Overview

overview

8

Static

static

3

Burgle Bud...2).apk

android-9-x86

8

Burgle Bud...2).apk

android-10-x64

8

Burgle Bud...2).apk

android-11-x64

8

Analysis

  • max time kernel
    6s
  • max time network
    152s
  • platform
    android-10_x64
  • resource
    android-x64-20260325-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
  • submitted
    30/10/2026, 21:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Burgle Buddies_0.2.8.4 (2).apk
  • Size 78.9MB
  • Sample261030-1np6rsssaw
  • SHA256 0f2eb81ca61595d1956d8f19735785c904b0f14eea3dafd58f30296e041da7dd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
    defense_evasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Checks the presence of a debugger
    defense_evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • se.leveleight.robberybob3
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks memory information
    PID:5059

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events
        • Path /data/data/se.leveleight.robberybob3/databases/com.google.android.datatransport.events
        • Size 40KB
        • SHA256 e802fdc1ccd833b91d80bb1d8f54cab2b585393e6a07622c4d9feaab07633370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/se.leveleight.robberybob3/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 ca3241a48f002de1cdbda38df936f559f777b65fedc738051adca72b228d3361
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/se.leveleight.robberybob3/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 0c1ef07d8547b9662cd651a9b8d7deb1b7cad6cf4b9bff4aa8f6dcfd27591561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/se.leveleight.robberybob3/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 85c07654f2b640f1bf0d22034c33ded4257d1609b41a77d20c678f0700577f6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/se.leveleight.robberybob3/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/se.leveleight.robberybob3/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 9aecee95277bc53eb638b7013e987cb7f40a35a657c1a502091340d234d2cd8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/se.leveleight.robberybob3/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 597110243635482eebebe320ab2ce03bb10b1adb5dcfac5dd77076c6133395b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/se.leveleight.robberybob3/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 d446da94371337b367a1bf5c2b253447bc6861035e68d4443b5b8359f9f2fa8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/se.leveleight.robberybob3/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 55a4eca81ad8a4a6189a5f4b5d6e42ffc581b2a23d1e6d8c6db00694a4ea9d34
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/se.leveleight.robberybob3/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 3905ff3e8f9a889d819887b7b6beb31ec85c600a94802ab71bc1703df30a7f5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/se.leveleight.robberybob3/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 c3522441e000a45a453abe5c4e6718b8da4cfd5b3709cdd797450a1b75479290
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/se.leveleight.robberybob3/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 450813c5450bd8e3b646e97044fcf31cd775ed7d71398b09bf33d14b172bf542
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/se.leveleight.robberybob3/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 493fb87b1ce3d499407db2438371785c1c2c9c65bbd7f88cb6e407664b8c3055
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/se.leveleight.robberybob3/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 2c8c76b03c599e50524adfab9a4ebdebd3c5b1f594783745f1fcad61db628033
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        6AE510A6012E-0001-13C3-D439E3F572B4BeginSession.cls_temp
        • Path /data/data/se.leveleight.robberybob3/files/.com.google.firebase.crashlytics/6AE510A6012E-0001-13C3-D439E3F572B4BeginSession.cls_temp
        • Size 75B
        • SHA256 4f9511ade8ea61e0c98933369c5dd411e2ae753f285a3f4ab84429cf9e9e3d35
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        6AE510A6012E-0001-13C3-D439E3F572B4SessionApp.cls_temp
        • Path /data/data/se.leveleight.robberybob3/files/.com.google.firebase.crashlytics/6AE510A6012E-0001-13C3-D439E3F572B4SessionApp.cls_temp
        • Size 98B
        • SHA256 32ffa25c9fe5080e20c261fc0aec1530dff68797928b89c6987234af0b0c9d93
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        6AE510A6012E-0001-13C3-D439E3F572B4SessionCrash.cls_temp
        • Path /data/data/se.leveleight.robberybob3/files/.com.google.firebase.crashlytics/6AE510A6012E-0001-13C3-D439E3F572B4SessionCrash.cls_temp
        • Size 36KB
        • SHA256 8a23f8a86e3ceda4fbf857cea8ec6c89c3384f315272d4dfa8213af3f0a14e81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        6AE510A6012E-0001-13C3-D439E3F572B4SessionDevice.cls_temp
        • Path /data/data/se.leveleight.robberybob3/files/.com.google.firebase.crashlytics/6AE510A6012E-0001-13C3-D439E3F572B4SessionDevice.cls_temp
        • Size 49B
        • SHA256 8103c28e4cddc0f3581e6189c4fc01bdce57c4c4ed292222989d5d1f765fb20b
        • MD5 SHA1 SHA512
        Submit Download

        6AE510A6012E-0001-13C3-D439E3F572B4SessionOS.cls_temp
        • Path /data/data/se.leveleight.robberybob3/files/.com.google.firebase.crashlytics/6AE510A6012E-0001-13C3-D439E3F572B4SessionOS.cls_temp
        • Size 15B
        • SHA256 e78068dac7c1adce8676a309d60abb8be4d31ab3dd5c6bdce85284b7ca8e8761
        • MD5 SHA1 SHA512
        Submit Download

        6AE510A6012E-0001-13C3-D439E3F572B4SessionUser.cls_temp
        • Path /data/data/se.leveleight.robberybob3/files/.com.google.firebase.crashlytics/6AE510A6012E-0001-13C3-D439E3F572B4SessionUser.cls_temp
        • Size 4B
        • SHA256 dd385bd6d860af19cb2c132d628e3d6872d7b89b3bd2d50f56253bfcb84c78ae
        • MD5 SHA1 SHA512
        Submit Download

        6AE510A70021-0002-13C3-D439E3F572B4BeginSession.cls_temp
        • Path /data/data/se.leveleight.robberybob3/files/.com.google.firebase.crashlytics/6AE510A70021-0002-13C3-D439E3F572B4BeginSession.cls_temp
        • Size 75B
        • SHA256 a7072e1999bc53e25a88f04ec2a4f33b8a84601b1f81e7c5e0f27216d3727320
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        6AE510A6012E-0001-13C3-D439E3F572B4.cls_temp
        • Path /data/data/se.leveleight.robberybob3/files/.com.google.firebase.crashlytics/fatal-sessions/6AE510A6012E-0001-13C3-D439E3F572B4.cls_temp
        • Size 36KB
        • SHA256 30bdca91248a807abd19685ab53f3d4cca25da4d0e7e9f25128cf07f7bfd5d68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        6AE510A6012E000113C3D439E3F572B4
        • Path /data/data/se.leveleight.robberybob3/files/.com.google.firebase.crashlytics/report-persistence/priority-reports/6AE510A6012E000113C3D439E3F572B4
        • Size 58KB
        • SHA256 4be8a8c89e115235ced52db0f725de2c0835ce2ca85f004ac0ebdb0a47911e0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        event0000000000_
        • Path /data/data/se.leveleight.robberybob3/files/.com.google.firebase.crashlytics/report-persistence/sessions/6AE510A6012E000113C3D439E3F572B4/event0000000000_
        • Size 57KB
        • SHA256 bed0e49e8bf8d08c69813b9f32e13752c8c521cff297d78c7f0249cf550aa9e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        report
        • Path /data/data/se.leveleight.robberybob3/files/.com.google.firebase.crashlytics/report-persistence/sessions/6AE510A6012E000113C3D439E3F572B4/report
        • Size 757B
        • SHA256 a1aaf95d0fb33d0c9d2329b97007b2ed87b29424c09066e3b50b1da754db62f0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        report
        • Path /data/data/se.leveleight.robberybob3/files/.com.google.firebase.crashlytics/report-persistence/sessions/6AE510A70021000213C3D439E3F572B4/report
        • Size 757B
        • SHA256 e133768ff42464f66adea9f7b22242f4ef327e6993e126bd3ec36602c120fcbd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation3260311706573697501tmp
        • Path /data/data/se.leveleight.robberybob3/files/PersistedInstallation3260311706573697501tmp
        • Size 569B
        • SHA256 3358b34e883ab7c6ec8d9b27230ad4996a71268eb45636467ffcc72a5a7e1ebd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation8572295840786952934tmp
        • Path /data/data/se.leveleight.robberybob3/files/PersistedInstallation8572295840786952934tmp
        • Size 90B
        • SHA256 cd2b3ea615be57dc5e64b123f3763ba24d29eb364dba91421a904a51da142e3a
        • MD5 SHA1 SHA512 TLSH
        Submit Download