General
- Target VidSync FocusPlan v1.4.1 MOD - TekMods.com.apk
- Size 73.1MB
- Sample261012-x2jpcswt7m
- SHA256 8152a11dda75fbd5a2ee0d70020605a43f285614ca636dd34d3ad9fc957dbd13
- MD5 dcb3320208c0257f9d90884c02a2b408
- SHA1 8b0ddb7b5612efb348f11b284575a9bb817e6248
- SHA512 5f8bb74da1a77475f16a2bd9e67ff73c7b73a4480526cf7910debe7b20f7b41bdbfa58b58ded6cde8dcfa9faf1f5deb134bb7224ef8bdadd1b7285f6645c6e7e
- SSDEEP 393216:X8W4lrJhEZ7hCLZ94HpPAxCuFRVJC/VEYp1vHEOFSVwcgCBooDfA3pIfWEj3GXl2:X8W41JKZ7GdvC/FXbEj3Gj/9OMd7S
- TLSH T1CBF7AE129207AE33C6AFE3BC58660F11BF305C54A6C35B635A0ED570FE932D99A71B84
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
VidSync FocusPlan v1.4.1 MOD - TekMods.com.apk
Resource
android-33-x64-arm64-20260708-en
Behavioral task
behavioral2
Sample
VidSync FocusPlan v1.4.1 MOD - TekMods.com.apk
Resource
android-34-x64-arm64-20260325.1-en
Behavioral task
behavioral3
Sample
VidSync FocusPlan v1.4.1 MOD - TekMods.com.apk
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral4
Sample
VidSync FocusPlan v1.4.1 MOD - TekMods.com.apk
Resource
android-x86-arm-20260325-en
Malware Config
Targets
-
- Target VidSync FocusPlan v1.4.1 MOD - TekMods.com.apk
- Size 73.1MB
- SHA256 8152a11dda75fbd5a2ee0d70020605a43f285614ca636dd34d3ad9fc957dbd13
- MD5 dcb3320208c0257f9d90884c02a2b408
- SHA1 8b0ddb7b5612efb348f11b284575a9bb817e6248
- SHA512 5f8bb74da1a77475f16a2bd9e67ff73c7b73a4480526cf7910debe7b20f7b41bdbfa58b58ded6cde8dcfa9faf1f5deb134bb7224ef8bdadd1b7285f6645c6e7e
- SSDEEP 393216:X8W4lrJhEZ7hCLZ94HpPAxCuFRVJC/VEYp1vHEOFSVwcgCBooDfA3pIfWEj3GXl2:X8W41JKZ7GdvC/FXbEj3Gj/9OMd7S
- TLSH T1CBF7AE129207AE33C6AFE3BC58660F11BF305C54A6C35B635A0ED570FE932D99A71B84
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Checks Android system properties for emulator presence.
-
Checks Qemu related system properties.
Checks for Android system properties related to Qemu for Emulator detection.
-
Checks known Qemu files.
Checks for known Qemu files that exist on Android virtual device images.
-
Checks known Qemu pipes.
Checks for known pipes used by the Android emulator to communicate with the host.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock
-
Queries information about active data network
-
Reads information about phone network operator.
-
Checks the presence of a debugger
-
Listens for changes in the sensor environment (might be used to detect emulation)
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
6System Checks
6