General
- Target deepcineph (1).apk
- Size 59.4MB
- Sample261017-vb61vsts3l
- SHA256 788e45abd4c315e5d2cb51319eae1ba92d8d796e24f4364314df334d636f8600
- MD5 133b2989bb824035a6f24c0d5a8991de
- SHA1 73ad9277725b6641238f21bb382df6e5e91ac562
- SHA512 c01337ab5c757ebee4c28c9638d35087c32fac0089e2bc25140856138b0a1c5291cb15c13d69357eee018793c6b49e953a20f349c4a056756d93e0d34b103dd9
- SSDEEP 786432:395lvytssj1MUM2GTs/q+y+dgxhPtPEXttVCyo1FoDYBOkAdDaKienL1ONh9a:ZKtsdUEs/q+ydhBUttXo1FP7ATiy1MhQ
- TLSH T1F4D7120EF60CCD37DDE6B0BC9D4A029276129C596250D7562914B22CBFB37EDAE193E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
deepcineph (1).apk
Resource
android-x64-20260325-en
Behavioral task
behavioral2
Sample
deepcineph (1).apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral3
Sample
deepcineph (1).apk
Resource
android-33-x64-arm64-20260708-en
Behavioral task
behavioral4
Sample
deepcineph (1).apk
Resource
android-34-x64-arm64-20260325.1-en
Behavioral task
behavioral5
Sample
deepcineph (1).apk
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral6
Sample
deepcineph (1).apk
Resource
android-x86-arm-20260325-en
Malware Config
Targets
-
- Target deepcineph (1).apk
- Size 59.4MB
- SHA256 788e45abd4c315e5d2cb51319eae1ba92d8d796e24f4364314df334d636f8600
- MD5 133b2989bb824035a6f24c0d5a8991de
- SHA1 73ad9277725b6641238f21bb382df6e5e91ac562
- SHA512 c01337ab5c757ebee4c28c9638d35087c32fac0089e2bc25140856138b0a1c5291cb15c13d69357eee018793c6b49e953a20f349c4a056756d93e0d34b103dd9
- SSDEEP 786432:395lvytssj1MUM2GTs/q+y+dgxhPtPEXttVCyo1FoDYBOkAdDaKienL1ONh9a:ZKtsdUEs/q+ydhBUttXo1FP7ATiy1MhQ
- TLSH T1F4D7120EF60CCD37DDE6B0BC9D4A029276129C596250D7562914B22CBFB37EDAE193E0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Checks Android system properties for emulator presence.
-
Checks Qemu related system properties.
Checks for Android system properties related to Qemu for Emulator detection.
-
Checks known Qemu files.
Checks for known Qemu files that exist on Android virtual device images.
-
Checks known Qemu pipes.
Checks for known pipes used by the Android emulator to communicate with the host.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Listens for changes in the sensor environment (might be used to detect emulation)
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Conceal Multimedia Files
1User Evasion
1Virtualization/Sandbox Evasion
6System Checks
6