Malware analysis 1d126e5904dde3b46175a4aae89eec1fb8a6b80e35b1f473878e5dd288f8aae6.apk Malicious activity

Add for printing

File name:	1d126e5904dde3b46175a4aae89eec1fb8a6b80e35b1f473878e5dd288f8aae6.apk
Full analysis:	https://app.any.run/tasks/207fe59b-9ac3-4229-98f8-a20e9e3f5bb0
Verdict:	Malicious activity
Analysis date:	March 24, 2025, 09:07:22
OS:	Android 14
Tags:	auto ngate
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v0.0 to extract, compression method=deflate
MD5:	8595855EAF9FE0398C8BFF7FA06151BF
SHA1:	E7AE59CD44204461EDBDDF292D36EEED38C83696
SHA256:	1D126E5904DDE3B46175A4AAE89EEC1FB8A6B80E35B1F473878E5DD288F8AAE6
SSDEEP:	98304:qpkk5CcLWeXBjYJiDlxTIIZ7jiUH0OmSAf6tq+5yQBPma+qS00CAPsuN+40XxLw9:6zIYsJPrUlz7M7wmQi3hhMRp7vo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- Detects root access on device
  - app_process64 (PID: 2265)
SUSPICIOUS
- Collects data about the device's environment (JVM version)
  - app_process64 (PID: 2265)
- Accesses system-level resources
  - app_process64 (PID: 2265)
- Launches a new activity
  - app_process64 (PID: 2265)
- Returns the name of the current network operator
  - app_process64 (PID: 2265)
- Updates data in the storage of application settings (SharedPreferences)
  - app_process64 (PID: 2265)
- Establishing a connection
  - app_process64 (PID: 2265)
INFO
- Returns elapsed time since boot
  - app_process64 (PID: 2265)
- Dynamically inspects or modifies classes, methods, and fields at runtime
  - app_process64 (PID: 2265)
- Dynamically loads a class in Java
  - app_process64 (PID: 2265)
- Retrieves data from storage of application settings (SharedPreferences)
  - app_process64 (PID: 2265)
- Stores data using SQLite database
  - app_process64 (PID: 2265)
- Gets the display metrics associated with the device's screen
  - app_process64 (PID: 2265)
- Dynamically registers broadcast event listeners
  - app_process64 (PID: 2265)
- Verifies whether the device is connected to the internet
  - app_process64 (PID: 2265)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.apk	\|	Android Package (58.6)
.jar	\|	Java Archive (16.2)
.vym	\|	VYM Mind Map (13.9)
.kmz	\|	Google Earth saved working session (6.7)
.zip	\|	ZIP compressed archive (4.4)

EXIF

ZIP

ZipRequiredVersion:	-
ZipBitFlag:	-
ZipCompression:	Deflated
ZipModifyDate:	1981:01:01 01:01:02
ZipCRC:	0xc9533e7c
ZipCompressedSize:	638062
ZipUncompressedSize:	1400832
ZipFileName:	assets/android-devices.db

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

127

Monitored processes

5

Malicious processes

1

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
343	/system/bin/netd	/system/bin/netd		init
User: root Integrity Level: UNKNOWN Exit code: 0
2265	zygote64	/system/bin/app_process64		app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2322	zygote	/system/bin/app_process32		app_process32
User: root Integrity Level: UNKNOWN Exit code: 0
2339	webview_zygote	/system/bin/app_process32	—	app_process32
User: webview_zygote Integrity Level: UNKNOWN Exit code: 0
2377	zygote	/system/bin/app_process32		app_process32
User: root Integrity Level: UNKNOWN Exit code: 0

Add for printing

Total events

0

Read events

0

Write events

0

Delete events

0

Modification events

No data

Add for printing

Executable files

0

Suspicious files

11

Text files

8

Unknown types

0

Dropped files

PID	Process	Filename		Type
2265	app_process64	/data/data/rb.system.com/no_backup/androidx.work.workdb-journal		—
		MD5:—	SHA256:—
2265	app_process64	/data/data/rb.system.com/no_backup/androidx.work.workdb-wal		—
		MD5:—	SHA256:—
2265	app_process64	/data/data/rb.system.com/shared_prefs/OneSignal.xml		—
		MD5:—	SHA256:—
2265	app_process64	/data/data/rb.system.com/shared_prefs/GTPlayerPurchases.xml		xml
		MD5:—	SHA256:—
2265	app_process64	/data/data/rb.system.com/shared_prefs/rb.system.com_preferences.xml		—
		MD5:—	SHA256:—
2265	app_process64	/data/data/rb.system.com/shared_prefs/WebViewChromiumPrefs.xml		xml
		MD5:—	SHA256:—
2265	app_process64	/data/data/rb.system.com/app_webview/Default/Local Storage/leveldb/MANIFEST-000001		binary
		MD5:—	SHA256:—
2265	app_process64	/data/data/rb.system.com/cache/WebView/Default/HTTP Cache/Code Cache/webui_js/index		binary
		MD5:—	SHA256:—
2265	app_process64	/data/data/rb.system.com/app_webview/Default/Local Storage/leveldb/000001.dbtmp		text
		MD5:—	SHA256:—
2265	app_process64	/data/data/rb.system.com/cache/WebView/Default/HTTP Cache/Code Cache/js/index		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

14

DNS requests

5

Threats

1

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	142.250.74.99:80	http://connectivitycheck.gstatic.com/generate_204	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
447	mdnsd	224.0.0.251:5353	—	—	—	unknown
—	—	142.250.74.36:443	www.google.com	GOOGLE	US	whitelisted
—	—	216.239.35.12:123	time.android.com	—	—	whitelisted
343	netd	8.8.8.8:443	—	—	—	malicious
—	—	142.250.74.99:80	connectivitycheck.gstatic.com	GOOGLE	US	whitelisted
—	—	8.8.8.8:853	—	GOOGLE	US	malicious
—	—	173.194.69.81:443	—	GOOGLE	US	unknown
2265	app_process64	104.16.160.145:443	—	CLOUDFLARENET	—	unknown
2377	app_process32	142.250.74.163:443	—	GOOGLE	US	unknown
2322	app_process32	142.250.74.67:443	—	GOOGLE	US	whitelisted

DNS requests

Domain	IP	Reputation
google.com	216.58.211.14	whitelisted
www.google.com	142.250.74.36	whitelisted
connectivitycheck.gstatic.com	142.250.74.99	whitelisted
time.android.com	216.239.35.12 216.239.35.8 216.239.35.0 216.239.35.4	whitelisted
23qB1e-dnsotls-ds.metric.gstatic.com	—	whitelisted

Threats

PID	Process	Class	Message
—	—	Misc activity	ET INFO Android Device Connectivity Check

Add for printing

No debug info

General Info

1d126e5904dde3b46175a4aae89eec1fb8a6b80e35b1f473878e5dd288f8aae6.apk

8595855EAF9FE0398C8BFF7FA06151BF

E7AE59CD44204461EDBDDF292D36EEED38C83696

1D126E5904DDE3B46175A4AAE89EEC1FB8A6B80E35B1F473878E5DD288F8AAE6

98304:qpkk5CcLWeXBjYJiDlxTIIZ7jiUH0OmSAf6tq+5yQBPma+qS00CAPsuN+40XxLw9:6zIYsJPrUlz7M7wmQi3hhMRp7vo

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Detects root access on device

SUSPICIOUS

Collects data about the device's environment (JVM version)

Accesses system-level resources

Launches a new activity

Returns the name of the current network operator

Updates data in the storage of application settings (SharedPreferences)

Establishing a connection

INFO

Returns elapsed time since boot

Dynamically inspects or modifies classes, methods, and fields at runtime

Dynamically loads a class in Java

Retrieves data from storage of application settings (SharedPreferences)

Stores data using SQLite database

Gets the display metrics associated with the device's screen

Dynamically registers broadcast event listeners

Verifies whether the device is connected to the internet

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings