cfc366b6ecfce802cdef23cfcfe105a75cdcc54a00a1021c9d81c4295810f422

Analysis

max time kernel
73s
max time network
67s
platform
android-14_x64
resource
android-34-x64-arm64-20260325.1-en
resource tags

arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
submitted
23/10/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Earn Robux - Ads for Robux.apk
Size 21.4MB
Sample261023-ampwhaaz2n
SHA256 cfc366b6ecfce802cdef23cfcfe105a75cdcc54a00a1021c9d81c4295810f422
MD5 7733dd9ba89e1eb8294b40e1972697ca
SHA1 2819e6417b74e460be9ddbe65a1d7ed847e072b8
SHA512 ad6b55eb563c2c15915612958f007fee68c53e2a4edffa1553ca42949a02be854cf6b33ce4e5d70423f4b1aa0adafc05812df7ce523a21cf8cd7f3ac3982699d
SSDEEP 393216:wEICbLoCf8FyUk2ep4P4bdWP4xmeGzDiF8Lu/M7mVyrnPugO4uD:NjQxk3bkPGGzWF8Lu/nP4Q
TLSH
T12A3723D2E710CC0ED1FA4532C9D3862AF4936C22555B190EC8563B6BA8F76F4F931B68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.Astreminix.AdCents

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.Astreminix.AdCents

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.Astreminix.AdCents/files/audience_network.dex	4437	com.Astreminix.AdCents
/data/user/0/com.Astreminix.AdCents/files/audience_network.dex	4437	com.Astreminix.AdCents
/data/user/0/com.Astreminix.AdCents/files/audience_network.dex	4437	com.Astreminix.AdCents

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.Astreminix.AdCents

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
50	api.ipify.org
51	api.ipify.org

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.Astreminix.AdCents

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.Astreminix.AdCents

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.Astreminix.AdCents

com.Astreminix.AdCents
1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4437

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

fbf7ad96532b1f6f_0

Path /data/data/com.Astreminix.AdCents/cache/WebView/Default/HTTP Cache/Cache_Data/fbf7ad96532b1f6f_0
Size 4KB
SHA256 5300874dd0e5bd830a47a85c0a595ec2043f2792290cac682e96b6948a162b22
MD5 03451958d1ec4e7da992dd59923f9bd1
SHA1 5cef8d223f249c81c31cd032b577ac65defdfadc
SHA512 2742226f0a9e080c30ee85e83f912f768ad1a904927dce9250f37c730b1ac18fd767fdf5282c12040d6aa4fd1e450c0195f129d7e273ebd31ea1c857ddf7bf03
SSDEEP 96:DEvG75+G0QnKMj7MxCtPUAHl9cscxQE4w6fOK9zuNn8VtAwH4Sflfdw:ovOkGbOoPB+GE4w6fOK9z5n/4qS
TLSH
T121812BDF5B5C67C2D7A2C531EDC6CCA9ACFA22D68ACAB4465502C53600D3BC40BC1A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.4437.tmp

Path /data/data/com.Astreminix.AdCents/cache/oat_primary/x86_64/base.4437.tmp
Size 152KB
SHA256 c891f82e6f58620a5b486ce3a690bc241eb91223d664f1c932c452d492842e1f
MD5 df21b21b743dff8773c76253c48273a1
SHA1 609c8021532d3d93c1ccbf1ed0c616c5cdd3c2fc
SHA512 e994c92db1ece166154b0d7160e509703cb54483ac8add45eeb9c86b2231247bf7b7dd0e28937b75b467770fc2accb42235d496f9e5ae93b96dfaf74ae24d02a
SSDEEP 3072:AnVPZoJbAIKNDGx33LyS+VzsKzXAYgb1LrDdhG9XWSMSMMXG4I:A5eaId+VQlJ9AEbx
TLSH
T19EE36EDF6612C190C2AB7FF696C601E8EF76941156573E08A471A33EA423F10DFB1BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.Astreminix.AdCents/databases/androidx.work.workdb
Size 4KB
SHA256 f8046fb6523b685349e4ceaa5b63d5653f3d4d9bc0291dd9546056bfabd76205
MD5 19e5c2bf2a99d61bc5ae4cc8952d1bb0
SHA1 34d540bf135454e98068819b42b84411fdd62dbf
SHA512 454bce38a46107d5a4c64d8757475da9ff6ee0025fa1a8212e613d787927cb209217c655ae4ec7adf884c723e5683f473e21df0a606cd40ada4245f8daf9c3ce
TLSH
T10C810454D34000F1D0D407F354D1130D0F07D1D4D5510F0315070041CC415470C74FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.Astreminix.AdCents/databases/androidx.work.workdb-journal
Size 512B
SHA256 21435dd6fc39fac47bf17f5e4bc1193047d57eaf7ce1cec8a206a40d840031da
MD5 0e71053d0e26817576f5b7bf08987dd7
SHA1 546b944ecafd400a67230dfd455e8c035572066f
SHA512 d2ae1fb2d926a4f7a9164344a5ac3cba2ce70414efdb286df01ea02d1b9a01956a56b3ac277ff9af33b8a73917173e4acf8f5554d83fe10f8f9e72d47869084f
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.Astreminix.AdCents/databases/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.Astreminix.AdCents/databases/androidx.work.workdb-wal
Size 16KB
SHA256 a6d21e33cbe7aeb6a540d66602b8490bba6f0bc9b87b63e72090bec012d880c2
MD5 46190609fd7067920038557d3651a746
SHA1 1a8ae4647d21184384d1910bdd1c3ad3992f77e3
SHA512 a5f0fac375d00ff3b29273445dde97749bb857ac646a8cf96aa82d20c6ffc03b902f661d60a66ce83fe9a78ea46161b11f313089f8215024501c9b036cc15f78
SSDEEP 6:KAgukXqv9FZdvtAlOERX4PBX4ogLugMBX4suuK+/zzA9zmvR9zmKVOw2:KAgukXMzdIRmBEyPbP/zUm/mcOw2
TLSH
T19F72C26D93466DD2C648267264C483013FD9A73A4356CF5B626219317E01BCCD470E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.Astreminix.AdCents/databases/androidx.work.workdb-wal
Size 88KB
SHA256 7d643efbddc44a6ad480cfd46146ad839a0615d33049197108e79babb24fb572
MD5 a8c35ea831ce3d1fdf43761d4cbd1512
SHA1 3d2da9275d2f8a5ebe00784a884922d7d19c648c
SHA512 033222613c1281fb2f6a962fa5c27f3caa48ad4eda0775c19895e74cad6e3c9509a566b9b3943e1da69c37a0dd2f2f3f8754ac0da141c312f7bd727969500251
SSDEEP 48:Ji/ymmumWAhrBlOymdlWJWKuWwN6xl73JcXSMmchI9a7WKZ+Pjw2cwgO69g82luv:gRMpf83wS0+aD8Nn6266mPrQdj
TLSH
T1C693EE8E0F5E2580C09998F0E1D00FB17DBE453E9793EBE575A20075ADC6931DE29CBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audience_network.dex

Path /data/data/com.Astreminix.AdCents/files/audience_network.dex
Size 3.1MB
SHA256 3aedaba6f25a7fd04b16f68bb7ca12f71c5a464346556cbce78ebdb490df0362
MD5 d8a79a805f183fb920f9d9675d1179f6
SHA1 14aee4b270afd3e28540a06dd735137f61cdacba
SHA512 9aabd947827fd6bc9bd6ecbf7a9a30996ff5d4df6739f2f12d6a9ba13cd71a19b08eebe4f9e6226b73790bf62edce6e4ab15c875a6a68d83fdb0ab836fad13ae
SSDEEP 49152:k0UjOKYWt7TvAX+CR0piZnjwldINTQgwQ2VAHET:5KSB0ynj98gwbVL
TLSH
T10BE57C19EE512B12DE9C8ABEADEF03027B3A6D44D65357132254E270EC9B0E21FC67D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audience_network.vdex

Path /data/data/com.Astreminix.AdCents/files/oat/x86_64/audience_network.vdex
Size 58KB
SHA256 9e09a8e0e3545751334c1cfcfcf048bcad5589a8a0b119f5cda28a21a9de476e
MD5 64cf83727e2a51e5094781d5e9eab9b3
SHA1 f1b9634f9292505c2078dcce6f76575e53d2eb46
SHA512 b2630b90069851a1616fb8cd15556da820d8625bcc76d4ad0fd4206e2df8efc1dfe82edb4175406236fbf20d8524d86e6ae06850acea38d9cfaf3739e994572a
SSDEEP 1536:g556fOGmTtskGvF11v755cr8cHa0oTapwnMe:gy2GhkGvF11TPcr8YabTmcM
TLSH
T1AF435B2FAD6A25AEF53058BA852668DDAE82E057F8B2149CCD71199FCC3F3C01CE14D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AwOriginVisitLoggerPrefs.xml

Path /data/data/com.Astreminix.AdCents/shared_prefs/AwOriginVisitLoggerPrefs.xml
Size 227B
SHA256 b9002660cffb050cb1c44474e112a7d74ac2b07250c1f4ac35b05a984b11951f
MD5 9628ad5725affa98850234f0c4deeefd
SHA1 c16fac60495bc8f83e53adf64aa7319abbe25071
SHA512 1b3ae2f2d60e8bd89842b42116b8c33328fcc6d425a418d2fa8e6e8ca7fe072995bd396ed391688b582cac5acff81ae7bcee4d082b8ac69f57e90f45e658e9da
TLSH
T197D0A791D0F4AE173481199A0616C14A6A37F493822464C9F49E42140F97102406107C
MD5 SHA1 SHA512 TLSH

Submit Download

AwOriginVisitLoggerPrefs.xml

Path /data/data/com.Astreminix.AdCents/shared_prefs/AwOriginVisitLoggerPrefs.xml
Size 369B
SHA256 afaa63bdfb43fd57320f6d0242623fe18eca291609a7c3e811158434d28e9f40
MD5 58fc33bd556564c317e80d62d16c826c
SHA1 703e39b36cae4bcf832c7551af4fb1246d05fa1b
SHA512 2ee77f54671fed43146da4ef77154e5bd35f970a8bd5209e275352dcb59aec3b8f40ce5ee99410dc4141314b88440d5ac01387ee5f2411a3e8db852224d4f865
TLSH
T133E026C5E0F89F0B28891E9B4756D10A2AA6F4EF823AE9EDF1DE52540F5790240B247C
MD5 SHA1 SHA512 TLSH

Submit Download

com.Astreminix.AdCents.v2.playerprefs.xml

Path /data/data/com.Astreminix.AdCents/shared_prefs/com.Astreminix.AdCents.v2.playerprefs.xml
Size 129B
SHA256 9b1958617ed977bb53bcd9f7a16c7bd423e89adf9beb0f60105dfd865d31f141
MD5 6399d119f41e3cb4ecfd9ae569a0731d
SHA1 d166654957e6141d347f00257e195dee8afdc238
SHA512 fb07f7c51bacee3b43db118b7f72a233e8a06dfe6c068dd7dc89595e5ff55b33e8c86d5d821c276d7b2e7d3c76c90ad89fac57518f2ddd7610000c0606cb1f1f
TLSH
T1A9B02BF0D0F46D5259C0080544201A4422753663020838C05C23B4300FA8240026E110
MD5 SHA1 SHA512 TLSH

Submit Download

anon_inode:[eventfd]

Path anon_inode:[eventfd]
Size 8B
SHA256 01acecb507abfe1a354aa8064f4af5d3f1acd019e37db3c11c97523b71c76e9d
MD5 da35686b165e3223d5d49c046644e68e
SHA1 efaa1c26cfc5d5d4f74655e52f564d469c118a61
SHA512 886ba57fc2297847cb641de89b900d4d37c68333e4a00d27f4ece4880b2bc0f76d74596e1c7cf831b426cb289e27e17a17338c55af13cb62729462370dccddcb
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads