34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3a:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T452,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 3c7feead8438… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3c7feead8438…. Threat score 100/100. 0/24 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3c7feead84381823ef5673e8e173d8f664bd29f4938886abff4332737f6ad359","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","3c7feead84381823ef5673e8e173d8f664bd29f4938886abff4332737f6ad359"],"about":{"@type":"SoftwareApplication","name":"Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk","applicationCategory":["android"],"identifier":"3c7feead84381823ef5673e8e173d8f664bd29f4938886abff4332737f6ad359","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":2,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T2039,"SELECT count(*) FROM sqlite_master WHERE name != \'android_metadata\'" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.gi7$a.smali.gi7$a.smali Indicator: "select count(*) from sqlite_master where name != \'android_metadata\'") "SELECT 1 FROM sqlite_master WHERE type = \'table\' AND name=\'room_master_table\'" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.gi7$a.smali.gi7$a.smali Indicator: "select 1 from sqlite_master where type = \'table\' and name=\'room_master_table\'") "INSERT OR IGNORE INTO `WorkName` (`name`,`work_spec_id`) VALUES (?,?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.fha$a.smali.fha$a.smali Indicator: "insert or ignore into `workname` (`name`,`work_spec_id`) values (?,?)") "SELECT * FROM SystemIdInfo WHERE work_spec_id=? AND generation=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.n29.smali.n29.smali Indicator: "select * from systemidinfo where work_spec_id=? and generation=?") "SELECT DISTINCT work_spec_id FROM SystemIdInfo" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.n29.smali.n29.smali Indicator: "select distinct work_spec_id from systemidinfo") "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, \'" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.hh7.smali.hh7.smali Indicator: "insert or replace into room_master_table (id,identity_hash) values(42, \'") "UPDATE workspec SET output=? WHERE id=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha$j.smali.qha$j.smali Indicator: "update workspec set output=? where id=?") "INSERT OR REPLACE INTO `WorkProgress` (`work_spec_id`,`progress`) VALUES (?,?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.iha$a.smali.iha$a.smali Indicator: "insert or replace into `workprogress` (`work_spec_id`,`progress`) values (?,?)") "INSERT OR REPLACE INTO `Preference` (`key`, `long_value`) VALUES (@key, @long_value)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.wx3.smali.wx3.smali Indicator: "insert or replace into `preference` (`key`, `long_value`) values (@key, @long_value)") "DELETE FROM workspec WHERE state IN (2, 3, 5) AND (SELECT COUNT(*)=0 FROM dependency WHERE prerequisite_id=id AND work_spec_id NOT IN (SELECT id FROM workspec WHERE state IN (2, 3, 5)))" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha$c.smali.qha$c.smali Indicator: "delete from workspec where state in (2, 3, 5) and (select count(*)=0 from dependency where prerequisite_id=id and work_spec_id not in (select id from workspec where state in (2, 3, 5)))") "INSERT OR IGNORE INTO `Dependency` (`work_spec_id`,`prerequisite_id`) VALUES (?,?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.zr1$a.smali.zr1$a.smali Indicator: "insert or ignore into `dependency` (`work_spec_id`,`prerequisite_id`) values (?,?)") "UPDATE workspec SET state=? WHERE id=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha$h.smali.qha$h.smali Indicator: "update workspec set state=? where id=?") "SELECT name FROM workname WHERE work_spec_id=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.fha.smali.fha.smali Indicator: "select name from workname where work_spec_id=?") "SELECT name FROM sqlite_master WHERE type = \'trigger\'" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.bg1.smali.bg1.smali Indicator: "select name from sqlite_master where type = \'trigger\'") "INSERT OR IGNORE INTO `WorkTag` (`tag`,`work_spec_id`) VALUES (?,?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.uha$a.smali.uha$a.smali Indicator: "insert or ignore into `worktag` (`tag`,`work_spec_id`) values (?,?)") "INSERT OR REPLACE INTO `Preference` (`key`,`long_value`) VALUES (?,?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.se6$a.smali.se6$a.smali Indicator: "insert or replace into `preference` (`key`,`long_value`) values (?,?)") "UPDATE workspec SET generation=generation+1 WHERE id=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha$d.smali.qha$d.smali Indicator: "update workspec set generation=generation+1 where id=?") "UPDATE workspec SET schedule_requested_at=? WHERE id=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha$a.smali.qha$a.smali Indicator: "update workspec set schedule_requested_at=? where id=?") "CREATE TABLE IF NOT EXISTS `Preference` (`key` TEXT NOT NULL, `long_value` INTEGER, PRIMARY KEY(`key`))" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.cha.smali.cha.smali Indicator: "create table if not exists `preference` (`key` text not null, `long_value` integer, primary key(`key`))") "UPDATE workspec SET period_count = 1 WHERE last_enqueue_time <> 0 AND interval_duration <> 0" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.ru.smali.ru.smali Indicator: "update workspec set period_count = 1 where last_enqueue_time <> 0 and interval_duration <> 0") "INSERT OR REPLACE INTO `SystemIdInfo` (`work_spec_id`,`generation`,`system_id`) VALUES (?,?,?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.n29$a.smali.n29$a.smali Indicator: "insert or replace into `systemidinfo` (`work_spec_id`,`generation`,`system_id`) values (?,?,?)") "DELETE FROM SystemIdInfo where work_spec_id=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.n29$c.smali.n29$c.smali Indicator: "delete from systemidinfo where work_spec_id=?") "SELECT * FROM workspec WHERE last_enqueue_time >= ? AND state IN (2, 3, 5) ORDER BY last_enqueue_time DESC" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha.smali.qha.smali Indicator: "select * from workspec where last_enqueue_time >= ? and state in (2, 3, 5) order by last_enqueue_time desc") "SELECT * FROM workspec WHERE state=0 AND schedule_requested_at<>-1" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha.smali.qha.smali Indicator: "select * from workspec where state=0 and schedule_requested_at<>-1") "SELECT id FROM workspec WHERE state NOT IN (2, 3, 5) AND id IN (SELECT work_spec_id FROM workname WHERE name=?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha.smali.qha.smali Indicator: "select id from workspec where state not in (2, 3, 5) and id in (select work_spec_id from workname where name=?)")37:T2039,"SELECT count(*) FROM sqlite_master WHERE name != \'android_metadata\'" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.gi7$a.smali.gi7$a.smali Indicator: "select count(*) from sqlite_master where name != \'android_metadata\'") "SELECT 1 FROM sqlite_master WHERE type = \'table\' AND name=\'room_master_table\'" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.gi7$a.smali.gi7$a.smali Indicator: "select 1 from sqlite_master where type = \'table\' and name=\'room_master_table\'") "INSERT OR IGNORE INTO `WorkName` (`name`,`work_spec_id`) VALUES (?,?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.fha$a.smali.fha$a.smali Indicator: "insert or ignore into `workname` (`name`,`work_spec_id`) values (?,?)") "SELECT * FROM SystemIdInfo WHERE work_spec_id=? AND generation=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.n29.smali.n29.smali Indicator: "select * from systemidinfo where work_spec_id=? and generation=?") "SELECT DISTINCT work_spec_id FROM SystemIdInfo" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.n29.smali.n29.smali Indicator: "select distinct work_spec_id from systemidinfo") "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, \'" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.hh7.smali.hh7.smali Indicator: "insert or replace into room_master_table (id,identity_hash) values(42, \'") "UPDATE workspec SET output=? WHERE id=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha$j.smali.qha$j.smali Indicator: "update workspec set output=? where id=?") "INSERT OR REPLACE INTO `WorkProgress` (`work_spec_id`,`progress`) VALUES (?,?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.iha$a.smali.iha$a.smali Indicator: "insert or replace into `workprogress` (`work_spec_id`,`progress`) values (?,?)") "INSERT OR REPLACE INTO `Preference` (`key`, `long_value`) VALUES (@key, @long_value)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.wx3.smali.wx3.smali Indicator: "insert or replace into `preference` (`key`, `long_value`) values (@key, @long_value)") "DELETE FROM workspec WHERE state IN (2, 3, 5) AND (SELECT COUNT(*)=0 FROM dependency WHERE prerequisite_id=id AND work_spec_id NOT IN (SELECT id FROM workspec WHERE state IN (2, 3, 5)))" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha$c.smali.qha$c.smali Indicator: "delete from workspec where state in (2, 3, 5) and (select count(*)=0 from dependency where prerequisite_id=id and work_spec_id not in (select id from workspec where state in (2, 3, 5)))") "INSERT OR IGNORE INTO `Dependency` (`work_spec_id`,`prerequisite_id`) VALUES (?,?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.zr1$a.smali.zr1$a.smali Indicator: "insert or ignore into `dependency` (`work_spec_id`,`prerequisite_id`) values (?,?)") "UPDATE workspec SET state=? WHERE id=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha$h.smali.qha$h.smali Indicator: "update workspec set state=? where id=?") "SELECT name FROM workname WHERE work_spec_id=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.fha.smali.fha.smali Indicator: "select name from workname where work_spec_id=?") "SELECT name FROM sqlite_master WHERE type = \'trigger\'" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.bg1.smali.bg1.smali Indicator: "select name from sqlite_master where type = \'trigger\'") "INSERT OR IGNORE INTO `WorkTag` (`tag`,`work_spec_id`) VALUES (?,?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.uha$a.smali.uha$a.smali Indicator: "insert or ignore into `worktag` (`tag`,`work_spec_id`) values (?,?)") "INSERT OR REPLACE INTO `Preference` (`key`,`long_value`) VALUES (?,?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.se6$a.smali.se6$a.smali Indicator: "insert or replace into `preference` (`key`,`long_value`) values (?,?)") "UPDATE workspec SET generation=generation+1 WHERE id=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha$d.smali.qha$d.smali Indicator: "update workspec set generation=generation+1 where id=?") "UPDATE workspec SET schedule_requested_at=? WHERE id=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha$a.smali.qha$a.smali Indicator: "update workspec set schedule_requested_at=? where id=?") "CREATE TABLE IF NOT EXISTS `Preference` (`key` TEXT NOT NULL, `long_value` INTEGER, PRIMARY KEY(`key`))" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.cha.smali.cha.smali Indicator: "create table if not exists `preference` (`key` text not null, `long_value` integer, primary key(`key`))") "UPDATE workspec SET period_count = 1 WHERE last_enqueue_time <> 0 AND interval_duration <> 0" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.ru.smali.ru.smali Indicator: "update workspec set period_count = 1 where last_enqueue_time <> 0 and interval_duration <> 0") "INSERT OR REPLACE INTO `SystemIdInfo` (`work_spec_id`,`generation`,`system_id`) VALUES (?,?,?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.n29$a.smali.n29$a.smali Indicator: "insert or replace into `systemidinfo` (`work_spec_id`,`generation`,`system_id`) values (?,?,?)") "DELETE FROM SystemIdInfo where work_spec_id=?" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.n29$c.smali.n29$c.smali Indicator: "delete from systemidinfo where work_spec_id=?") "SELECT * FROM workspec WHERE last_enqueue_time >= ? AND state IN (2, 3, 5) ORDER BY last_enqueue_time DESC" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha.smali.qha.smali Indicator: "select * from workspec where last_enqueue_time >= ? and state in (2, 3, 5) order by last_enqueue_time desc") "SELECT * FROM workspec WHERE state=0 AND schedule_requested_at<>-1" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha.smali.qha.smali Indicator: "select * from workspec where state=0 and schedule_requested_at<>-1") "SELECT id FROM workspec WHERE state NOT IN (2, 3, 5) AND id IN (SELECT work_spec_id FROM workname WHERE name=?)" (Source: .tmp.3a50b9cd-f012-48d5-8bbc-24ca8c974620.Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk.decoded.smali.qha.smali.qha.smali Indicator: "select id from workspec where state not in (2, 3, 5) and id in (select work_spec_id from workname where name=?)")38:T21cb,"MAXI123444.SF" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "ASM" has type "ASCII text"- [targetUID: N/A] "MAXI123444.RSA" has type "data"- [targetUID: N/A] "INDEX.LIST" has type "ASCII text"- [targetUID: N/A] "com.google.protobuf.GeneratedExtensionRegistryLoader" has type "ASCII text"- [targetUID: N/A] "androidx.hilt_hilt-work.version" has type "ASCII text"- [targetUID: N/A] "androidx.room_room-rxjava2.version" has type "ASCII text"- [targetUID: N/A] "androidx.navigation_navigation-common-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.fragment_fragment-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.autofill_autofill.version" has type "ASCII text"- [targetUID: N/A] "androidx.savedstate_savedstate-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.core_core.version" has type "ASCII text"- [targetUID: N/A] "androidx.sqlite_sqlite-framework.version" has type "ASCII text"- [targetUID: N/A] "androidx.annotation_annotation-experimental.version" has type "ASCII text"- [targetUID: N/A] "androidx.recyclerview_recyclerview.version" has type "ASCII text"- [targetUID: N/A] "androidx.navigation_navigation-fragment-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.appcompat_appcompat-resources.version" has type "ASCII text"- [targetUID: N/A] "androidx.activity_activity-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.arch.core_core-testing.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.animation_animation-core.version" has type "ASCII text"- [targetUID: N/A] "androidx.vectordrawable_vectordrawable.version" has type "ASCII text"- [targetUID: N/A] "androidx.webkit_webkit.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-livedata.version" has type "ASCII text"- [targetUID: N/A] "androidx.media_media.version" has type "ASCII text"- [targetUID: N/A] "androidx.work_work-runtime.version" has type "ASCII text"- [targetUID: N/A] "androidx.exifinterface_exifinterface.version" has type "ASCII text"- [targetUID: N/A] "com.google.dagger_dagger-android.version" has type "ASCII text"- [targetUID: N/A] "kotlinx_coroutines_jdk8.version" has type "ASCII text with no line terminators"- [targetUID: N/A] "com.google.dagger_hilt-core.version" has type "ASCII text"- [targetUID: N/A] "androidx.databinding_library.version" has type "ASCII text with no line terminators"- [targetUID: N/A] "androidx.databinding_viewbinding.version" has type "ASCII text with no line terminators"- [targetUID: N/A] "kotlinx.coroutines.CoroutineExceptionHandler" has type "ASCII text"- [targetUID: N/A] "kotlinx.coroutines.internal.MainDispatcherFactory" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-process.version" has type "ASCII text"- [targetUID: N/A] "androidx.room_room-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.legacy_legacy-support-core-ui.version" has type "ASCII text"- [targetUID: N/A] "androidx.core_core-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.ui_ui-unit.version" has type "ASCII text"- [targetUID: N/A] "androidx.hilt_hilt-navigation-compose.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-viewmodel-savedstate.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-runtime-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.documentfile_documentfile.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.ui_ui-tooling.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-viewmodel-compose.version" has type "ASCII text"- [targetUID: N/A] "androidx.legacy_legacy-support-core-utils.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-livedata-core.version" has type "ASCII text"- [targetUID: N/A] "androidx.savedstate_savedstate.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.runtime_runtime-livedata.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-viewmodel.version" has type "ASCII text"- [targetUID: N/A] "androidx.window_window.version" has type "ASCII text"- [targetUID: N/A] "androidx.cardview_cardview.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.runtime_runtime.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.foundation_foundation.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.runtime_runtime-saveable.version" has type "ASCII text"- [targetUID: N/A] "androidx.navigation_navigation-ui-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-livedata-core-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.fragment_fragment.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.material_material-ripple.version" has type "ASCII text"- [targetUID: N/A] "androidx.customview_customview.version" has type "ASCII text"- [targetUID: N/A] "androidx.coordinatorlayout_coordinatorlayout.version" has type "ASCII text"- [targetUID: N/A] "androidx.customview_customview-poolingcontainer.version" has type "ASCII text"- [targetUID: N/A] "androidx.swiperefreshlayout_swiperefreshlayout.version" has type "ASCII text"- [targetUID: N/A] "androidx.dynamicanimation_dynamicanimation.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.ui_ui-text.version" has type "ASCII text"- [targetUID: N/A] "androidx.tracing_tracing.version" has type "ASCII text"- [targetUID: N/A] "androidx.palette_palette.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.animation_animation.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.ui_ui-geometry.version" has type "ASCII text"- [targetUID: N/A] "androidx.navigation_navigation-common.version" has type "ASCII text"- [targetUID: N/A] "androidx.hilt_hilt-navigation.version" has type "ASCII text"- [targetUID: N/A] "androidx.profileinstaller_profileinstaller.version" has type "ASCII text"- [targetUID: N/A] "androidx.navigation_navigation-compose.version" has type "ASCII text"- [targetUID: N/A] "androidx.drawerlayout_drawerlayout.version" has type "ASCII text"- [targetUID: N/A] "androidx.asynclayoutinflater_asynclayoutinflater.version" has type "ASCII text"- [targetUID: N/A] "androidx.navigation_navigation-fragment.version" has type "ASCII text"- [targetUID: N/A] "androidx.localbroadcastmanager_localbroadcastmanager.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-viewmodel-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.ui_ui-tooling-data.version" has type "ASCII text"- [targetUID: N/A] "androidx.startup_startup-runtime.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.material_material.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-runtime.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.ui_ui.version" has type "ASCII text"- [targetUID: N/A] "androidx.navigation_navigation-runtime-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.emoji2_emoji2.version" has type "ASCII text"- [targetUID: N/A] "androidx.sqlite_sqlite.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.ui_ui-util.version" has type "ASCII text"- [targetUID: N/A] "androidx.arch.core_core-runtime.version" has type "ASCII text"- [targetUID: N/A] "androidx.emoji2_emoji2-views-helper.version" has type "ASCII text"- [targetUID: N/A] "androidx.legacy_legacy-support-v4.version" has type "ASCII text"- [targetUID: N/A] "androidx.cursoradapter_cursoradapter.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-service.version" has type "ASCII text"- [targetUID: N/A] "androidx.compose.material_material-icons-core.version" has type "ASCII text"- [targetUID: N/A] "kotlinx_coroutines_core.version" has type "ASCII text with no line terminators"- [targetUID: N/A] "kotlinx_coroutines_play_services.version" has type "ASCII text with no line terminators"- [targetUID: N/A] "kotlinx_coroutines_reactive.version" has type "ASCII text with no line terminators"- [targetUID: N/A] "com.google.dagger_dagger-android-support.version" has type "ASCII text"- [targetUID: N/A] "com.google.dagger_hilt-android.version" has type "ASCII text"- [targetUID: N/A] "com.google.dagger_dagger.version" has type "ASCII text"- [targetUID: N/A] "com.google.dagger_dagger-lint-aar.version" has type "ASCII text"- [targetUID: N/A] "kotlinx_coroutines_android.version" has type "ASCII text with no line terminators"- [targetUID: N/A]39:T6aa,Heuristic match: "s'.Re" Heuristic match: "?x.tC" Heuristic match: "u)6.af" Heuristic match: "ex.wf" Heuristic match: "J~c.iR" Heuristic match: "LineHeightStyle.Alignment.Top" Heuristic match: "arrayType.name" Heuristic match: "androidx.work.util.id" Heuristic match: "type.name" Heuristic match: "clazz.name" Pattern match: "http://ns.adobe.com/xap/1.0/\u0000" Pattern match: "http://schemas.android.com/apk/res/android" Heuristic match: "Name: META-INF/androidx.localbroadcastmanager_localbroadcastmanager.ve" Heuristic match: "Name: res/drawable-hdpi-v4/abc_scrubber_control_to_pressed_mtrl_000.pn" Heuristic match: "Name: res/drawable-hdpi-v4/abc_scrubber_control_to_pressed_mtrl_005.pn" Heuristic match: "Name: res/drawable-hdpi-v4/applovin_ic_mediation_amazon_marketplace.pn" Heuristic match: "Name: res/drawable-ldpi-v4/applovin_ic_mediation_amazon_marketplace.pn" Heuristic match: "Name: res/drawable-mdpi-v4/abc_scrubber_control_to_pressed_mtrl_000.pn" Heuristic match: "Name: res/drawable-mdpi-v4/abc_scrubber_control_to_pressed_mtrl_005.pn" Heuristic match: "Name: res/drawable-mdpi-v4/applovin_ic_mediation_amazon_marketplace.pn" Heuristic match: "Name: res/drawable-xhdpi-v4/abc_list_selector_disabled_holo_light.9.pn" Heuristic match: "Name: res/drawable-xhdpi-v4/applovin_ic_baseline_add_circle_outline.pn" Heuristic match: "Name: res/drawable-xhdpi-v4/applovin_ic_mediation_google_ad_manager.pn" Heuristic match: "Name: res/drawable-xhdpi-v4/com_facebook_tooltip_black_background.9.pn" Heuristic match: "Name: res/drawable-xxhdpi-v4/abc_list_selector_disabled_holo_dark.9.pn" Heuristic match: "Name: res/drawable-xxhdpi-v4/com_facebook_button_like_icon_selected.pn"30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"3c7feead84381823ef5673e8e173d8f664bd29f4938886abff4332737f6ad359","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793947345689,"unified_at":"2026-11-06T06:42:25.689Z","metadata":{"hashes":{"sha256":"3c7feead84381823ef5673e8e173d8f664bd29f4938886abff4332737f6ad359","sha1":"e914459d6bd271e4a4a9a680494d27eedbc4dc4c","md5":"5d0772b1ae97a8cd44cf355065996cd5","sha512":"b784451fd496a2c115909871fa769166920acad42f11acb381d2d66b7f4a355a1442c9b44a16a60cc4b65be7542fb1df5e1cf336b80e3d7ac6a8494e90ffebef","ssdeep":"786432:IRWCH80NoKSiYBvad7QE8k/T2Ste7r4+1iZx5f9tP6VM2cvDRDm3C++rfwNowoTJ:IRM0m93I8ka8eP4+wlleEFm3/otTJ","ssdeep_chunks":["786432:IRWCH80","786432:RWCH80N","786432:WCH80No","786432:CH80NoK","786432:H80NoKS","786432:80NoKSi","786432:0NoKSiY","786432:NoKSiYB","786432:oKSiYBv","786432:KSiYBva","786432:SiYBvad","786432:iYBvad7","786432:YBvad7Q","786432:Bvad7QE","786432:vad7QE8","786432:ad7QE8k","786432:d7QE8k/","786432:7QE8k/T","786432:QE8k/T2","786432:E8k/T2S","786432:8k/T2St","786432:k/T2Ste","786432:/T2Ste7","786432:T2Ste7r","786432:2Ste7r4","786432:Ste7r4+","786432:te7r4+1","786432:e7r4+1i","786432:7r4+1iZ","786432:r4+1iZx","786432:4+1iZx5","786432:+1iZx5f","786432:1iZx5f9","786432:iZx5f9t","786432:Zx5f9tP","786432:x5f9tP6","786432:5f9tP6V","786432:f9tP6VM","786432:9tP6VM2","786432:tP6VM2c","786432:P6VM2cv","786432:6VM2cvD","786432:VM2cvDR","786432:M2cvDRD","786432:2cvDRDm","786432:cvDRDm3","786432:vDRDm3C","786432:DRDm3C+","786432:RDm3C++","786432:Dm3C++r","786432:m3C++rf","786432:3C++rfw","786432:C++rfwN","786432:++rfwNo","786432:+rfwNow","786432:rfwNowo","786432:fwNowoT","786432:wNowoTJ","1572864:IRWCH80","1572864:RWCH80N","1572864:WCH80No","1572864:CH80NoK","1572864:H80NoKS","1572864:80NoKSi","1572864:0NoKSiY","1572864:NoKSiYB","1572864:oKSiYBv","1572864:KSiYBva","1572864:SiYBvad","1572864:iYBvad7","1572864:YBvad7Q","1572864:Bvad7QE","1572864:vad7QE8","1572864:ad7QE8k","1572864:d7QE8k/","1572864:7QE8k/T","1572864:QE8k/T2","1572864:E8k/T2S","1572864:8k/T2St","1572864:k/T2Ste","1572864:/T2Ste7","1572864:T2Ste7r","1572864:2Ste7r4","1572864:Ste7r4+","1572864:te7r4+1","1572864:e7r4+1i","1572864:7r4+1iZ","1572864:r4+1iZx","1572864:4+1iZx5","1572864:+1iZx5f","1572864:1iZx5f9","1572864:iZx5f9t","1572864:Zx5f9tP","1572864:x5f9tP6","1572864:5f9tP6V","1572864:f9tP6VM","1572864:9tP6VM2","1572864:tP6VM2c","1572864:P6VM2cv","1572864:6VM2cvD","1572864:VM2cvDR","1572864:M2cvDRD","1572864:2cvDRDm","1572864:cvDRDm3","1572864:vDRDm3C","1572864:DRDm3C+","1572864:RDm3C++","1572864:Dm3C++r","1572864:m3C++rf","1572864:3C++rfw","1572864:C++rfwN","1572864:++rfwNo","1572864:+rfwNow","1572864:rfwNowo","1572864:fwNowoT","1572864:wNowoTJ","786432:IRM0m93","786432:RM0m93I","786432:M0m93I8","786432:0m93I8k","786432:m93I8ka","786432:93I8ka8","786432:3I8ka8e","786432:I8ka8eP","786432:8ka8eP4","786432:ka8eP4+","786432:a8eP4+w","786432:8eP4+wl","786432:eP4+wll","786432:P4+wlle","786432:4+wlleE","786432:+wlleEF","786432:wlleEFm","786432:lleEFm3","786432:leEFm3/","786432:eEFm3/o","786432:EFm3/ot","786432:Fm3/otT","786432:m3/otTJ"],"imphash":"Unknown"},"file_info":{"file_name":"Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk","file_type":["android"],"file_type_id":"apk","file_size":52376401,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1704397562000,"last_seen":1704425530000,"last_multi_scan":1704425530000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":8,"suspicious_count":3,"malicious_count":2,"total":13},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Broadcast Receivers","attack_id":"T1402","attack_id_wiki":"https://attack.mitre.org/techniques/T1402","identifiers":[{"type":"malicious","value":"Has the ability to execute code after reboot"}],"sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"tactic":"Collection","technique":"Audio Capture","attack_id":"T1429","attack_id_wiki":"https://attack.mitre.org/techniques/T1429","identifiers":[{"type":"suspicious","value":"Has the ability to record audio"}],"sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.896919545911336","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$36","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"Name: res/drawable-hdpi-v4/intercom_icn_twitter.png\" (Indicator: \"twitter\"; File: \"MAXI123444.SF\")\n Found string \"Name: res/drawable-mdpi-v4/intercom_icn_twitter.png\" (Indicator: \"twitter\"; File: \"MAXI123444.SF\")\n Found string \"Name: res/drawable-xhdpi-v4/intercom_icn_twitter.png\" (Indicator: \"twitter\"; File: \"MAXI123444.SF\")\n Found string \"Name: res/drawable-xxhdpi-v4/intercom_icn_twitter.png\" (Indicator: \"twitter\"; File: \"MAXI123444.SF\")\n Found string \"Name: res/drawable/intercom_twitter.xml\" (Indicator: \"twitter\"; File: \"MAXI123444.SF\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$37","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$38","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$39","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"encodeToString(bytes, Base64.DEFAULT)\" (Indicator: \"base64\"; File: \"z72.smali\")\n Found string \"SHA-256-Digest: EaESqHe0dh09JDfnHPyn9Yt/hC2L/zuugknHJ0NnLBw=\" (Indicator: \"aes\"; File: \"MAXI123444.SF\")\n Found string \"SHA-256-Digest: xMde04fSE2DIekGJPBcOFMHhAESVAuEUnPEcBup9aNk=\" (Indicator: \"aes\"; File: \"MAXI123444.SF\")\n Found string \"SHA-256-Digest: /ijcvtcDyhJNlaEseFu5TJj8cURxYRhCO7/qCoDJG7k=\" (Indicator: \"aes\"; File: \"MAXI123444.SF\")\n Found string \"SHA-256-Digest: fIxXxb32erEaBO9eCo2z0mXYzWlRdS0A1DNRdyiAes8=\" (Indicator: \"aes\"; File: \"MAXI123444.SF\")\n Found string \"SHA-256-Digest: pHFEXSnOcBd7aES1SVH3lezKvuW2uKLcONr6OEB4X0M=\" (Indicator: \"aes\"; File: \"MAXI123444.SF\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/59 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"v@lhk.j\"\n Pattern match: \"3@ot.i\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Has the ability to record audio","description":"Permission request for \"android.permission.RECORD_AUDIO\"","origin":"Static Parser","mitre_attack_id":"T1429","relevance":10,"id":"static-34","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Has the ability to execute code after reboot","description":"Permission request for \"android.permission.RECEIVE_BOOT_COMPLETED\"","origin":"Static Parser","mitre_attack_id":"T1402","relevance":10,"id":"static-28","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Bolonyokte\" classified file \"sample.bin\" as \"rat\" (Author: Jean-Philippe Teissier / @Jipe_)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Has the ability to record audio"}],"sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Has the ability to execute code after reboot"}],"sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]}]},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"65970af480466713fe005cb7","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Android.Malct","submit_name":"Busuu Learn Languages v31.10.3(906071) Premium Mod Apk {CracksHash}.apk","analysis_start_time":"2024-01-04T19:46:04+00:00","indicators_count":{"informative":8,"suspicious":4,"malicious":2},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"MAXI123444.SF","sha256":"ae8a31094e51a7708ccb3b63ff3b721f5d0fafdf347070df06e94638e32c46c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"ASM","sha256":"337e92fd361effe495d03978a34a3cd44681a63b8329adfd99c8996b306b2a8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"MAXI123444.RSA","sha256":"8934e2119bbe3a18cc7d26575cf03550fd335a6933f21272f4c03c5a0ab874be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"INDEX.LIST","sha256":"e47757b0b0629767d45c2c2de3ec6194c563d57f21c21e4edc108eb23dfa7266","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"com.google.protobuf.GeneratedExtensionRegistryLoader","sha256":"0a1457479eb5254ab5a6c044cc44ee6ad3eafc7544339395e2442c09f2b5a06a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.hilt_hilt-work.version","sha256":"bc9c67fcb0060930df08ece422b785f7c5c2df9179c33e0cb458d5af5515e7c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.room_room-rxjava2.version","sha256":"7df73b8e407cc08ce7babfd544ab4ad92a7f62cf73a21468d2bfae85c0508c7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.navigation_navigation-common-ktx.version","sha256":"99600f6a7bfe6c33ebd1a2518f44a861a67afc40c25da42bc622595716529584","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.fragment_fragment-ktx.version","sha256":"04c93b7e7635a43d0cb6d097f9af0a72a9973041d11847e521cc682f1668c605","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.autofill_autofill.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.savedstate_savedstate-ktx.version","sha256":"1e5b51cde515396a9fa762909cf8ca6584ccc564b325d2eebeea76175fe95c4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.core_core.version","sha256":"30f4611383aa30a15753789f40effde81332f2f8714e6d3b2940bf0fc4592377","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.sqlite_sqlite-framework.version","sha256":"a42caf4a54bbbe27aa45b6efbc6356c5e299b19763e728b6cdb7201b02ebbe36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.annotation_annotation-experimental.version","sha256":"64d23f858ef51b0f996e4966d4e27c0371b437e2d2787890b1f7ad22d4ec5663","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.recyclerview_recyclerview.version","sha256":"6cf4e084b47f33c9b02ef79279d157833868f8f70514169a768be353ee328fea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.navigation_navigation-fragment-ktx.version","sha256":"732f64d874f90788c0199b0c19bfd9b3b6436e140114e53e462832532d74c61c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.appcompat_appcompat-resources.version","sha256":"6430a242e9486093ef6f71d9086d48f61ba102f0d2fb0f5b95334c6007a46db3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.activity_activity-ktx.version","sha256":"cb1d9a30bc4ab8a397f39b7d786bb82aca0b816077eefc35d7c822017d75f6a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.arch.core_core-testing.version","sha256":"c89b87c262e9d5ffd20e73aac74a1772adcc9f5a21682cc33adcf5086e5fef5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]},{"name":"androidx.compose.animation_animation-core.version","sha256":"cc52f678848b814373757b460383bf61960e4943c203735adde0a350b3e50989","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65970af480466713fe005cb7"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["65970af480466713fe005cb7"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Sample 3c7feead8438… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3c7feead8438…. Threat score 100/100. 0/24 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3c7feead84381823ef5673e8e173d8f664bd29f4938886abff4332737f6ad359"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 3c7feead8438… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3c7feead8438…. Threat score 100/100. 0/24 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3c7feead84381823ef5673e8e173d8f664bd29f4938886abff4332737f6ad359"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 3c7feead8438… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3c7feead8438…. Threat score 100/100. 0/24 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]] 32:null