Overview

overview

8

Static

static

6

BitLife_Ma...32.apk

android-13-x64

8

Analysis

  • max time kernel
    54s
  • max time network
    153s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260708-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
  • submitted
    11/10/2026, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BitLife_MayoMods_v32.apk
  • Size 293.1MB
  • Sample261011-e86tcsx15q
  • SHA256 36419f84aa5da75efbe7c3eddf4a2c6d6891a0257a04a38a49dbc2659ef653c5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Checks the presence of a debugger
    defense_evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.candywriter.bitlife
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4167

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events
        • Path /data/data/com.candywriter.bitlife/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 383e94f4717941307388b00324f1e1e8be9a659d8ede05abbd21a965688874bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.candywriter.bitlife/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 364588701813d86e658aeacfff25ced03a0df1de5716bc346a6f02d0db3987ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.candywriter.bitlife/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 32b96f4b77fe8ce5ce296b671771f7a200aa09866f8d3cd6780f0a1fcf686913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.candywriter.bitlife/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 70d510ff88e9962d6439cefcbcf9d60efcfe4ed224b72d5d3cb22d8733085453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.candywriter.bitlife/databases/com.google.android.datatransport.events-journal
        • Size 20KB
        • SHA256 c5efb55b7db384cece5d1d3a5d8eb79485da8488e05f01f9f57e60f42cd48201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.candywriter.bitlife/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 d9d92b2b1a2f75ca3ca1383c1d7fb5ad1f26a163295009718e5049ab2911e77f
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.candywriter.bitlife/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 c114ff837c4e282dd947e3ad0339e2a03fc8e71a4b57048a734a292d71eaffc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.candywriter.bitlife/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2a340388f145288c8867ecda5c58991d8dd97363ac730d5a0251136491461a20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.candywriter.bitlife/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 1129b8b0fa78335922c81c6d6aef9da33966394b4fe588556a7e3233ab33f592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.candywriter.bitlife/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 29cb3ca68fb79029f2fa88409855d20a92afd73eefa3130d7da56620008a25d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.candywriter.bitlife/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 8caeed44e33abd1a6803a9f87f76039e84cd064ba9bca2af56cb06b5429ecf48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.candywriter.bitlife/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2bc85788facc40364ca3ea1ac0619f83ee3627a65df92f4877aa38d4c77862fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.candywriter.bitlife/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 68d8daf876eef127ccb5430910eb1723bc33d50e4e3b59c8afe6ba66d563386c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.candywriter.bitlife/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 9b45099da0b32e54b7907bb2bce3b67c9f26a8851b9cad15439737ab8a096178
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.candywriter.bitlife/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 60f9f93d6720943ccf5e5f1ea2857de9a821208a49c23bc009777a92cd7a8c24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.candywriter.bitlife/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 0108a52ab857b3488d50d050f32b5bb417ebb9a1b5b68d92e47103134b9e2908
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.candywriter.bitlife/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 dd96f544ca5f7368f7c1b15e51e07d2a4a467c2260d72c4a87978568d411341d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.candywriter.bitlife/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 8a61cce70b9873eb5aae66a56635cd8fa9bb7bd44c85819231ea83415bc0c01d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.candywriter.bitlife/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 bb68fc3e83ae2296f91e1d80f4b22de5ad4934a302e8fcc02749524f552c2e0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.crashlytics.settings.json
        • Path /data/data/com.candywriter.bitlife/files/.crashlytics.v3/com.candywriter.bitlife/com.crashlytics.settings.json
        • Size 772B
        • SHA256 7295abc7ac18ec96310a158683b3a0cd2c46093dc0ed7fc88ab0e33f1afc62f1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        internal-keys
        • Path /data/data/com.candywriter.bitlife/files/.crashlytics.v3/com.candywriter.bitlife/open-sessions/6ACB3D6D033400011047EB6D982952E6/internal-keys
        • Size 107B
        • SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        report
        • Path /data/data/com.candywriter.bitlife/files/.crashlytics.v3/com.candywriter.bitlife/open-sessions/6ACB3D6D033400011047EB6D982952E6/report
        • Size 873B
        • SHA256 9969354fa212f52fb0087a8b62944ebd3dd56fc27d1f17dac841d6864dce4bc4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        userlog
        • Path /data/data/com.candywriter.bitlife/files/.crashlytics.v3/com.candywriter.bitlife/open-sessions/6ACB3D6D033400011047EB6D982952E6/userlog
        • Size 193B
        • SHA256 c54907eead29896b41a8d3ed83af81a0bf0c30edda45ac2b5ef23a9f932a6f61
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        userlog.tmp
        • Path /data/data/com.candywriter.bitlife/files/.crashlytics.v3/com.candywriter.bitlife/open-sessions/6ACB3D6D033400011047EB6D982952E6/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512
        Submit Download

        FIREBASE_CLOUD_MESSAGING_LOCAL_STORAGE
        • Path /data/data/com.candywriter.bitlife/files/FIREBASE_CLOUD_MESSAGING_LOCAL_STORAGE
        • Size 188B
        • SHA256 13031d73af9c7e496618f000eaa0320c6f3961f1828ef2f6a8753504b78a7aa5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation5258719653001503456tmp
        • Path /data/data/com.candywriter.bitlife/files/PersistedInstallation5258719653001503456tmp
        • Size 567B
        • SHA256 1119825dda108dafcf37dbf3ac7a5c0d51a2ae23766dd890f93ba0e2a2b6b273
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation6161904478240198745tmp
        • Path /data/data/com.candywriter.bitlife/files/PersistedInstallation6161904478240198745tmp
        • Size 90B
        • SHA256 e20eb5bb683596e1bca0699734e654805d68fccc6edb1433db88f173ae7c36c3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        1791704429777.trace.json
        • Path /data/data/com.candywriter.bitlife/files/bm/quality/startup/1791704429777.trace.json
        • Size 65B
        • SHA256 e90617c25714510160529da7f01617b9915cdab4764f5102b33dcab437810e00
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        1791704429777.trace.json
        • Path /data/data/com.candywriter.bitlife/files/bm/quality/startup/1791704429777.trace.json
        • Size 64B
        • SHA256 b199bcf4296926bab0924d2f688f07c40125b66bcf0c46ab849812a7e90508c5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        runtime.log
        • Path /data/data/com.candywriter.bitlife/files/chance_crash_v23/current/runtime.log
        • Size 61B
        • SHA256 a21fa5cee94b7bc541711f6ab9440aee90d57979b263a090df7cea9c97ce6a95
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        runtime.log
        • Path /data/data/com.candywriter.bitlife/files/chance_crash_v23/current/runtime.log
        • Size 81B
        • SHA256 88ad271a50a0e07d46d7dd705bb7aac6b951bd7e940196a849f1efd93a802546
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        session.txt.pending
        • Path /data/data/com.candywriter.bitlife/files/chance_crash_v23/current/session.txt.pending
        • Size 142B
        • SHA256 4967fbc4ca69c4475726a7f13602c29dd3e6d251eb232ea904264337df27af78
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        stages.txt.pending
        • Path /data/data/com.candywriter.bitlife/files/chance_crash_v23/current/stages.txt.pending
        • Size 76B
        • SHA256 601dd715bdb1b9c2782b9473227a502ab7159b70f0d03812fdabf545c8110965
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        stages.txt.pending
        • Path /data/data/com.candywriter.bitlife/files/chance_crash_v23/current/stages.txt.pending
        • Size 137B
        • SHA256 25560a532ff166e15bc2aa40cbd08ed9ff3f5da1df349a53fc5b5388417bd037
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        stages.txt.pending
        • Path /data/data/com.candywriter.bitlife/files/chance_crash_v23/current/stages.txt.pending
        • Size 218B
        • SHA256 bb2c6bc382308cf9c2469923ba1c63643998d3f00396cfc95606df0fb7d2230a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        system-exit.txt.pending
        • Path /data/data/com.candywriter.bitlife/files/chance_crash_v23/system-exit.txt.pending
        • Size 90B
        • SHA256 f20505e96c086293ffb5aaadb307ab7988f5c60555201abd90da1fa0cc241706
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_data.preferences_pb.tmp
        • Path /data/data/com.candywriter.bitlife/files/datastore/firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_data.preferences_pb.tmp
        • Size 50B
        • SHA256 483ca91ca45554f34fb17c0ea23f335b1ddaaceb342522e54cc96dd737f52a0e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Path /data/data/com.candywriter.bitlife/files/datastore/firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Size 33B
        • SHA256 a4aaa2a4e0cb12123b405a9d33bdd7edf8cbb41ea92e75deb1ba21bf1db5b2a6
        • MD5 SHA1 SHA512
        Submit Download

        firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Path /data/data/com.candywriter.bitlife/files/datastore/firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Size 75B
        • SHA256 1e58e88b20702d0a80025c1fbacc9ad5fe2565311e2230d581d669fbd7e8b0ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Path /data/data/com.candywriter.bitlife/files/datastore/firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Size 121B
        • SHA256 232f9626cbee2e063e25f61a08f46575d019b62f02a6753c1325957a95e1c513
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Path /data/data/com.candywriter.bitlife/files/datastore/firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Size 163B
        • SHA256 7495b9faf55ff02d0a2906ca3e3f4b356abd96e421815f9d07f893682da6eaf2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Path /data/data/com.candywriter.bitlife/files/datastore/firebase_session_Y29tLmNhbmR5d3JpdGVyLmJpdGxpZmU=_settings.preferences_pb.tmp
        • Size 212B
        • SHA256 92dda32cee2116c4ba027d1af3ada233034ae61be32efedbb9123e574b8b2feb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        profileInstalled
        • Path /data/data/com.candywriter.bitlife/files/profileInstalled
        • Size 24B
        • SHA256 b9c3349d1ccb95d4c9e6f88d33da548b745d4f37c95afffd6e0c0274848ae12a
        • MD5 SHA1 SHA512
        Submit Download

        profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Path /data/data/com.candywriter.bitlife/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 a725d01e738167c7864116eee135e518a121697be90daea58ac2636939627d7f
        • MD5 SHA1 SHA512
        Submit Download

        installationNum
        • Path /data/data/com.candywriter.bitlife/no_backup/.flurryNoBackup/installationNum
        • Size 100B
        • SHA256 6044e11f051b98cb5bdc251ad84db639ae73fe04bc407a81b56430a964cf4b04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb
        • Path /data/data/com.candywriter.bitlife/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/com.candywriter.bitlife/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 473c3c3cf8abb19dc3a83f2fbdc45cab9b4a5f68db6f7ed747520d2562fe9c99
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/com.candywriter.bitlife/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.candywriter.bitlife/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 13aa6defe4afc440520a275168f736f604e459bbeda4f35cec92323ec6a55007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.candywriter.bitlife/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 e802fee297840e4bf47271f4af4deb53a4b143cdb46f00ce17717eaff140fe70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        [email protected]
        • Path /data/data/com.candywriter.bitlife/oat/x86_64/[email protected]
        • Size 69KB
        • SHA256 17da7ef5cb29c63a147f9c3b9bf35812de284efe9bf9d5f3fda4507df0473b72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        primary.prof
        • Path /data/misc/profiles/cur/0/com.candywriter.bitlife/primary.prof
        • Size 16KB
        • SHA256 d60831961afb2899bf3e37436a5c670856135bd92db28cef1299146a8b7c1ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        [email protected]
        • Path /data/user/0/com.candywriter.bitlife/[email protected]
        • Size 55KB
        • SHA256 e17201bb7419b8dc8cb6bc5a6b20a751fd82c244b9413dc76da8f46fa8032dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        [email protected]!classes2.dex
        • Path /data/user/0/com.candywriter.bitlife/[email protected]!classes2.dex
        • Size 5.0MB
        • SHA256 a710fe4a5b7136be1ef29889eb3a6597a41493bc1b1bef0be49e083e85e338cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        androidx.window.extensions.jar
        • Path /system_ext/framework/androidx.window.extensions.jar
        • Size 123KB
        • SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        androidx.window.sidecar.jar
        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 25KB
        • SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download