Analysis

  • max time kernel
    6s
  • max time network
    153s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    02/11/2026, 13:08

General

  • Target
    AquaMenu_1.504.apk
  • Size 2.8MB
  • Sample261102-qdcsksct7l
  • SHA256 0ca83058c07272aef23136727618dc79c9c47b489e468cdc8db90de9cffca620
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

Processes

  • com.aqua.menu
    1⤵
    • Makes use of the framework's foreground persistence service
    PID:4846
    • getprop debug.gp.su
      2⤵
        PID:4962

    Network

          MITRE ATT&CK Mobile v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          gpty.tmp

          • Path /data/user/0/com.aqua.menu/files/gpty.tmp
          • Size 8KB
          • SHA256 6fee891d2f84c4b43f141874fa2c51098aeeacf4b666d612db7ce00fff86c8aa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tool.bin.tmp

          • Path /data/user/0/com.aqua.menu/files/tool.bin.tmp
          • Size 2.5MB
          • SHA256 f53f2e3d486dea955eef20dfceb46999d21a310b05102e307f22822cfaa98c4c
          • MD5 SHA1 SHA512 SSDEEP TLSH