmp
PersistedInstallation836059344872762285tmp
FirebaseHeartBeatW0RFRkFVTFRd+MTo5MDg5MzEwOTM2ODg6YW5kcm9pZDoyNjg1NDEwYWFlNzJiOWQ3ZWVkMDRk.preferences_pb.tmp
FirebaseHeartBeatW0RFRkFVTFRd+MTo5MDg5MzEwOTM2ODg6YW5kcm9pZDoyNjg1NDEwYWFlNzJiOWQ3ZWVkMDRk.preferences_pb.tmp
FirebaseHeartBeatW0RFRkFVTFRd+MTo5MDg5MzEwOTM2ODg6YW5kcm9pZDoyNjg1NDEwYWFlNzJiOWQ3ZWVkMDRk.preferences_pb.tmp
sessionConfigsDataStore.data.tmp
sessionDataStore.data.tmp
frc_1:908931093688:android:2685410aae72b9d7eed04d_firebase_fetch.json
initCacheConfig
profileInstalled
ttopenadsdk
androidx.work.workdb
androidx.work.workdb-journal
androidx.work.workdb-shm
androidx.work.workdb-wal
androidx.work.workdb-wal
com.pabloleban.IdleSlayer.v2.playerprefs.xml