Malware analysis https://happymod.tube/#google_vignette Malicious activity

Add for printing

URL:	https://happymod.tube/#google_vignette
Full analysis:	https://app.any.run/tasks/090ccf62-1b37-4e5e-9b0b-6373f7129eaf
Verdict:	Malicious activity
Analysis date:	May 28, 2026, 10:18:06
OS:	Android 14
Tags:	bittorrent
Indicators:
MD5:	B61BF63DB907EDDE81EB4A6B2D736F05
SHA1:	438AF5271D840108110B37C9A63D7A43FB9C071F
SHA256:	261ABD6EFF44B14680AD5B25260E5BCBC7B0C93604165F049CAFD14973BB0CAE
SSDEEP:	3:N84UDm6JDAw:24Uaicw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: off
Network:: on

Software preset

android (14)
android.cuttlefish.overlay (14)
android.cuttlefish.phone.overlay (14)
android.ext.services (2019-09)
android.ext.shared (1)
com.android.adservices.api (14)
com.android.apps.tag (1.1)
com.android.backupconfirm (14)
com.android.bips (14)
com.android.bluetoothmidiservice (14)
com.android.bookmarkprovider (14)
com.android.calendar (14)
com.android.calllogbackup (14)
com.android.camera2 (2.0.002)
com.android.cameraextensions (14)
com.android.captiveportallogin (14)
com.android.carrierconfig (1.0.0)
com.android.carrierdefaultapp (14)
com.android.cellbroadcastreceiver (R-initial)
com.android.cellbroadcastreceiver.module (R-initial)
com.android.cellbroadcastservice (R-initial)
com.android.certinstaller (14)
com.android.companiondevicemanager (14)
com.android.compos.payload (14)
com.android.connectivity.resources (S-initial)
com.android.connectivity.resources.cuttlefish.overlay (14)
com.android.contacts (1.7.34)
com.android.credentialmanager (14)
com.android.cts.ctsshim (14-10093150)
com.android.cts.priv.ctsshim (14-10093150)
com.android.deskclock (14)
com.android.devicelockcontroller (14)
com.android.dialer (23.0)
com.android.documentsui (14)
com.android.dreams.basic (14)
com.android.dreams.phototable (14)
com.android.dynsystem (14)
com.android.egg (1.0)
com.android.emergency (14)
com.android.ext.adservices.api (14)
com.android.externalstorage (14)
com.android.federatedcompute.services (T-initial)
com.android.gallery3d (1.1.40030)
com.android.google.gce.gceservice (14)
com.android.health.connect.backuprestore (14)
com.android.healthconnect.controller (14)
com.android.hotspot2.osulogin (14)
com.android.htmlviewer (14)
com.android.imsserviceentitlement (14)
com.android.inputdevices (14)
com.android.inputmethod.latin (14)
com.android.intentresolver (2021-11)
com.android.internal.display.cutout.emulation.corner (1.0)
com.android.internal.display.cutout.emulation.double (1.0)
com.android.internal.display.cutout.emulation.hole (1.0)
com.android.internal.display.cutout.emulation.tall (1.0)
com.android.internal.display.cutout.emulation.waterfall (1.0)
com.android.internal.systemui.navbar.gestural (1.0)
com.android.internal.systemui.navbar.gestural_extra_wide_back (1.0)
com.android.internal.systemui.navbar.gestural_narrow_back (1.0)
com.android.internal.systemui.navbar.gestural_wide_back (1.0)
com.android.internal.systemui.navbar.threebutton (1.0)
com.android.internal.systemui.navbar.transparent (1.0)
com.android.keychain (14)
com.android.launcher3 (14)
com.android.localtransport (14)
com.android.location.fused (14)
com.android.managedprovisioning (14)
com.android.messaging (1.0.001)
com.android.microdroid.empty_payload (14)
com.android.mms.service (14)
com.android.modulemetadata (14)
com.android.mtp (14)
com.android.music (14)
com.android.musicfx (1.4)
com.android.nearby.halfsheet (14)
com.android.networkstack (14)
com.android.networkstack.tethering (14)
com.android.networkstack.tethering.cuttlefishoverlay (1.0)
com.android.nfc (14)
com.android.ondevicepersonalization.services (T-initial)
com.android.ons (14)
com.android.packageinstaller (14)
com.android.pacprocessor (14)
com.android.permissioncontroller (33 system image)
com.android.phone (14)
com.android.printservice.recommendation (1.3.0)
com.android.printspooler (14)
com.android.providers.blockednumber (14)
com.android.providers.calendar (14)
com.android.providers.contacts (14)
com.android.providers.downloads (14)
com.android.providers.downloads.ui (14)
com.android.providers.media (14)
com.android.providers.media.module (14)
com.android.providers.partnerbookmarks (14)
com.android.providers.settings (14)
com.android.providers.settings.cuttlefish.overlay (14)
com.android.providers.telephony (14)
com.android.providers.userdictionary (14)
com.android.provision (14)
com.android.proxyhandler (14)
com.android.quicksearchbox (14)
com.android.rkpdapp (14)
com.android.role.notes.enabled (1.0)
com.android.safetycenter.resources (33 system image)
com.android.sdksandbox (T-initial)
com.android.se (14)
com.android.server.telecom (14)
com.android.settings (14)
com.android.settings.intelligence (14)
com.android.sharedstoragebackup (14)
com.android.shell (14)
com.android.simappdialog (14)
com.android.soundpicker (14)
com.android.statementservice (1.0)
com.android.stk (14)
com.android.storagemanager (14)
com.android.systemui (14)
com.android.systemui.accessibility.accessibilitymenu (14)
com.android.telephony.qns (14)
com.android.theme.font.notoserifsource (1.0)
com.android.traceur (1.0)
com.android.uwb.resources (T-initial)
com.android.virtualmachine.res (14)
com.android.vpndialogs (14)
com.android.wallpaper.livepicker (14)
com.android.wallpaperbackup (14)
com.android.wallpapercropper (14)
com.android.wallpaperpicker (1.0)
com.android.webview (137.0.7122.0)
com.android.wifi.dialog (14)
com.android.wifi.resources (R-initial)
com.android.wifi.resources.cf (1.0)
com.google.android.telephony.satellite (14)
org.chromium.chrome (137.0.7122.0)

Add for printing

MALICIOUS
- Checks whether the screen is currently on
  - app_process64 (PID: 3172)
SUSPICIOUS
- Collects data about the device's environment (JVM version)
  - app_process64 (PID: 3172)
- Accesses system-level resources
  - app_process64 (PID: 3172)
- Retrieves Android OS build information
  - app_process64 (PID: 3172)
- Retrieves a list of running application processes
  - app_process64 (PID: 3172)
- Updates data in the storage of application settings (SharedPreferences)
  - app_process64 (PID: 3172)
- Accesses external device storage files
  - app_process64 (PID: 3172)
- Retrieves the ISO country code of the current SIM card
  - app_process64 (PID: 3172)
- Abuses foreground service for persistence
  - app_process64 (PID: 3172)
- Launches a new activity
  - app_process64 (PID: 3172)
- Establishing a connection
  - app_process64 (PID: 3172)
INFO
- Loads a native library into the application
  - app_process64 (PID: 3172)
- Dynamically inspects or modifies classes, methods, and fields at runtime
  - app_process64 (PID: 3172)
- Returns elapsed time since boot
  - app_process64 (PID: 3172)
- Gets file name without full path
  - app_process64 (PID: 3172)
- Retrieves data from storage of application settings (SharedPreferences)
  - app_process64 (PID: 3172)
- Detects if debugger is connected
  - app_process64 (PID: 3172)
- Creates and writes local files
  - app_process64 (PID: 3172)
- Gets the display metrics associated with the device's screen
  - app_process64 (PID: 3172)
- Dynamically registers broadcast event listeners
  - app_process64 (PID: 3172)
- Verifies whether the device is connected to the internet
  - app_process64 (PID: 3172)
- Stores data using SQLite database
  - app_process64 (PID: 3172)
- Dynamically loads a class in Java
  - app_process64 (PID: 3172)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

143

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
2787	org.chromium.chrome	/system/bin/app_process64		app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2839	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2866	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0
2883	org.chromium.chrome:privileged_process0	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2907	com.android.adservices.api	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
3014	com.android.providers.partnerbookmarks	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
3033	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0
3129	/system/bin/dmesgd	/system/bin/dmesgd	—	init
User: dmesgd Integrity Level: UNKNOWN Exit code: 0
3130	dmesg	/system/bin/toybox	—	dmesgd
User: dmesgd Integrity Level: UNKNOWN Exit code: 0
3156	/apex/com.android.art/bin/artd	/apex/com.android.art/bin/artd	—	init
User: artd Integrity Level: UNKNOWN Exit code: 0

Add for printing

Total events

Read events

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

100

Unknown types

Dropped files

PID	Process	Filename		Type
3172	app_process64	/data/data/com.happymod.apk/.jiagu/libjiagu.so		binary
		MD5:—	SHA256:—
3172	app_process64	/data/data/com.happymod.apk/.jiagu/libjiagu_64.so		binary
		MD5:—	SHA256:—
3172	app_process64	/data/data/com.happymod.apk/files/.jglogs/.jg.ri		binary
		MD5:—	SHA256:—
3172	app_process64	/data/data/com.happymod.apk/files/.jglogs/.jg.store.report_pid		text
		MD5:—	SHA256:—
3172	app_process64	/data/data/com.happymod.apk/files/jgobfppppp		binary
		MD5:—	SHA256:—
3172	app_process64	/data/data/com.happymod.apk/.oabugaij/.fsgkea		binary
		MD5:—	SHA256:—
3172	app_process64	/data/data/com.happymod.apk/files/.jglogs/.jg.store.report_cf		binary
		MD5:—	SHA256:—
3172	app_process64	/data/data/com.happymod.apk/files/PersistedInstallation693886158187477870tmp		text
		MD5:—	SHA256:—
3172	app_process64	/data/data/com.happymod.apk/files/PersistedInstallation.W0RFRkFVTFRd+MTozNzk2MTMzODkxMTk6YW5kcm9pZDpkYTliN2UxMWRmODhhZTc2NzA3Mzhh.json		text
		MD5:—	SHA256:—
3172	app_process64	/data/data/com.happymod.apk/shared_prefs/com.google.android.gms.measurement.prefs.xml		xml
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

232

TCP/UDP connections

256

DNS requests

172

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2787	app_process64	OPTIONS	204	178.162.226.242:443	https://pbs.avads.live/rtb/bid	DE	—	—	unknown
822	app_process64	GET	204	142.251.153.119:443	https://www.google.com/generate_204	US	—	—	whitelisted
2787	app_process64	GET	200	178.162.226.242:443	https://pbs.avads.live/id/setuid?bidder=advergic&f=i	DE	—	—	unknown
2787	app_process64	GET	200	142.251.13.101:80	http://clients2.google.com/time/1/current?cup2key=9:i8XZhBQ-Q0evTXrXLfXPMSI8ZjgY4EVlB-Njr6eyeEA&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	US	text	105 b	whitelisted
2787	app_process64	POST	204	216.239.34.36:443	https://region1.google-analytics.com/g/collect?v=2&tid=G-938HPM0W9S&gtm=45je65q2v9249873107za200zd9249873107&_p=1779963500939&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&are=1&cid=1177606344.1779963508&frm=0&pscdl=&rcb=3&sr=1024x576&uaa=&uab=&uafvl=Chromium%3B137.0.7122.0%7CNot%252FA)Brand%3B24.0.0.0&uam=Galaxy_S9&uamb=1&uap=Android&uapv=14.0.0&uaw=0&ul=en-us&_s=1&tag_exp=0~115938466~115938468~119034493&sid=1779963508&sct=1&seg=0&dl=https%3A%2F%2Fhappymod.tube%2F&dt=HappyMod%20Pro%20-%20Download%20Apk%20v3.3.4%20Latest%20Version%202026&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=11209	US	—	—	whitelisted
2787	app_process64	POST	200	178.162.226.242:443	https://tap.avads.live/	DE	text	1.53 Kb	unknown
2787	app_process64	POST	200	178.162.226.242:443	https://pbs.avads.live/rtb/bid	DE	text	71 b	unknown
1756	app_process64	POST	200	142.251.127.81:443	https://staging-remoteprovisioning.sandbox.googleapis.com/v1:fetchEekChain	US	binary	778 b	whitelisted
1756	app_process64	POST	200	142.251.127.81:443	https://staging-remoteprovisioning.sandbox.googleapis.com/v1:signCertificates?challenge=AAABnm4XnWEBILStY7UX10TBxg-Ih2Ehje6_M8U=&request_id=fdcab59c-b708-4b0b-941e-cb2bdae5bed9	US	binary	11.8 Kb	whitelisted
2787	app_process64	GET	200	151.101.194.217:443	https://vjs.zencdn.net/7.16.0/video-js.min.css	US	text	39.7 Kb	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
443	mdnsd	224.0.0.251:5353	—	—	—	whitelisted
—	—	142.251.156.119:80	www.google.com	GOOGLE	US	whitelisted
—	—	142.251.13.94:80	—	GOOGLE	US	whitelisted
—	—	142.251.150.119:443	www.google.com	GOOGLE	US	whitelisted
2787	app_process64	142.251.13.101:80	clients2.google.com	GOOGLE	US	whitelisted
2787	app_process64	104.21.12.232:443	happymod.tube	CLOUDFLARENET	US	whitelisted
2787	app_process64	142.251.127.84:443	accounts.google.com	GOOGLE	US	whitelisted
2787	app_process64	142.251.150.119:443	www.google.com	GOOGLE	US	whitelisted
2787	app_process64	172.67.145.61:443	avads.live	CLOUDFLARENET	US	whitelisted
2787	app_process64	178.162.226.242:443	rack.avads.live	LEASEWEB-DE-FRA-10	DE	unknown

DNS requests

Domain	IP	Reputation
google.com	142.251.110.102 142.251.110.113 142.251.110.139 142.251.110.138 142.251.110.101 142.251.110.100	whitelisted
clients2.google.com	142.251.13.101 142.251.13.100 142.251.13.138 142.251.13.139 142.251.13.113 142.251.13.102	whitelisted
happymod.tube	104.21.12.232 172.67.153.185	unknown
accounts.google.com	142.251.127.84	whitelisted
www.google.com	142.251.150.119 142.251.152.119 142.251.154.119 142.251.153.119 142.251.157.119 142.251.156.119 142.251.155.119 142.251.151.119	whitelisted
avads.live	172.67.145.61 104.21.47.64	unknown
rack.avads.live	178.162.226.242	unknown
pbs.avads.live	178.162.226.242	unknown
tap.avads.live	178.162.226.242	unknown
connectivitycheck.gstatic.com	192.178.183.94	whitelisted

Threats

PID	Process	Class	Message
822	app_process64	Misc activity	ET INFO Android Device Connectivity Check
2787	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2787	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3172	app_process64	Misc activity	INFO [ANY.RUN] P2P BitTorrent Protocol
2787	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2787	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
2787	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)

Add for printing

No debug info

General Info

https://happymod.tube/#google_vignette

B61BF63DB907EDDE81EB4A6B2D736F05

438AF5271D840108110B37C9A63D7A43FB9C071F

261ABD6EFF44B14680AD5B25260E5BCBC7B0C93604165F049CAFD14973BB0CAE

3:N84UDm6JDAw:24Uaicw

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Checks whether the screen is currently on

SUSPICIOUS

Collects data about the device's environment (JVM version)

Accesses system-level resources

Retrieves Android OS build information

Retrieves a list of running application processes

Updates data in the storage of application settings (SharedPreferences)

Accesses external device storage files

Retrieves the ISO country code of the current SIM card

Abuses foreground service for persistence

Launches a new activity

Establishing a connection

INFO

Loads a native library into the application

Dynamically inspects or modifies classes, methods, and fields at runtime

Returns elapsed time since boot

Gets file name without full path

Retrieves data from storage of application settings (SharedPreferences)

Detects if debugger is connected

Creates and writes local files

Gets the display metrics associated with the device's screen

Dynamically registers broadcast event listeners

Verifies whether the device is connected to the internet

Stores data using SQLite database

Dynamically loads a class in Java

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings