439d0da04a01ef8342b2e0da9e9dad622877bc42f8ea29d97031daac4589356e

Resubmissions

27/10/2026, 12:39

261027-pvlalstyay8

27/10/2026, 12:36

261027-ps1mhstyas8

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
6s
max time network
908s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
27/10/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CM_Reborn_1.2.0_sign.apk
Size 749.7MB
Sample261027-pvlalstyay
SHA256 439d0da04a01ef8342b2e0da9e9dad622877bc42f8ea29d97031daac4589356e
MD5 35dea5f4a7d6b51d41e1d06e370ecc00
SHA1 4c4040d4aec62f125c7558edf157a8ff6b174573
SHA512 4030f7af7e2a48e111de879f7a0e985df25315683dbf048d0a2dabcdf00ccea9550c21c1d6ad2a846b3edb83286a0d3d54ad97c9c5781faca01d6ef4c0011c63
SSDEEP 12582912:Lh8Go/JquM4vEzxxwa2k/0ExUPFrCq/rJHcfAHCU/OQ9apMuiZZuAmaYXLtCYQFZ:LaqubEbwacPFrCq/FWMCU/OCapCZufan
TLSH
T17C8947C2B502C589D02D6A33ACB7DEECD1AFBDC49629752732A4B75E3CF13287A50611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.sheibi.clashmini
/sbin/su	com.sheibi.clashmini
/system/bin/su	com.sheibi.clashmini
/system/xbin/su	com.sheibi.clashmini
/data/local/xbin/su	com.sheibi.clashmini
/system/sd/xbin/su	com.sheibi.clashmini
/system/bin/failsafe/su	com.sheibi.clashmini
/data/local/bin/su	com.sheibi.clashmini
/data/local/su	com.sheibi.clashmini

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

defense_evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.sheibi.clashmini
/dev/qemu_pipe	com.sheibi.clashmini

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sheibi.clashmini

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sheibi.clashmini

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.sheibi.clashmini

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.sheibi.clashmini

com.sheibi.clashmini
1⤵
- Checks if the Android device is rooted.
- Checks known Qemu pipes.
- Queries information about running processes on the device
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
PID:4794

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

178a1288-10b9-4547-b781-9b7d1eb727aa.envelope

Path /data/data/com.sheibi.clashmini/cache/sentry/e43579ebc71a73d6cc7465b460dbf7dbd7931e11/178a1288-10b9-4547-b781-9b7d1eb727aa.envelope
Size 603B
SHA256 4c3f03b0f40254ca3019eb41ccbaf5593c30d11a1d7bb3f8515dde4a2ea8e5b0
MD5 75e069510ffcf62376a33da106a14ba8
SHA1 888d15a5bff32dfd4a3966493db6447c42ca8616
SHA512 647dc17160f5cb577adde5e296e89d7fc314bce4485b645bb4e165b699b33d2a28368ec1a664355f716c1cd171bb7a0553ca358c8b2be7022f9827be7a79f8b1
TLSH
T1AEF0ACC592A29F7A0EDE5B75B8495D9C6B3FF993A1C80BCC4D4D2711471B2624901427
MD5 SHA1 SHA512 TLSH

Submit Download

session.json

Path /data/data/com.sheibi.clashmini/cache/sentry/e43579ebc71a73d6cc7465b460dbf7dbd7931e11/session.json
Size 281B
SHA256 058817ca72a7cb44e704e2aed2c30c10b1685706803d277c47ca192a90b80e16
MD5 82bcc601e8b9079855e62b57e7b715b4
SHA1 37bc1787b6e042fa12f646cc60827bc7e32a265f
SHA512 70d2e1f98f8cdc4fa637ceae95abf94f349fef760027b9b79b46b29c575acc7bc91027602deca13e6ce5d3477c211ee41dc252733ce1c47d7e97525641405cc7
TLSH
T1CFD02B019607A9362D45D1D3588C2B5C1D6FF4B255D059ED4F4D07205C1F061090A877
MD5 SHA1 SHA512 TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.sheibi.clashmini/databases/com.google.android.datatransport.events
Size 40KB
SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
MD5 1cf3f63c021d755a21623e6d0e86dbc6
SHA1 e40e0f1faa61abcca7ba3394c54c92ff7334b49b
SHA512 38d72e14f3513ffd26989cbda3df46ed3dd6e731bdfae56440eff6b64760cc13f91014281c9add61e018fe3529e49c63a6892ca22479515816c768b546244466
SSDEEP 48:TfkL3u59MENZBdUdndVd/7T9IvdldHlq8/JqYpqPS:zkL3KMEX0xIyNYMa
TLSH
T1AF03EF5D4A202611C2BE083FD7E257931B3CE35F6B2387612E904CF6DDC68B6B821998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.sheibi.clashmini/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 6f4624c80d02c77667aed29f48d40c3a4fc668d142e2b14c586b63dac6dd1733
MD5 0fd5c7eee654d8c8ba84f3c899a225d1
SHA1 10b7121289fb335a0f8260fef040c5e59a5ef109
SHA512 ee92645190cec6459bca38d4dde342f5c559131a76441001f8ee3614c636689ebbf342e5ac9dbe289f71cc8f2c4747efec88de0173fea0c7721898bbc1f10ac2
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.sheibi.clashmini/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 92f155b9fc070b20193af4ec2e84d710fe2ed317c05c2ecbda5773432500300c
MD5 35463ecd1a9863bd770dc35b46cf5290
SHA1 819509b9ac784d6b2a2431c69eed74e366457190
SHA512 ffb9dfad6bd989ae42d1d9781d0798840a081a8f8c3d9f9662922d5845c54276dac428cb526e7ddd4a08eb3e2643aece4142beec4c25a258f9b6e671d49d6bd3
SSDEEP 6:7+/l9vRn1qvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK0C:7+tNiqLiuWdYRmBEyPbM
TLSH
T10802C08C63C04A13C82D66B7A0E483480D00F72891F1CB3F36980C943C478CCECA0D8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.sheibi.clashmini/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 951e057fdea0430ef6ba06db5f32a1b18c7e5aabf10ea9e5b7fa40bdb4383f55
MD5 a59b5e595b2baa2da2963e8487749f73
SHA1 f96ec8a82178d882d3751092a09922a05b08e924
SHA512 e3e7db51f3761cf84a2efc813341003dcf21eb98bf320a8a9702685a0851323456b8ab88e48b890995998ad2329157831c0f5c54ed65f8a1c2d88d024b9b16ec
SSDEEP 6:7+/l9pIPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKyE/L:7+t0qLJdeWRmBEyPbDkL
TLSH
T1D602229863410F03C0295B77A0C883401E20A7289223CB172AD10A946D4A6CCECA0D80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLATION

Path /data/data/com.sheibi.clashmini/files/INSTALLATION
Size 36B
SHA256 9328e1d7e5f6498dcf324785ce0c4bb989f1f640920de9be5b77948c48c33ec1
MD5 e677cf33648e277bda88a7660123f3a9
SHA1 efba0c59cd9c8de277eaeaf8503874e953575444
SHA512 442ab2a8c4fdcfbec20a3f38f947fbacb48de2e8f8d641948ca00d28ecdeaa8059c6bfd1da1cb1e45d5a68dc5f6e7fb33d8632e7b231a9ed32ad7e25aebcfcca
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads