Analysis
- max time kernel
37s - max time network
44s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
- submitted
24/10/2026, 16:47
General
- Target ru-yandex-music-24025252-70606501-cff01c0f86ab34aec671db60bf63d120.apk
- Size 60.1MB
- Sample261024-varvjscy2l
- SHA256 1abfc01eadc4de4ae3fc100ab9cf916eb7df932a62ce044cc55e5db650c40485
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 10 IoCs
- Loads dropped Dex/Jar 1 TTPs 8 IoCs
Runs executable file dropped to the device during analysis.
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Checks the presence of a debugger
- Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
Processes
-
ru.yandex.music1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
-
ru.yandex.music:AppMetrica1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
centralDb
centralDb-journal
centralDb-shm
centralDb-wal
chunk_norris.db
chunk_norris.db-journal
chunk_norris.db-wal
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-journal
disclaimers.db-shm
disclaimers.db-wal
userDb_0
userDb_0-journal
userDb_0-shm
userDb_0-wal
com.crashlytics.settings.json
event0000000000
event0000000001
event0000000002
internal-keys
keys
keys
keys
keys
keys
keys
report
user-data
userlog
userlog.tmp
1792860479067
PersistedInstallation2611317565722551337tmp
PersistedInstallation7775686428090411740tmp
firebase_session_cnUueWFuZGV4Lm11c2lj_data.preferences_pb.tmp
firebase_session_cnUueWFuZGV4Lm11c2lj_settings.preferences_pb.tmp
firebase_session_cnUueWFuZGV4Lm11c2lj_settings.preferences_pb.tmp
firebase_session_cnUueWFuZGV4Lm11c2lj_settings.preferences_pb.tmp
firebase_session_cnUueWFuZGV4Lm11c2lj_settings.preferences_pb.tmp
throttle.txt
version.txt
metrics_state.tmp
metrics_state.tmp
log-1.log
log.lock
profileinstaller_profileWrittenFor_lastUpdateTime.dat
androidx.work.workdb
androidx.work.workdb-journal
androidx.work.workdb-shm
androidx.work.workdb-wal
androidx.work.workdb-wal
appmetrica_vital.dat
appmetrica_vital.dat
appmetrica_vital_67bb016b-be40-4c08-a190-96a3f3b503d3.dat
appmetrica_vital_67bb016b-be40-4c08-a190-96a3f3b503d3.dat
appmetrica_vital_9c5e85e6-5b39-4e91-b058-02e0c0b40a57.dat
appmetrica_vital_main.dat
appmetrica_vital_main.dat
auto_inapp.db-journal
client.db
client.db
client.db
client.db
client.db
client.db
client.db-journal
client.db-journal
client.db-journal
client.db-journal
client.db-journal
client.db-journal
component_0e5e9c33-f8c3-4568-86c5-2e4f57523f72.db-journal
component_0e5e9c33-f8c3-4568-86c5-2e4f57523f72.db-journal
component_0e5e9c33-f8c3-4568-86c5-2e4f57523f72.db-journal
component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal
component_67bb016b-be40-4c08-a190-96a3f3b503d3.db-journal
component_67bb016b-be40-4c08-a190-96a3f3b503d3.db-journal
component_67bb016b-be40-4c08-a190-96a3f3b503d3.db-journal
component_9c5e85e6-5b39-4e91-b058-02e0c0b40a57.db-journal
service_main.db
service_main.db-journal
service_main.db-journal
service_main.db-journal
androidx.window.sidecar.jar