3f0246756ee5cb29ceeed7520ba40fda685cd05e1d88630fef93b2c7c5eea1f3

Analysis

user interaction
yes
max time kernel
299s
max time network
304s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
20/10/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Summer_vacation_with_Mgaki-chan.apk
Size 336.9MB
Sample261020-p14zxazz4j
SHA256 3f0246756ee5cb29ceeed7520ba40fda685cd05e1d88630fef93b2c7c5eea1f3
MD5 25cc32974ade398e4d30d19323f5111a
SHA1 5673e603cbc86b1be64dfe1f6387bab3eee21381
SHA512 473098a7c2c85e7c43ccd33803a1bdc50d5ed9d0ce5896150b0b66e6870e879db994a3f88b12353317af1705a3049294553fec3f608a140b37ff8b66ebeb6e37
SSDEEP 6291456:qUmmMRXp9lpGwoEf02367P59RuXw9S6B+MKZergmlphPLTtjEZt6s2KQvA:Lklgwop23K9RuXw9s4jLTtjEZt72w
TLSH
T198F833C696B4D4D9FC13103372634FD23AA53E6C975282C63F54716E2CB3AA17D18A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	id.rj01117883.liomeko

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	id.rj01117883.liomeko

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	id.rj01117883.liomeko

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	id.rj01117883.liomeko

id.rj01117883.liomeko
1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks memory information
PID:3312

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3312.tmp

Path /data/data/id.rj01117883.liomeko/cache/oat_primary/x86_64/base.3312.tmp
Size 82KB
SHA256 a33c36c7056cf7bac6476cc4de8a5e02f1a95028704b74dab7382468b3f7bcb3
MD5 d1a08b74194f5a12011f81e25a772dae
SHA1 a6708374cb1886c829a45706a83cfad528ef4333
SHA512 519377e44171ae449611309850392b0e9c1a7d83dc53a509fba8ec84697954e218f40eb9e02b1152b3ebaad79e79ad4e3a6327285e06999ae12ec816f9421dc5
SSDEEP 1536:lOeUqQi39KQUfhsQkPArrloEHbVkGIgBLVv7Ra:lD1QQDYlH9IC7c
TLSH
T1B383094FDA939041C2F7ADF7ABCB5ADCF62D8060035E2E0454B1777FA425A11EB21BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof.Rw3684.tmp

Path /data/misc/profiles/cur/0/id.rj01117883.liomeko/primary.prof.Rw3684.tmp
Size 939B
SHA256 9d0a5f8cb1257fd91423154ae9e6b706001051e4f236da252d1b76464f726127
MD5 b115a6bb83bf7c3cd9f65bdd49b77b7b
SHA1 9d38150075c1839067a4fc6e4d410e529e9076bf
SHA512 16c3400d22dbf8b6a78aa500b0d9145c1a401b2899da50ea4c1cab6a1856e259822b6e53cc9e88d235b2e720685d5d1b86cdc502a41c7bca7cccc9898df2d8d9
TLSH
T1F0118425C1C49260E6EF87799A1CA8ECD423D861234B7E6244A917E9EF9359190320E3
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof.ryI6Es.tmp

Path /data/misc/profiles/cur/0/id.rj01117883.liomeko/primary.prof.ryI6Es.tmp
Size 888B
SHA256 663c755df2a290162e4cbbd6e5cac89aa288c08d2756b829100694a3fea3bc5b
MD5 18962594650c092820548abe1073ed1a
SHA1 98f51cdc33f3e89967134e758d2045c780d3d2f0
SHA512 0fb432ce6e2c8ebba29f290472737dff25d20021d2265be349dd1449ce961ae16f17c2de40f376ff6c6690e0a9f2b32602a616ff879a8ca6830d93a4fbf4e9a4
TLSH
T11911631AE29D0261CD6D0D38725CABC1A0E16E8956C2155C8E3EC3F253C4141AAB9F93
MD5 SHA1 SHA512 TLSH

Submit Download

RPG Config.rpgsave

Path /storage/emulated/0/Games-Port-IioMeko/Adik Nakal di Liburan Musim Panas/save/RPG Config.rpgsave
Size 252B
SHA256 0a5e621d0a612a89c0671161d013fd4f2dd0ac91897efe5901930cabcc17b29c
MD5 c7244a2f7f037c46b570668c81338d3e
SHA1 41d42a66c80ee28de83b68150db9f243f93cea2e
SHA512 e1863b192e87353409681bc9ddef813ca1e543404a3c0068b9c179529b071471d63aa7f4ef3255cd9aadcdf321869a28a14111b68332a908ca92dfd84aa322b8
TLSH
T191D0970700A9011F316BA0A628764C0F83EBD9024BB103D90C1E11838811432E3870CE
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads