Analysis
- user interaction
yes - max time kernel
3s - max time network
52s - platform
android-15_x64 - resource
android-35-x64-arm64-20260325-en - resource tags
arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system - submitted
30/10/2026, 16:13
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
Remaster Cheat.apk
Resource
android-35-x64-arm64-20260325-en
9 signatures
150 seconds
General
- Target Remaster Cheat.apk
- Size 4.3MB
- Sample261030-tpjxtaew5l
- SHA256 f9da9b00abefdc9ff594b0703d4b38dc566cacfce489f359a9a3c63d3fdc8085
- MD5 19778cf8ef012c03503a2a6aa1660fff
- SHA1 c6e5404862cf45ce71c48f910a806f766883f02d
- SHA512 ec13df6268adc17cadcfecc398fecc2d1024292be54d62d64f9c96e70dde4edc372e81eccdec1fdf09cfca37f12bc3a67b1dc160ec8fdeae8c679d84c6c45047
- SSDEEP 98304:UAIP1f5fPIsSuVlFAOSa5+MDzyRRXaG5hCOuudvRoongyItS0+3n:UA8f5fP0IT8I+ezyRRXOmdvRbgyItd+n
- TLSH T1222633FF4AEA5116DE8D1CB99E54D52B9E97A8FA01202F0C0CB9F87860F5D2780117B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
description ioc Process Accessed system property key: ro.product.model ru.zglahazn6.ev58s3z1f - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener ru.zglahazn6.ev58s3z1f - Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://sms/inbox ru.zglahazn6.ev58s3z1f - Reads the content of outgoing SMS messages. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://sms/sent ru.zglahazn6.ev58s3z1f - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock ru.zglahazn6.ev58s3z1f - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule ru.zglahazn6.ev58s3z1f - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal ru.zglahazn6.ev58s3z1f - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo ru.zglahazn6.ev58s3z1f
Processes
-
ru.zglahazn6.ev58s3z1f1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Reads the content of SMS inbox messages.
- Reads the content of outgoing SMS messages.
- Acquires the wake lock
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:3217