Malware analysis https://trashbox.ru/files30/2173289/ru.oneme.app_6398_rs.apk/ Malicious activity

Add for printing

URL:	https://trashbox.ru/files30/2173289/ru.oneme.app_6398_rs.apk/
Full analysis:	https://app.any.run/tasks/fa4d8c57-4542-4357-99e6-57777fa85d2b
Verdict:	Malicious activity
Analysis date:	September 03, 2025, 17:42:23
OS:	Android 14
Indicators:
MD5:	530CA3129478C9C68400ADD0651C5324
SHA1:	62599194EB0A5B2EC91CDF608F015353210B86C3
SHA256:	576FF9403F5904CDB2A4FB8E2ADC003A16AE38D7D17EB6EF5F4A8D12300CA3FB
SSDEEP:	3:N8f/VKc6VKENeRL3EVq41D:23VKJze58q41D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

android (14)
android.cuttlefish.overlay (14)
android.cuttlefish.phone.overlay (14)
android.ext.services (2019-09)
android.ext.shared (1)
com.android.adservices.api (14)
com.android.apps.tag (1.1)
com.android.backupconfirm (14)
com.android.bips (14)
com.android.bluetoothmidiservice (14)
com.android.bookmarkprovider (14)
com.android.calendar (14)
com.android.calllogbackup (14)
com.android.camera2 (2.0.002)
com.android.cameraextensions (14)
com.android.captiveportallogin (14)
com.android.carrierconfig (1.0.0)
com.android.carrierdefaultapp (14)
com.android.cellbroadcastreceiver (R-initial)
com.android.cellbroadcastreceiver.module (R-initial)
com.android.cellbroadcastservice (R-initial)
com.android.certinstaller (14)
com.android.companiondevicemanager (14)
com.android.compos.payload (14)
com.android.connectivity.resources (S-initial)
com.android.connectivity.resources.cuttlefish.overlay (14)
com.android.contacts (1.7.34)
com.android.credentialmanager (14)
com.android.cts.ctsshim (14-10093150)
com.android.cts.priv.ctsshim (14-10093150)
com.android.deskclock (14)
com.android.devicelockcontroller (14)
com.android.dialer (23.0)
com.android.documentsui (14)
com.android.dreams.basic (14)
com.android.dreams.phototable (14)
com.android.dynsystem (14)
com.android.egg (1.0)
com.android.emergency (14)
com.android.ext.adservices.api (14)
com.android.externalstorage (14)
com.android.federatedcompute.services (T-initial)
com.android.gallery3d (1.1.40030)
com.android.google.gce.gceservice (14)
com.android.health.connect.backuprestore (14)
com.android.healthconnect.controller (14)
com.android.hotspot2.osulogin (14)
com.android.htmlviewer (14)
com.android.imsserviceentitlement (14)
com.android.inputdevices (14)
com.android.inputmethod.latin (14)
com.android.intentresolver (2021-11)
com.android.internal.display.cutout.emulation.corner (1.0)
com.android.internal.display.cutout.emulation.double (1.0)
com.android.internal.display.cutout.emulation.hole (1.0)
com.android.internal.display.cutout.emulation.tall (1.0)
com.android.internal.display.cutout.emulation.waterfall (1.0)
com.android.internal.systemui.navbar.gestural (1.0)
com.android.internal.systemui.navbar.gestural_extra_wide_back (1.0)
com.android.internal.systemui.navbar.gestural_narrow_back (1.0)
com.android.internal.systemui.navbar.gestural_wide_back (1.0)
com.android.internal.systemui.navbar.threebutton (1.0)
com.android.internal.systemui.navbar.transparent (1.0)
com.android.keychain (14)
com.android.launcher3 (14)
com.android.localtransport (14)
com.android.location.fused (14)
com.android.managedprovisioning (14)
com.android.messaging (1.0.001)
com.android.microdroid.empty_payload (14)
com.android.mms.service (14)
com.android.modulemetadata (14)
com.android.mtp (14)
com.android.music (14)
com.android.musicfx (1.4)
com.android.nearby.halfsheet (14)
com.android.networkstack (14)
com.android.networkstack.tethering (14)
com.android.networkstack.tethering.cuttlefishoverlay (1.0)
com.android.nfc (14)
com.android.ondevicepersonalization.services (T-initial)
com.android.ons (14)
com.android.packageinstaller (14)
com.android.pacprocessor (14)
com.android.permissioncontroller (33 system image)
com.android.phone (14)
com.android.printservice.recommendation (1.3.0)
com.android.printspooler (14)
com.android.providers.blockednumber (14)
com.android.providers.calendar (14)
com.android.providers.contacts (14)
com.android.providers.downloads (14)
com.android.providers.downloads.ui (14)
com.android.providers.media (14)
com.android.providers.media.module (14)
com.android.providers.partnerbookmarks (14)
com.android.providers.settings (14)
com.android.providers.settings.cuttlefish.overlay (14)
com.android.providers.telephony (14)
com.android.providers.userdictionary (14)
com.android.provision (14)
com.android.proxyhandler (14)
com.android.quicksearchbox (14)
com.android.rkpdapp (14)
com.android.role.notes.enabled (1.0)
com.android.safetycenter.resources (33 system image)
com.android.sdksandbox (T-initial)
com.android.se (14)
com.android.server.telecom (14)
com.android.settings (14)
com.android.settings.intelligence (14)
com.android.sharedstoragebackup (14)
com.android.shell (14)
com.android.simappdialog (14)
com.android.soundpicker (14)
com.android.statementservice (1.0)
com.android.stk (14)
com.android.storagemanager (14)
com.android.systemui (14)
com.android.systemui.accessibility.accessibilitymenu (14)
com.android.telephony.qns (14)
com.android.theme.font.notoserifsource (1.0)
com.android.traceur (1.0)
com.android.uwb.resources (T-initial)
com.android.virtualmachine.res (14)
com.android.vpndialogs (14)
com.android.wallpaper.livepicker (14)
com.android.wallpaperbackup (14)
com.android.wallpapercropper (14)
com.android.wallpaperpicker (1.0)
com.android.webview (137.0.7122.0)
com.android.wifi.dialog (14)
com.android.wifi.resources (R-initial)
com.android.wifi.resources.cf (1.0)
com.google.android.telephony.satellite (14)
org.chromium.chrome (137.0.7122.0)

Add for printing

MALICIOUS
- Detects root access on device
  - app_process64 (PID: 3669)
- Executes system commands or scripts
  - app_process64 (PID: 3669)
SUSPICIOUS
- Gets data of saved accounts
  - app_process64 (PID: 3669)
- Returns the name of the current network operator
  - app_process64 (PID: 3669)
- Accesses system-level resources
  - app_process64 (PID: 3669)
- Retrieves a list of running application processes
  - app_process64 (PID: 3669)
- Collects data about the device's environment (JVM version)
  - app_process64 (PID: 3669)
- Accesses memory information
  - app_process64 (PID: 3669)
- Retrieves installed applications on device
  - app_process64 (PID: 3669)
- Checks exemption from battery optimization
  - app_process64 (PID: 3669)
INFO
- Stores data using SQLite database
  - app_process64 (PID: 3669)
- Dynamically inspects or modifies classes, methods, and fields at runtime
  - app_process64 (PID: 3669)
- Gets file name without full path
  - app_process64 (PID: 3669)
- Retrieves the value of a global system setting
  - app_process64 (PID: 3669)
- Retrieves the value of a secure system setting
  - app_process64 (PID: 3669)
- Listens for changes in sensors
  - app_process64 (PID: 3669)
- Returns elapsed time since boot
  - app_process64 (PID: 3669)
- Retrieves CPU core information
  - app_process64 (PID: 3669)
- Gets the display metrics associated with the device's screen
  - app_process64 (PID: 3669)
- Verifies whether the device is connected to the internet
  - app_process64 (PID: 3669)
- Loads a native library into the application
  - app_process64 (PID: 3669)
- Dynamically registers broadcast event listeners
  - app_process64 (PID: 3669)
- Retrieves data from storage of application settings (SharedPreferences)
  - app_process64 (PID: 3669)
- Dynamically loads a class in Java
  - app_process64 (PID: 3669)
- Detects device power status
  - app_process64 (PID: 3669)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

166

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
2790	org.chromium.chrome	/system/bin/app_process64		app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2836	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2853	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0
2885	org.chromium.chrome:privileged_process0	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2905	com.android.adservices.api	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2966	com.android.providers.partnerbookmarks	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2983	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0
3081	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0
3101	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0
3120	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0

Add for printing

Total events

Read events

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

556

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3081	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.RyMAnY/list.pb		binary
		MD5:—	SHA256:—
3081	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.RyMAnY/manifest.json		binary
		MD5:—	SHA256:—
3081	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.RyMAnY/LICENSE		text
		MD5:—	SHA256:—
3081	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.RyMAnY/_metadata/verified_contents.json		text
		MD5:—	SHA256:—
3081	app_process64	/data/data/org.chromium.chrome/app_chrome/component_crx_cache/cab4d1f0a6a2a1afecae808a520f6690dd2b9d58bf54762877f2dc9715d55461		binary
		MD5:—	SHA256:—
3101	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.1Lxll2/decoded_xz		binary
		MD5:—	SHA256:—
3101	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.1Lxll2/97b4e68a7a79ae5be44033dbc869b57b36884d4ba50887521547c98b08363638		binary
		MD5:—	SHA256:—
3120	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.7uSvk9/privacy-sandbox-attestations.dat		binary
		MD5:—	SHA256:—
3120	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.7uSvk9/manifest.json		binary
		MD5:—	SHA256:—
3120	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.7uSvk9/_metadata/verified_contents.json		text
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	142.250.184.196:80	http://www.google.com/gen_204	unknown	—	—	whitelisted
2790	app_process64	GET	200	142.250.186.142:80	http://clients2.google.com/time/1/current?cup2key=9:ENBqjRhSXykri4ftCUqyPlvOA4jExEeulzlvKZdhKJ8&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	unknown	—	—	whitelisted
877	app_process64	GET	204	142.250.184.195:80	http://connectivitycheck.gstatic.com/generate_204	unknown	—	—	whitelisted
2790	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acmmwq7dser4xm5sepzjv74g65vq_2023.7.28.10/cffplpkejcbdpfnfabnjikeicbedmifn_2023.07.28.10_all_acgbwixmcanakp2bkoppyszsbkrq.crx3	unknown	—	—	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/niikhdgajlphfehepabhhblakbdgeefj/97b4e68a7a79ae5be44033dbc869b57b36884d4ba50887521547c98b08363638	unknown	—	—	whitelisted
2790	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/gcmjkmgdlgnkkcocmoeiminaijmmjnii/bae7d7966338476ee4829765db6d4bc00dce5f8715eacf3015eed0718f1a199b	unknown	—	—	whitelisted
2790	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/obedbbhbpmojnkanicioggnmelmoomoc/7ea8c389f285d819b2a9ecc8e8793e81634b53ef23455666d45a405e3ea2bc27	unknown	—	—	whitelisted
2790	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqrcrq6rsjrh7vogg2lkyjh7ipa_535/lmelglejhemejginpboagddgdfbepgmp_535_all_ZZ_ada6cpuj4euaooj45qfknst3dzeq.crx3	unknown	—	—	whitelisted
2790	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/kiabhabjdbkjdpjbpigfodbdjmbglcoo/1725ed486810df61a28e44f0833b0c8959ce5661fb0071fab774c1c995b71772	unknown	—	—	whitelisted
2790	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/kgdbnmlfakkebekbaceapiaenjgmlhan/6e0e891efa22dbd2e96881ebf4ad3d08d4c42b3eae9ec323a658cea3dc764dc4	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
443	mdnsd	224.0.0.251:5353	—	—	—	unknown
—	—	142.250.184.196:80	www.google.com	GOOGLE	US	whitelisted
—	—	142.250.184.196:443	www.google.com	GOOGLE	US	whitelisted
—	—	142.250.184.195:80	connectivitycheck.gstatic.com	GOOGLE	US	whitelisted
2790	app_process64	142.250.186.142:80	clients2.google.com	GOOGLE	US	whitelisted
2790	app_process64	142.250.27.84:443	accounts.google.com	GOOGLE	US	whitelisted
2790	app_process64	5.53.121.218:443	trashbox.ru	OOO Network of data-centers Selectel	RU	whitelisted
2790	app_process64	142.250.184.196:443	www.google.com	—	—	whitelisted
2790	app_process64	5.255.255.77:443	yandex.ru	YANDEX LLC	RU	whitelisted
2790	app_process64	88.212.201.198:443	counter.yadro.ru	United Network LLC	RU	whitelisted

DNS requests

Domain	IP	Reputation
google.com	142.250.186.46	whitelisted
www.google.com	142.250.184.196 142.250.181.228	whitelisted
clients2.google.com	142.250.186.142	whitelisted
accounts.google.com	142.250.27.84	whitelisted
trashbox.ru	5.53.121.218	whitelisted
counter.yadro.ru	88.212.201.198 88.212.202.52 88.212.201.204	whitelisted
vk.com	87.240.137.164 87.240.129.133 93.186.225.194 87.240.132.78 87.240.132.67 87.240.132.72	whitelisted
mc.yandex.ru	87.250.251.119 87.250.250.119 77.88.21.119	whitelisted
yandex.ru	5.255.255.77 77.88.44.55 77.88.55.88	whitelisted
content-autofill.googleapis.com	142.250.186.106 142.250.186.138 142.250.186.42 142.250.185.170 142.250.185.234 172.217.16.202 142.250.181.234 142.250.185.74 142.250.185.138 172.217.18.106 142.250.185.106 172.217.18.10 216.58.206.42 142.250.74.202 142.250.186.74 142.250.185.202	whitelisted

Threats

PID	Process	Class	Message
2790	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2790	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2790	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2790	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2790	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2790	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2790	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2790	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2790	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
2790	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)

Add for printing

No debug info

General Info

https://trashbox.ru/files30/2173289/ru.oneme.app_6398_rs.apk/

530CA3129478C9C68400ADD0651C5324

62599194EB0A5B2EC91CDF608F015353210B86C3

576FF9403F5904CDB2A4FB8E2ADC003A16AE38D7D17EB6EF5F4A8D12300CA3FB

3:N8f/VKc6VKENeRL3EVq41D:23VKJze58q41D

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Detects root access on device

Executes system commands or scripts

SUSPICIOUS

Gets data of saved accounts

Returns the name of the current network operator

Accesses system-level resources

Retrieves a list of running application processes

Collects data about the device's environment (JVM version)

Accesses memory information

Retrieves installed applications on device

Checks exemption from battery optimization

INFO

Stores data using SQLite database

Dynamically inspects or modifies classes, methods, and fields at runtime

Gets file name without full path

Retrieves the value of a global system setting

Retrieves the value of a secure system setting

Listens for changes in sensors

Returns elapsed time since boot

Retrieves CPU core information

Gets the display metrics associated with the device's screen

Verifies whether the device is connected to the internet

Loads a native library into the application

Dynamically registers broadcast event listeners

Retrieves data from storage of application settings (SharedPreferences)

Dynamically loads a class in Java

Detects device power status

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings