cfc366b6ecfce802cdef23cfcfe105a75cdcc54a00a1021c9d81c4295810f422

Analysis

user interaction
yes
max time kernel
65s
max time network
66s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
23/10/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Earn Robux - Ads for Robux.apk
Size 21.4MB
Sample261023-ampwhaaz2n
SHA256 cfc366b6ecfce802cdef23cfcfe105a75cdcc54a00a1021c9d81c4295810f422
MD5 7733dd9ba89e1eb8294b40e1972697ca
SHA1 2819e6417b74e460be9ddbe65a1d7ed847e072b8
SHA512 ad6b55eb563c2c15915612958f007fee68c53e2a4edffa1553ca42949a02be854cf6b33ce4e5d70423f4b1aa0adafc05812df7ce523a21cf8cd7f3ac3982699d
SSDEEP 393216:wEICbLoCf8FyUk2ep4P4bdWP4xmeGzDiF8Lu/M7mVyrnPugO4uD:NjQxk3bkPGGzWF8Lu/nP4Q
TLSH
T12A3723D2E710CC0ED1FA4532C9D3862AF4936C22555B190EC8563B6BA8F76F4F931B68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.Astreminix.AdCents

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.Astreminix.AdCents

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.Astreminix.AdCents

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
46	api.ipify.org
45	api.ipify.org

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.Astreminix.AdCents

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.Astreminix.AdCents

com.Astreminix.AdCents
1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Checks memory information
PID:3330

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

fbf7ad96532b1f6f_0

Path /data/data/com.Astreminix.AdCents/cache/WebView/Default/HTTP Cache/Cache_Data/fbf7ad96532b1f6f_0
Size 4KB
SHA256 8a326cedc7195e0040127fae89d15b5a9d5835515702fa892f55b5bedda69d44
MD5 b8d2aa6f0391a09cd2928cfb8dac3150
SHA1 07349b67578653d677ac782ec5bddd2184593f28
SHA512 1f8190148832a5c5d8b99277be72d76dc3ae8ac6d5b49863be8f656a7a07346e0baa55b679bfe0d9cae9f231e96fe804760bc5fc6ad059c8328e2f801aa6ee34
SSDEEP 96:DEvG75+G0QnKMj7Mx2PUAHl9eOcpQE4w6fOK9zuNn8VtAwH4Sflfd+:ovOkGbOQPBmuE4w6fOK9z5n/4qI
TLSH
T150812ADF4B5C67C2D3E2C531ADC6CCA9ACBA22D68ADAB4465502C53500D3BC41B82A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.3330.tmp

Path /data/data/com.Astreminix.AdCents/cache/oat_primary/x86_64/base.3330.tmp
Size 197KB
SHA256 b6b30fc1311bfe5d80b678c4d49c833e8589725c4f5778dd03fcda15539ecbff
MD5 d193cff28b3f49b94595e0f10e6d2b5a
SHA1 3491565ad9fd18bc76e1778e7f5f8bb042085124
SHA512 ded518e11517c66b6e11b78d26d24e74cf3e2e1735a5ed7a619c895711fdd4a0b6577c5718d3afc799a21f7260e841bf0b3cf7b4a6c9c3bc1cfdea5fa9296ceb
SSDEEP 3072:6tm57yZ3E7WFi+0ksu93fNSTt3lLrNsxBCDqOhgSjhijzI5z/0:6tm8ZL0ksuFNSTt39NsWe6tQIzM
TLSH
T15A143B8FEA539010C1EBAEF7978B16ECE92DD025135A2A149471377EA427E05E770FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.Astreminix.AdCents/databases/androidx.work.workdb
Size 4KB
SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
MD5 f92de9b7aca81136a5f2712adbd9ae8d
SHA1 8612ffa8ecae146263660d878c1e74d3da282d00
SHA512 9c2b923253b6871e68b7c513a1cbd80d39e270749933dc8e08d5add372f5f432c183768854e699cbd68c105b4e81a5500caa1d3fb2b194743c2b76b6095a526e
TLSH
T195810440574000F1D05407F354D1171D0F17D1DCD5410F0315010041CC455440C70FCD
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.Astreminix.AdCents/databases/androidx.work.workdb-journal
Size 512B
SHA256 edfd2565029e534f427e78e3b941d44cb29ac8817586a50f067c0fee614b39ff
MD5 985e117dcfe948fb56b840c08dd8be38
SHA1 76f9b2f9d343cc0e6f9f750489318f34c3585518
SHA512 cd865fb8993a01de9ceb34fb0e035853349f3e0d7c2f7c18167630039eb747aef45c3ccdc8b8564b01df75b59bd0aa19f4d6536feccdf8bd60e16d70fc76d764
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.Astreminix.AdCents/databases/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.Astreminix.AdCents/databases/androidx.work.workdb-wal
Size 16KB
SHA256 0bf9855bb4693544b08a9f949df6b7677824ceebbd39322437da8e735c4c1497
MD5 4fcc85fa03081f50f258c1d7bf2f366e
SHA1 336a923dbf351bfcf02d4fbfd66a5f5602c37c6a
SHA512 a0760718c71d8f8f1778353d3f8fd82c1f69058aef7b130aeb6ef07db21eba171292f378d5b685da2780d087c74fad36bfb118063b86b472bfc154d9cfe177b0
SSDEEP 6:KK7OeXv9FZdvlWlOERX4PBX4ogLugMBX4suuK+/3rfCl3r4+Ow2:KA1zdvloRmBEyPbP/7fCl74+Ow2
TLSH
T10572C2905A801567E10A573260EFA3080FA16689C352C74BE23014623DA1AC8A950F2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.Astreminix.AdCents/databases/androidx.work.workdb-wal
Size 88KB
SHA256 abbb6f6dab0ae62b14e241a165fd9b9b0d26b405c94cc5b1145a3450b47b7919
MD5 b5be37951609efc7803430d056147615
SHA1 fbf9e0e174a64ad6fad3393157353b4e021b18ca
SHA512 928fa73cdc82cd3acf97c8b995d0014357e473377825b71a2018e857f899f47412617cdf7bb370595c18f6d24efd597f88fdf2ce46240da558ee80e9b3989d03
SSDEEP 48:49a/ymmumWAhrBlOymdlWJWKuWwN6xl73JcXSMmchI9a7WKZ+Pjw2cwgO69g82l1:bRMpf83wS0+aD8Nn6266mPicCfY
TLSH
T13393118E0F592500C09968F0D5E51EF17E3E416DC3A3E3E1A5A20076ADD6931DE29DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audience_network.dex

Path /data/data/com.Astreminix.AdCents/files/audience_network.dex
Size 3.1MB
SHA256 3aedaba6f25a7fd04b16f68bb7ca12f71c5a464346556cbce78ebdb490df0362
MD5 d8a79a805f183fb920f9d9675d1179f6
SHA1 14aee4b270afd3e28540a06dd735137f61cdacba
SHA512 9aabd947827fd6bc9bd6ecbf7a9a30996ff5d4df6739f2f12d6a9ba13cd71a19b08eebe4f9e6226b73790bf62edce6e4ab15c875a6a68d83fdb0ab836fad13ae
SSDEEP 49152:k0UjOKYWt7TvAX+CR0piZnjwldINTQgwQ2VAHET:5KSB0ynj98gwbVL
TLSH
T10BE57C19EE512B12DE9C8ABEADEF03027B3A6D44D65357132254E270EC9B0E21FC67D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audience_network.dex.cur.prof.kBYt0Q.tmp

Path /data/data/com.Astreminix.AdCents/files/oat/audience_network.dex.cur.prof.kBYt0Q.tmp
Size 434B
SHA256 c123af991634679b02dc178631f3a0511cfa5a4a6918c8a723457be587fc4f26
MD5 2aa96ce07c0061223ffdf4210be0b0f8
SHA1 2ceeadb0eeb0f509a85a11f37b033f13e11e856b
SHA512 7cdcbaa8e449303e66255638bb9c2b0cde891f42d8176f09f0d220d1fbdbd8cb2f12f153fa5698e3b37e8d2b98609faa7d0bdf2e731b025f45b44dd0e155f010
TLSH
T1D9E02B0E82E9038BE490AC71C9A64EC9F020538534DA0C3F03AC81EE0AAA623D0AA850
MD5 SHA1 SHA512 TLSH

Submit Download

audience_network.vdex

Path /data/data/com.Astreminix.AdCents/files/oat/x86_64/audience_network.vdex
Size 58KB
SHA256 9e09a8e0e3545751334c1cfcfcf048bcad5589a8a0b119f5cda28a21a9de476e
MD5 64cf83727e2a51e5094781d5e9eab9b3
SHA1 f1b9634f9292505c2078dcce6f76575e53d2eb46
SHA512 b2630b90069851a1616fb8cd15556da820d8625bcc76d4ad0fd4206e2df8efc1dfe82edb4175406236fbf20d8524d86e6ae06850acea38d9cfaf3739e994572a
SSDEEP 1536:g556fOGmTtskGvF11v755cr8cHa0oTapwnMe:gy2GhkGvF11TPcr8YabTmcM
TLSH
T1AF435B2FAD6A25AEF53058BA852668DDAE82E057F8B2149CCD71199FCC3F3C01CE14D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AwOriginVisitLoggerPrefs.xml

Path /data/data/com.Astreminix.AdCents/shared_prefs/AwOriginVisitLoggerPrefs.xml
Size 212B
SHA256 01dd874470fbf98ebd0e849d653519b1489779ee6470c91bf0c14df034fc5be1
MD5 8cbfbc010e5d216ed294c51851d3aeb0
SHA1 c5587b85b12f068f72a00d7eb2af1cab2f2d113b
SHA512 0ecea592f5dc33fdc9a29f4e0ee183ab9c08b87ba9b66c17b317f686e064d2a30975d743b2722ec4a005a326368c5400acb2f5b12e7115c9e82b8537339978ce
TLSH
T14BD022C891FC8E0B09C809074350C40929A078DF0177E9F8FBDE50A50F189210071434
MD5 SHA1 SHA512 TLSH

Submit Download

com.Astreminix.AdCents.v2.playerprefs.xml

Path /data/data/com.Astreminix.AdCents/shared_prefs/com.Astreminix.AdCents.v2.playerprefs.xml
Size 129B
SHA256 9b1958617ed977bb53bcd9f7a16c7bd423e89adf9beb0f60105dfd865d31f141
MD5 6399d119f41e3cb4ecfd9ae569a0731d
SHA1 d166654957e6141d347f00257e195dee8afdc238
SHA512 fb07f7c51bacee3b43db118b7f72a233e8a06dfe6c068dd7dc89595e5ff55b33e8c86d5d821c276d7b2e7d3c76c90ad89fac57518f2ddd7610000c0606cb1f1f
TLSH
T1A9B02BF0D0F46D5259C0080544201A4422753663020838C05C23B4300FA8240026E110
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof.crU2Tk.tmp

Path /data/misc/profiles/cur/0/com.Astreminix.AdCents/primary.prof.crU2Tk.tmp
Size 2KB
SHA256 adc7e2d8dd1baf91784b149bc75058d503f563b420f9045ced43c607e0f3a4de
MD5 3477fb51180a550d25485339c5b7e453
SHA1 d865a78828fbe9e4feb35ddb6be394681e966c96
SHA512 b4258c261d1338868923f4d0d4f581266a9be154cd3b85f070c5dda58f0764930ce61311340fa38ac2b89b8d8743fa5b06e81a59ed98e36c085bbde65950a9ca
TLSH
T1DA516A087B3C551DFFC2D9B2CDD2BC4E6DA42B1952003527A1D73024D08BA8620BB5AF
MD5 SHA1 SHA512 TLSH

Submit Download

goldfish_pipe_dprctd

Path /dev/goldfish_pipe_dprctd
Size 3.9MB
SHA256 fa16afdc8ad3d65f5f868d0dfb6fcb95ec033d866416b3a956c1385368cc60b2
MD5 fc668fe0d740731f4743694345d42dbd
SHA1 3e4cc6bd06e3cc3edb8c905630243194a5cf3bdb
SHA512 1ccf3bd6ff14350fb1109c26e91fa3ee3114a97191c13f0e63c5efcbd6a63d459ad684d7c027c9daab7b6a13ea4f80d5d4643b0a0357380b87f270c41c349085
SSDEEP 3072:I1bLzqI/HK8XxT1wYvYEYYYc4bs92M1YYHYpEDM5fVYazq7dENYYYbEJYYY4hfYH:ibPvN/92safVJzq77EdhUn6ouBMX
TLSH
T17816935F6E74C541E6E0ECB29476678A04A74CEE84C6D252C230FFEDB7B9B8C594B048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

anon_inode:[eventfd]

Path anon_inode:[eventfd]
Size 8B
SHA256 01acecb507abfe1a354aa8064f4af5d3f1acd019e37db3c11c97523b71c76e9d
MD5 da35686b165e3223d5d49c046644e68e
SHA1 efaa1c26cfc5d5d4f74655e52f564d469c118a61
SHA512 886ba57fc2297847cb641de89b900d4d37c68333e4a00d27f4ece4880b2bc0f76d74596e1c7cf831b426cb289e27e17a17338c55af13cb62729462370dccddcb
MD5 SHA1 SHA512

Submit Download

socket:[23351]

Path socket:[23351]
Size 48B
SHA256 51a6e6650c4538c86ce15f77b365caaaf64f68d2ef0d8708007bee2fccff65e2
MD5 b4853afb660816e4ab8d8f96aca56847
SHA1 0e5dd8cc58e508c1892b6d273088b68725e37e57
SHA512 ab611393bdca649d9e14690564285289adb6fb0cd1a491038c84f655e8c479ca45ea6cd035570f5e8c87b5827001a3ad5e31f01f1f9ebb4b8bc23fd779ec1e5f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads