| File name: | SportzX.ver.1.7.build.8.apk |
| Full analysis: | https://app.any.run/tasks/ef4dc7a0-911d-48e1-8e76-73d37d95c4a3 |
| Verdict: | Malicious activity |
| Analysis date: | March 22, 2025, 08:51:24 |
| OS: | Android 14 |
| Indicators: | |
| MIME: | application/vnd.android.package-archive |
| File info: | Android package (APK), with gradle app-metadata.properties |
| MD5: | 5DEF0E68B386D295B91BEE797A509B54 |
| SHA1: | DE6C6C62A6BBB78D402539D0C08D6684C590FEAE |
| SHA256: | 2B12880CF90173873723A262D44B5D776B5B6F409D6AC228B45458B45A054A80 |
| SSDEEP: | 98304:6JjZLKOFV5jQVtoGQgE3As0CQSJsGCU8MUEx9FpnEssMhwfjCDQWUw7MdWBDyfSH:9GRrDmtp9TMIwdbEJ+ |
MALICIOUS
No malicious indicators.SUSPICIOUS
Scans for popular installed apps
- app_process64 (PID: 2278)
Updates data in the storage of application settings (SharedPreferences)
- app_process64 (PID: 2278)
Collects data about the device's environment (JVM version)
- app_process64 (PID: 2278)
Creates a WakeLock to manage power state
- app_process64 (PID: 2278)
Acquires a wake lock to keep the device awake
- app_process64 (PID: 2278)
Accesses system-level resources
- app_process64 (PID: 2278)
Establishing a connection
- app_process64 (PID: 2278)
INFO
Stores data using SQLite database
- app_process64 (PID: 2278)
Handles throwable exceptions in the app
- app_process64 (PID: 2278)
Dynamically loads a class in Java
- app_process64 (PID: 2278)
Loads a native library into the application
- app_process64 (PID: 2278)
Returns elapsed time since boot
- app_process64 (PID: 2278)
Dynamically inspects or modifies classes, methods, and fields at runtime
- app_process64 (PID: 2278)
Retrieves data from storage of application settings (SharedPreferences)
- app_process64 (PID: 2278)
Gets the display metrics associated with the device's screen
- app_process64 (PID: 2278)
Gets file name without full path
- app_process64 (PID: 2278)
Verifies whether the device is connected to the internet
- app_process64 (PID: 2278)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .apk | | | Android Package (62.8) |
|---|---|---|
| .jar | | | Java Archive (17.3) |
| .vym | | | VYM Mind Map (14.9) |
| .zip | | | ZIP compressed archive (4.7) |
EXIF
ZIP
| ZipRequiredVersion: | - |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | Deflated |
| ZipModifyDate: | 1981:01:01 01:01:02 |
| ZipCRC: | 0x58460490 |
| ZipCompressedSize: | 52 |
| ZipUncompressedSize: | 56 |
| ZipFileName: | META-INF/com/android/build/gradle/app-metadata.properties |
Total processes
127
Monitored processes
3
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 343 | /system/bin/netd | /system/bin/netd | init | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2278 | com.sportzx.live | /system/bin/app_process64 | app_process64 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2330 | com.android.adservices.api | /system/bin/app_process64 | — | app_process64 |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
5
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2278 | app_process64 | /data/data/com.sportzx.live/shared_prefs/com.google.firebase.messaging.xml | xml | |
MD5:— | SHA256:— | |||
| 2278 | app_process64 | /data/data/com.sportzx.live/shared_prefs/FirebaseHeartBeatW0RFRkFVTFRd+MTo3NzA4MzAwNDA1NTI6YW5kcm9pZDpkMDgwZjIyNjhlZGNmYTIxMDQ3ODVk.xml | — | |
MD5:— | SHA256:— | |||
| 2278 | app_process64 | /data/data/com.sportzx.live/no_backup/androidx.work.workdb-journal | — | |
MD5:— | SHA256:— | |||
| 2278 | app_process64 | /data/data/com.sportzx.live/no_backup/androidx.work.workdb-wal | — | |
MD5:— | SHA256:— | |||
| 2278 | app_process64 | /data/data/com.sportzx.live/shared_prefs/com.google.android.gms.measurement.prefs.xml | xml | |
MD5:— | SHA256:— | |||
| 2278 | app_process64 | /data/data/com.sportzx.live/shared_prefs/frc_1:770830040552:android:d080f2268edcfa2104785d_firebase_settings.xml | — | |
MD5:— | SHA256:— | |||
| 2278 | app_process64 | /data/data/com.sportzx.live/files/PersistedInstallation1911507562268249882tmp | — | |
MD5:— | SHA256:— | |||
| 2278 | app_process64 | /data/data/com.sportzx.live/files/PersistedInstallation.W0RFRkFVTFRd+MTo3NzA4MzAwNDA1NTI6YW5kcm9pZDpkMDgwZjIyNjhlZGNmYTIxMDQ3ODVk.json | — | |
MD5:— | SHA256:— | |||
| 2278 | app_process64 | /data/data/com.sportzx.live/shared_prefs/com.google.android.gms.appid.xml | — | |
MD5:— | SHA256:— | |||
| 2278 | app_process64 | /data/data/com.sportzx.live/files/PersistedInstallation5445534317569854089tmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
25
DNS requests
4
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 142.250.74.99:80 | http://connectivitycheck.gstatic.com/generate_204 | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
447 | mdnsd | 224.0.0.251:5353 | — | — | — | unknown |
343 | netd | 8.8.8.8:443 | — | — | — | malicious |
— | — | 216.239.35.8:123 | time.android.com | — | — | whitelisted |
— | — | 8.8.8.8:853 | — | GOOGLE | US | malicious |
— | — | 216.58.207.228:443 | www.google.com | GOOGLE | US | whitelisted |
— | — | 142.250.74.99:80 | connectivitycheck.gstatic.com | GOOGLE | US | whitelisted |
— | — | 173.194.69.81:443 | — | GOOGLE | US | unknown |
2278 | app_process64 | 142.250.74.138:443 | — | GOOGLE | US | whitelisted |
2278 | app_process64 | 216.58.211.10:443 | — | GOOGLE | US | whitelisted |
2278 | app_process64 | 104.21.1.158:443 | — | CLOUDFLARENET | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
time.android.com |
| whitelisted |
www.google.com |
| whitelisted |
connectivitycheck.gstatic.com |
| whitelisted |
6dWDab-dnsotls-ds.metric.gstatic.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET INFO Android Device Connectivity Check |