Analysis

  • max time kernel
    6s
  • max time network
    152s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    01/11/2026, 21:07

General

  • Target
    roblox_v2_745_1142_mod1_sdk.apk
  • Size 148.4MB
  • Sample261101-zyebksdc77
  • SHA256 babe19db95bb0bf24dc1831372f59f48eb3f0ccb381760ab73c6619c208b802a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs

Processes

  • com.roblox.client
    1⤵
    • Acquires the wake lock
    • Queries information about active data network
    PID:3264
  • com.roblox.client:ssd
    1⤵
      PID:3318
    • com.roblox.client:ssd
      1⤵
        PID:3511

      Network

            MITRE ATT&CK Mobile v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            d5eaa3aecf82dbfac75854d2917817aa.0.tmp

            • Path /data/data/com.roblox.client/cache/d5eaa3aecf82dbfac75854d2917817aa.0.tmp
            • Size 6KB
            • SHA256 d3b600e94ebf30a85dcd4f6df3494c93d025a8ad1dd1b19bdfea55b390c840dc
            • MD5 SHA1 SHA512 SSDEEP TLSH

            d5eaa3aecf82dbfac75854d2917817aa.1.tmp

            • Path /data/data/com.roblox.client/cache/d5eaa3aecf82dbfac75854d2917817aa.1.tmp
            • Size 14KB
            • SHA256 19a8b4b20f222ba610c6e331659a76277f83757e32baf711b6db0014adaeae91
            • MD5 SHA1 SHA512 SSDEEP TLSH

            journal

            • Path /data/data/com.roblox.client/cache/journal
            • Size 39B
            • SHA256 eeec22d94d65d10b0aef63b693158326542f2a83df10163961284e64daf35dfe
            • MD5 SHA1 SHA512

            journal.tmp

            • Path /data/data/com.roblox.client/cache/journal.tmp
            • Size 36B
            • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
            • MD5 SHA1 SHA512

            google_app_measurement_local.db

            • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db
            • Size 16KB
            • SHA256 d1ffdca7ba8c0925bec4d10295b7c355bc1cace5e6b44d6efe9f812023f9e772
            • MD5 SHA1 SHA512 SSDEEP TLSH

            google_app_measurement_local.db

            • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db
            • Size 16KB
            • SHA256 4aec34c116bc491067ed5d4d54e7a11e01277f8c3b9bc388491314a348a1aae6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            google_app_measurement_local.db

            • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db
            • Size 16KB
            • SHA256 82d1e07d6be99dd35b44413f68e27accdc6e82f81bcb420d5815361422c4802a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            google_app_measurement_local.db-journal

            • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
            • Size 512B
            • SHA256 75bb107d9e6eb54299538cdaca9e816eb9f93ee50c819ca588b33ab44bc8bdf0
            • MD5 SHA1 SHA512

            google_app_measurement_local.db-journal

            • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
            • Size 8KB
            • SHA256 5e2dadfa91dceab21b7b60f0c8a6e322f161102a3c0cb9574f0c808f923a81f4
            • MD5 SHA1 SHA512 SSDEEP TLSH

            google_app_measurement_local.db-journal

            • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
            • Size 4KB
            • SHA256 41881460013bfd80254cc0295088a6d47c04070a2fa7ccac1b4506983a219359
            • MD5 SHA1 SHA512 SSDEEP TLSH

            google_app_measurement_local.db-journal

            • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
            • Size 8KB
            • SHA256 139fb6b08835711a89eaa4fdf2eea7cd9cd651e73b0a123e29e95802c088fabb
            • MD5 SHA1 SHA512 SSDEEP TLSH

            google_app_measurement_local.db-journal

            • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
            • Size 4KB
            • SHA256 43f805a3907552d5aa7688a80b918d93c0de843a0dc906d087c47326a2818e13
            • MD5 SHA1 SHA512 SSDEEP TLSH

            google_app_measurement_local.db-journal

            • Path /data/data/com.roblox.client/databases/google_app_measurement_local.db-journal
            • Size 8KB
            • SHA256 37c47389df8e79931193b91d41d72a18217812ad7c335f52324344d89f3775c7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            PersistedInstallation3382476362441073134tmp

            • Path /data/data/com.roblox.client/files/PersistedInstallation3382476362441073134tmp
            • Size 90B
            • SHA256 3f8c52b5807afc318df87e573de1ab8b3ecd420bffb5520b2aa30b0a5de882c1
            • MD5 SHA1 SHA512 TLSH

            PersistedInstallation5412346431412232643tmp

            • Path /data/data/com.roblox.client/files/PersistedInstallation5412346431412232643tmp
            • Size 559B
            • SHA256 187e02ae59dffce8c7650dfafcae1add07e7bccef7de6bc644d7b11dc69b18d4
            • MD5 SHA1 SHA512 TLSH

            FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp

            • Path /data/data/com.roblox.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp
            • Size 367B
            • SHA256 f4a92916650c79740a9b05892f038523459b291937ed32f59fd3dce73fc5e939
            • MD5 SHA1 SHA512 TLSH

            FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp

            • Path /data/data/com.roblox.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDAxNTUzMjA5MDk6YW5kcm9pZDphMmU0ODY1MDVhZDQzNGY1.preferences_pb.tmp
            • Size 343B
            • SHA256 27b8ff7c78550f09060f0c64cdc5238af2ed54ce61abf3781162217170330fe6
            • MD5 SHA1 SHA512 TLSH

            a

            • Path /data/data/com.roblox.client/files/sdk/plugin/a
            • Size 716KB
            • SHA256 8b2a6ed5ff792858454e26431887ce04bc831857dc89a409f9fed7b3b248378a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            libmmkv.so

            • Path /data/data/com.roblox.client/files/sdk/plugin/lib64/libmmkv.so
            • Size 713KB
            • SHA256 b145e9b2da7b1fd1840ea5e9ac85514b069a13f31df0e5342c9ebb5295ad1eb5
            • MD5 SHA1 SHA512 SSDEEP TLSH

            a.vdex

            • Path /data/data/com.roblox.client/files/sdk/plugin/oat/x86_64/a.vdex
            • Size 7KB
            • SHA256 5eda5b0813331ac6074c70aa1ff71032646ab085858d8265899a248eef0aa259
            • MD5 SHA1 SHA512 SSDEEP TLSH

            androidx.work.workdb

            • Path /data/data/com.roblox.client/no_backup/androidx.work.workdb
            • Size 4KB
            • SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
            • MD5 SHA1 SHA512 TLSH

            androidx.work.workdb-journal

            • Path /data/data/com.roblox.client/no_backup/androidx.work.workdb-journal
            • Size 512B
            • SHA256 e8141ef4d95b82a21aeb3dff74e4efe048b42399dc2eff8f7b38d42cb0e942bf
            • MD5 SHA1 SHA512

            androidx.work.workdb-shm

            • Path /data/data/com.roblox.client/no_backup/androidx.work.workdb-shm
            • Size 32KB
            • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
            • MD5 SHA1 SHA512 SSDEEP

            androidx.work.workdb-wal

            • Path /data/data/com.roblox.client/no_backup/androidx.work.workdb-wal
            • Size 116KB
            • SHA256 e196520f696161aab286265b4ee13500d8bcd859b7e222366b19dfad3d2e8591
            • MD5 SHA1 SHA512 SSDEEP TLSH