24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T44c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample a2795f27607d… — Score 55/100 — Hybrid Analysis","description":"Malicious verdict for sample a2795f27607d…. Threat score 55/100. 0/24 AV engines flagged this file. 1 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a2795f27607d2bc856381a9c786e3849e35c7991b30446a75b260cfc7f918b81","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","a2795f27607d2bc856381a9c786e3849e35c7991b30446a75b260cfc7f918b81"],"about":{"@type":"SoftwareApplication","name":"Home Workout - No Equipment v1.2.16 Premium Mod Apk {CracksHash}.apk","applicationCategory":["android"],"identifier":"a2795f27607d2bc856381a9c786e3849e35c7991b30446a75b260cfc7f918b81","additionalType":"Malicious sample"},"threatScore":55,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":1,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T841,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "libaoecore.so") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "libaoecore.so") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "libaoecore.so_1706988685772") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "libaoecore.so_1706988685772") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "libaoecore.so_1706988685773") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "libaoecore.so_1706988685773") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "libaoecore.so_1706988685774") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "libaoecore.so_1706988685774") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "liblpcore.so_1706988685774") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "liblpcore.so_1706988685774") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "liblpcore.so_1706988685773") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "liblpcore.so_1706988685773") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "liblpcore.so") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "liblpcore.so")26:T33a2,"SELECT log_source, reason, events_dropped_count FROM log_event_dropped" (Source: t8.p.smali, Indicator: "select log_source, reason, events_dropped_count from log_event_dropped") "SELECT COUNT(*), transport_name FROM events WHERE timestamp_ms < ? GROUP BY transport_name" (Source: t8.p.smali, Indicator: "select count(*) transport_name from events where timestamp_ms < ? group by transport_name"), "SELECT next_request_ms FROM transport_contexts WHERE backend_name = ? and priority = ?" (Source: t8.p.smali, Indicator: "select next_request_ms from transport_contexts where backend_name = ? and priority = ?"), "DELETE FROM events WHERE _id in" (Source: t8.p.smali, Indicator: "delete from events where _id in"), "UPDATE events SET num_attempts = num_attempts + 1 WHERE _id in" (Source: t8.p.smali, Indicator: "update events set num_attempts = num_attempts + 1 where _id in"), "SELECT COUNT(*) transport_name FROM events WHERE num_attempts >= 16 GROUP BY transport_name" (Source: t8.p.smali, Indicator: "select count(*) transport_name from events where num_attempts >= 16 group by transport_name"), "SELECT 1 FROM events WHERE context_id = ? LIMIT 1" (Source: t8.p.smali, Indicator: "select 1 from events where context_id = ? limit 1"), "SELECT distinct t._id t.backend_name t.priority t.extras FROM transport_contexts AS t events AS e WHERE e.context_id = t._id" (Source: t8.p.smali, Indicator: "select distinct t._id t.backend_name t.priority t.extras from transport_contexts as t events as e where e.context_id = t._id"), "INSERT INTO global_log_event_state VALUES (" (Source: t8.v.smali, Indicator: "insert into global_log_event_state values (") "DELETE FROM WorkProgress" (Source: q4.o$c.smali, Indicator: "delete from workprogress") "SELECT work_spec_id FROM dependency WHERE prerequisite_id=?" (Source: q4.c.smali, Indicator: "select work_spec_id from dependency where prerequisite_id=?") "SELECT COUNT(*)=0 FROM dependency WHERE work_spec_id=? AND prerequisite_id IN (SELECT id FROM workspec WHERE state!=2)" (Source: q4.c.smali, Indicator: "select count(*)=0 from dependency where work_spec_id=? and prerequisite_id in (select id from workspec where state!=2)"), "INSERT OR IGNORE INTO `WorkTag` (`tag`,`work_spec_id`) VALUES (?,?)" (Source: q4.u$a.smali, Indicator: "insert or ignore into `worktag` (`tag`,`work_spec_id`) values (?,?)"), "DELETE FROM workspec WHERE id=?" (Source: q4.r$b.smali, Indicator: "delete from workspec where id=?"), "SELECT DISTINCT tag FROM worktag WHERE work_spec_id=?" (Source: q4.u.smali, Indicator: "select distinct tag from worktag where work_spec_id=?"), "SELECT `SystemIdInfo`.`work_spec_id` AS `work_spec_id` `SystemIdInfo`.`system_id` AS `system_id` FROM SystemIdInfo WHERE work_spec_id=?" (Source: q4.i.smali, Indicator: "select `systemidinfo`.`work_spec_id` as `work_spec_id` `systemidinfo`.`system_id` as `system_id` from systemidinfo where work_spec_id=?"), "UPDATE workspec SET output=? WHERE id=?" (Source: q4.r$c.smali, Indicator: "update workspec set output=? where id=?"), "DELETE FROM SystemIdInfo where work_spec_id=?" (Source: q4.i$b.smali, Indicator: "delete from systemidinfo where work_spec_id=?"), "INSERT OR REPLACE INTO `Preference` (`key`,`long_value`) VALUES (?,?)" (Source: q4.f$a.smali, Indicator: "insert or replace into `preference` (`key`,`long_value`) values (?,?)"), "SELECT `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `WorkSpec`.`id` AS `id` `WorkSpec`.`state` AS `state` `WorkSpec`.`worker_class_name` AS `worker_class_name` `WorkSpec`.`input_merger_class_name` AS `input_merger_class_name` `WorkSpec`.`input` AS `input` `WorkSpec`.`output` AS `output` `WorkSpec`.`initial_delay` AS `initial_delay` `WorkSpec`.`interval_duration` AS `interval_duration` `WorkSpec`.`flex_duration` AS `flex_duration` `WorkSpec`.`run_attempt_count` AS `run_attempt_count` `WorkSpec`.`backoff_policy` AS `backoff_policy` `WorkSpec`.`backoff_delay_duration` AS `backoff_delay_duration` `WorkSpec`.`period_start_time` AS `period_start_time` `WorkSpec`.`minimum_retention_duration` AS `minimum_retention_duration` `WorkSpec`.`schedule_requested_at` AS `schedule_requested_at` `WorkSpec`.`run_in_foreground` AS `run_in_foreground` `WorkSpec`.`out_of_quota_policy` AS `out_of_quota_policy` FROM workspec WHERE state=0 ORDER BY period_start_time LIMIT ?" (Source: q4.r.smali, Indicator: "select `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `workspec`.`id` as `id` `workspec`.`state` as `state` `workspec`.`worker_class_name` as `worker_class_name` `workspec`.`input_merger_class_name` as `input_merger_class_name` `workspec`.`input` as `input` `workspec`.`output` as `output` `workspec`.`initial_delay` as `initial_delay` `workspec`.`interval_duration` as `interval_duration` `workspec`.`flex_duration` as `flex_duration` `workspec`.`run_attempt_count` as `run_attempt_count` `workspec`.`backoff_policy` as `backoff_policy` `workspec`.`backoff_delay_duration` as `backoff_delay_duration` `workspec`.`period_start_time` as `period_start_time` `workspec`.`minimum_retention_duration` as `minimum_retention_duration` `workspec`.`schedule_requested_at` as `schedule_requested_at` `workspec`.`run_in_foreground` as `run_in_foreground` `workspec`.`out_of_quota_policy` as `out_of_quota_policy` from workspec where state=0 order by period_start_time limit ?"), "SELECT `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `WorkSpec`.`id` AS `id` `WorkSpec`.`state` AS `state` `WorkSpec`.`worker_class_name` AS `worker_class_name` `WorkSpec`.`input_merger_class_name` AS `input_merger_class_name` `WorkSpec`.`input` AS `input` `WorkSpec`.`output` AS `output` `WorkSpec`.`initial_delay` AS `initial_delay` `WorkSpec`.`interval_duration` AS `interval_duration` `WorkSpec`.`flex_duration` AS `flex_duration` `WorkSpec`.`run_attempt_count` AS `run_attempt_count` `WorkSpec`.`backoff_policy` AS `backoff_policy` `WorkSpec`.`backoff_delay_duration` AS `backoff_delay_duration` `WorkSpec`.`period_start_time` AS `period_start_time` `WorkSpec`.`minimum_retention_duration` AS `minimum_retention_duration` `WorkSpec`.`schedule_requested_at` AS `schedule_requested_at` `WorkSpec`.`run_in_foreground` AS `run_in_foreground` `WorkSpec`.`out_of_quota_policy` AS `out_of_quota_policy` FROM workspec WHERE state=0 AND schedule_requested_at=-1 ORDER BY period_start_time LIMIT (SELECT MAX(?-COUNT(*) 0) FROM workspec WHERE schedule_requested_at<>-1 AND state NOT IN (2, 3, 5))" (Source: q4.r.smali, Indicator: "select `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `workspec`.`id` as `id` `workspec`.`state` as `state` `workspec`.`worker_class_name` as `worker_class_name` `workspec`.`input_merger_class_name` as `input_merger_class_name` `workspec`.`input` as `input` `workspec`.`output` as `output` `workspec`.`initial_delay` as `initial_delay` `workspec`.`interval_duration` as `interval_duration` `workspec`.`flex_duration` as `flex_duration` `workspec`.`run_attempt_count` as `run_attempt_count` `workspec`.`backoff_policy` as `backoff_policy` `workspec`.`backoff_delay_duration` as `backoff_delay_duration` `workspec`.`period_start_time` as `period_start_time` `workspec`.`minimum_retention_duration` as `minimum_retention_duration` `workspec`.`schedule_requested_at` as `schedule_requested_at` `workspec`.`run_in_foreground` as `run_in_foreground` `workspec`.`out_of_quota_policy` as `out_of_quota_policy` from workspec where state=0 and schedule_requested_at=-1 order by period_start_time limit (select max(?-count(*) 0) from workspec where schedule_requested_at<>-1 and state not in (2, 3, 5))"), "SELECT `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `WorkSpec`.`id` AS `id` `WorkSpec`.`state` AS `state` `WorkSpec`.`worker_class_name` AS `worker_class_name` `WorkSpec`.`input_merger_class_name` AS `input_merger_class_name` `WorkSpec`.`input` AS `input` `WorkSpec`.`output` AS `output` `WorkSpec`.`initial_delay` AS `initial_delay` `WorkSpec`.`interval_duration` AS `interval_duration` `WorkSpec`.`flex_duration` AS `flex_duration` `WorkSpec`.`run_attempt_count` AS `run_attempt_count` `WorkSpec`.`backoff_policy` AS `backoff_policy` `WorkSpec`.`backoff_delay_duration` AS `backoff_delay_duration` `WorkSpec`.`period_start_time` AS `period_start_time` `WorkSpec`.`minimum_retention_duration` AS `minimum_retention_duration` `WorkSpec`.`schedule_requested_at` AS `schedule_requested_at` `WorkSpec`.`run_in_foreground` AS `run_in_foreground` `WorkSpec`.`out_of_quota_policy` AS `out_of_quota_policy` FROM workspec WHERE state=1" (Source: q4.r.smali, Indicator: "select `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `workspec`.`id` as `id` `workspec`.`state` as `state` `workspec`.`worker_class_name` as `worker_class_name` `workspec`.`input_merger_class_name` as `input_merger_class_name` `workspec`.`input` as `input` `workspec`.`output` as `output` `workspec`.`initial_delay` as `initial_delay` `workspec`.`interval_duration` as `interval_duration` `workspec`.`flex_duration` as `flex_duration` `workspec`.`run_attempt_count` as `run_attempt_count` `workspec`.`backoff_policy` as `backoff_policy` `workspec`.`backoff_delay_duration` as `backoff_delay_duration` `workspec`.`period_start_time` as `period_start_time` `workspec`.`minimum_retention_duration` as `minimum_retention_duration` `workspec`.`schedule_requested_at` as `schedule_requested_at` `workspec`.`run_in_foreground` as `run_in_foreground` `workspec`.`out_of_quota_policy` as `out_of_quota_policy` from workspec where state=1"), "SELECT `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `WorkSpec`.`id` AS `id` `WorkSpec`.`state` AS `state` `WorkSpec`.`worker_class_name` AS `worker_class_name` `WorkSpec`.`input_merger_class_name` AS `input_merger_class_name` `WorkSpec`.`input` AS `input` `WorkSpec`.`output` AS `output` `WorkSpec`.`initial_delay` AS `initial_delay` `WorkSpec`.`interval_duration` AS `interval_duration` `WorkSpec`.`flex_duration` AS `flex_duration` `WorkSpec`.`run_attempt_count` AS `run_attempt_count` `WorkSpec`.`backoff_policy` AS `backoff_policy` `WorkSpec`.`backoff_delay_duration` AS `backoff_delay_duration` `WorkSpec`.`period_start_time` AS `period_start_time` `WorkSpec`.`minimum_retention_duration` AS `minimum_retention_duration` `WorkSpec`.`schedule_requested_at` AS `schedule_requested_at` `WorkSpec`.`run_in_foreground` AS `run_in_foreground` `WorkSpec`.`out_of_quota_policy` AS `out_of_quota_policy` FROM workspec WHERE state=0 AND schedule_requested_at<>-1" (Source: q4.r.smali, Indicator: "select `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `workspec`.`id` as `id` `workspec`.`state` as `state` `workspec`.`worker_class_name` as `worker_class_name` `workspec`.`input_merger_class_name` as `input_merger_class_name` `workspec`.`input` as `input` `workspec`.`output` as `output` `workspec`.`initial_delay` as `initial_delay` `workspec`.`interval_duration` as `interval_duration` `workspec`.`flex_duration` as `flex_duration` `workspec`.`run_attempt_count` as `run_attempt_count` `workspec`.`backoff_policy` as `backoff_policy` `workspec`.`backoff_delay_duration` as `backoff_delay_duration` `workspec`.`period_start_time` as `period_start_time` `workspec`.`minimum_retention_duration` as `minimum_retention_duration` `workspec`.`schedule_requested_at` as `schedule_requested_at` `workspec`.`run_in_foreground` as `run_in_foreground` `workspec`.`out_of_quota_policy` as `out_of_quota_policy` from workspec where state=0 and schedule_requested_at<>-1"), "SELECT state FROM workspec WHERE id=?" (Source: q4.r.smali, Indicator: "select state from workspec where id=?"), "SELECT id FROM workspec WHERE state NOT IN (2, 3, 5) AND id IN (SELECT work_spec_id FROM workname WHERE name=?)" (Source: q4.r.smali, Indicator: "select id from workspec where state not in (2, 3, 5) and id in (select work_spec_id from workname where name=?)")27:T5b0,Found string "(?:youtube(?:-nocookie)?\\.com\\/(?:[^\\/\\n\\s]+\\/\\S+\\/|(?:v|e(?:mbed)?)\\/|\\S*?[?&]v=)|youtu\\.be\\/)([a-zA-Z0-9_-]{11})" (Indicator: "youtube"; File: "q.smali") Found string "vnd.youtube:" (Indicator: "youtube"; File: "p.smali") Found string "https://www.youtube.com/watch?v=" (Indicator: "youtube"; File: "p.smali") Found string "exepreview_youtube_click" (Indicator: "youtube"; File: "p$a.smali") Found string "Starting with v13 of the SDK, a client token must be embedded in your client code before making Graph API calls. Visit https://developers.facebook.com/docs/android/getting-started#client-token to learn how to implement this change." (Indicator: "facebook.com"; File: "x.smali") Found string "facebook.com" (Indicator: "facebook.com"; File: "i.smali") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "i.smali") Found string "A valid Facebook client token must be set in the AndroidManifest.xml or set by calling FacebookSdk.setClientToken before initializing the sdk. Visit https://developers.facebook.com/docs/android/getting-started#add-app_id for more information." (Indicator: "facebook.com"; File: "t.smali") file/memory contains long string with (Indicator: "facebook.com"; File: "t.smali") file/memory contains long string with (Indicator: "facebook.com"; File: "o0.smali") Found string "Name: res/drawable-xhdpi-v4/explore_tips_ic_youtube.png" (Indicator: "youtube"; File: "MANIFEST.MF")28:T33a2,"SELECT log_source, reason, events_dropped_count FROM log_event_dropped" (Source: t8.p.smali, Indicator: "select log_source, reason, events_dropped_count from log_event_dropped") "SELECT COUNT(*), transport_name FROM events WHERE timestamp_ms < ? GROUP BY transport_name" (Source: t8.p.smali, Indicator: "select count(*) transport_name from events where timestamp_ms < ? group by transport_name"), "SELECT next_request_ms FROM transport_contexts WHERE backend_name = ? and priority = ?" (Source: t8.p.smali, Indicator: "select next_request_ms from transport_contexts where backend_name = ? and priority = ?"), "DELETE FROM events WHERE _id in" (Source: t8.p.smali, Indicator: "delete from events where _id in"), "UPDATE events SET num_attempts = num_attempts + 1 WHERE _id in" (Source: t8.p.smali, Indicator: "update events set num_attempts = num_attempts + 1 where _id in"), "SELECT COUNT(*) transport_name FROM events WHERE num_attempts >= 16 GROUP BY transport_name" (Source: t8.p.smali, Indicator: "select count(*) transport_name from events where num_attempts >= 16 group by transport_name"), "SELECT 1 FROM events WHERE context_id = ? LIMIT 1" (Source: t8.p.smali, Indicator: "select 1 from events where context_id = ? limit 1"), "SELECT distinct t._id t.backend_name t.priority t.extras FROM transport_contexts AS t events AS e WHERE e.context_id = t._id" (Source: t8.p.smali, Indicator: "select distinct t._id t.backend_name t.priority t.extras from transport_contexts as t events as e where e.context_id = t._id"), "INSERT INTO global_log_event_state VALUES (" (Source: t8.v.smali, Indicator: "insert into global_log_event_state values (") "DELETE FROM WorkProgress" (Source: q4.o$c.smali, Indicator: "delete from workprogress") "SELECT work_spec_id FROM dependency WHERE prerequisite_id=?" (Source: q4.c.smali, Indicator: "select work_spec_id from dependency where prerequisite_id=?") "SELECT COUNT(*)=0 FROM dependency WHERE work_spec_id=? AND prerequisite_id IN (SELECT id FROM workspec WHERE state!=2)" (Source: q4.c.smali, Indicator: "select count(*)=0 from dependency where work_spec_id=? and prerequisite_id in (select id from workspec where state!=2)"), "INSERT OR IGNORE INTO `WorkTag` (`tag`,`work_spec_id`) VALUES (?,?)" (Source: q4.u$a.smali, Indicator: "insert or ignore into `worktag` (`tag`,`work_spec_id`) values (?,?)"), "DELETE FROM workspec WHERE id=?" (Source: q4.r$b.smali, Indicator: "delete from workspec where id=?"), "SELECT DISTINCT tag FROM worktag WHERE work_spec_id=?" (Source: q4.u.smali, Indicator: "select distinct tag from worktag where work_spec_id=?"), "SELECT `SystemIdInfo`.`work_spec_id` AS `work_spec_id` `SystemIdInfo`.`system_id` AS `system_id` FROM SystemIdInfo WHERE work_spec_id=?" (Source: q4.i.smali, Indicator: "select `systemidinfo`.`work_spec_id` as `work_spec_id` `systemidinfo`.`system_id` as `system_id` from systemidinfo where work_spec_id=?"), "UPDATE workspec SET output=? WHERE id=?" (Source: q4.r$c.smali, Indicator: "update workspec set output=? where id=?"), "DELETE FROM SystemIdInfo where work_spec_id=?" (Source: q4.i$b.smali, Indicator: "delete from systemidinfo where work_spec_id=?"), "INSERT OR REPLACE INTO `Preference` (`key`,`long_value`) VALUES (?,?)" (Source: q4.f$a.smali, Indicator: "insert or replace into `preference` (`key`,`long_value`) values (?,?)"), "SELECT `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `WorkSpec`.`id` AS `id` `WorkSpec`.`state` AS `state` `WorkSpec`.`worker_class_name` AS `worker_class_name` `WorkSpec`.`input_merger_class_name` AS `input_merger_class_name` `WorkSpec`.`input` AS `input` `WorkSpec`.`output` AS `output` `WorkSpec`.`initial_delay` AS `initial_delay` `WorkSpec`.`interval_duration` AS `interval_duration` `WorkSpec`.`flex_duration` AS `flex_duration` `WorkSpec`.`run_attempt_count` AS `run_attempt_count` `WorkSpec`.`backoff_policy` AS `backoff_policy` `WorkSpec`.`backoff_delay_duration` AS `backoff_delay_duration` `WorkSpec`.`period_start_time` AS `period_start_time` `WorkSpec`.`minimum_retention_duration` AS `minimum_retention_duration` `WorkSpec`.`schedule_requested_at` AS `schedule_requested_at` `WorkSpec`.`run_in_foreground` AS `run_in_foreground` `WorkSpec`.`out_of_quota_policy` AS `out_of_quota_policy` FROM workspec WHERE state=0 ORDER BY period_start_time LIMIT ?" (Source: q4.r.smali, Indicator: "select `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `workspec`.`id` as `id` `workspec`.`state` as `state` `workspec`.`worker_class_name` as `worker_class_name` `workspec`.`input_merger_class_name` as `input_merger_class_name` `workspec`.`input` as `input` `workspec`.`output` as `output` `workspec`.`initial_delay` as `initial_delay` `workspec`.`interval_duration` as `interval_duration` `workspec`.`flex_duration` as `flex_duration` `workspec`.`run_attempt_count` as `run_attempt_count` `workspec`.`backoff_policy` as `backoff_policy` `workspec`.`backoff_delay_duration` as `backoff_delay_duration` `workspec`.`period_start_time` as `period_start_time` `workspec`.`minimum_retention_duration` as `minimum_retention_duration` `workspec`.`schedule_requested_at` as `schedule_requested_at` `workspec`.`run_in_foreground` as `run_in_foreground` `workspec`.`out_of_quota_policy` as `out_of_quota_policy` from workspec where state=0 order by period_start_time limit ?"), "SELECT `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `WorkSpec`.`id` AS `id` `WorkSpec`.`state` AS `state` `WorkSpec`.`worker_class_name` AS `worker_class_name` `WorkSpec`.`input_merger_class_name` AS `input_merger_class_name` `WorkSpec`.`input` AS `input` `WorkSpec`.`output` AS `output` `WorkSpec`.`initial_delay` AS `initial_delay` `WorkSpec`.`interval_duration` AS `interval_duration` `WorkSpec`.`flex_duration` AS `flex_duration` `WorkSpec`.`run_attempt_count` AS `run_attempt_count` `WorkSpec`.`backoff_policy` AS `backoff_policy` `WorkSpec`.`backoff_delay_duration` AS `backoff_delay_duration` `WorkSpec`.`period_start_time` AS `period_start_time` `WorkSpec`.`minimum_retention_duration` AS `minimum_retention_duration` `WorkSpec`.`schedule_requested_at` AS `schedule_requested_at` `WorkSpec`.`run_in_foreground` AS `run_in_foreground` `WorkSpec`.`out_of_quota_policy` AS `out_of_quota_policy` FROM workspec WHERE state=0 AND schedule_requested_at=-1 ORDER BY period_start_time LIMIT (SELECT MAX(?-COUNT(*) 0) FROM workspec WHERE schedule_requested_at<>-1 AND state NOT IN (2, 3, 5))" (Source: q4.r.smali, Indicator: "select `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `workspec`.`id` as `id` `workspec`.`state` as `state` `workspec`.`worker_class_name` as `worker_class_name` `workspec`.`input_merger_class_name` as `input_merger_class_name` `workspec`.`input` as `input` `workspec`.`output` as `output` `workspec`.`initial_delay` as `initial_delay` `workspec`.`interval_duration` as `interval_duration` `workspec`.`flex_duration` as `flex_duration` `workspec`.`run_attempt_count` as `run_attempt_count` `workspec`.`backoff_policy` as `backoff_policy` `workspec`.`backoff_delay_duration` as `backoff_delay_duration` `workspec`.`period_start_time` as `period_start_time` `workspec`.`minimum_retention_duration` as `minimum_retention_duration` `workspec`.`schedule_requested_at` as `schedule_requested_at` `workspec`.`run_in_foreground` as `run_in_foreground` `workspec`.`out_of_quota_policy` as `out_of_quota_policy` from workspec where state=0 and schedule_requested_at=-1 order by period_start_time limit (select max(?-count(*) 0) from workspec where schedule_requested_at<>-1 and state not in (2, 3, 5))"), "SELECT `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `WorkSpec`.`id` AS `id` `WorkSpec`.`state` AS `state` `WorkSpec`.`worker_class_name` AS `worker_class_name` `WorkSpec`.`input_merger_class_name` AS `input_merger_class_name` `WorkSpec`.`input` AS `input` `WorkSpec`.`output` AS `output` `WorkSpec`.`initial_delay` AS `initial_delay` `WorkSpec`.`interval_duration` AS `interval_duration` `WorkSpec`.`flex_duration` AS `flex_duration` `WorkSpec`.`run_attempt_count` AS `run_attempt_count` `WorkSpec`.`backoff_policy` AS `backoff_policy` `WorkSpec`.`backoff_delay_duration` AS `backoff_delay_duration` `WorkSpec`.`period_start_time` AS `period_start_time` `WorkSpec`.`minimum_retention_duration` AS `minimum_retention_duration` `WorkSpec`.`schedule_requested_at` AS `schedule_requested_at` `WorkSpec`.`run_in_foreground` AS `run_in_foreground` `WorkSpec`.`out_of_quota_policy` AS `out_of_quota_policy` FROM workspec WHERE state=1" (Source: q4.r.smali, Indicator: "select `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `workspec`.`id` as `id` `workspec`.`state` as `state` `workspec`.`worker_class_name` as `worker_class_name` `workspec`.`input_merger_class_name` as `input_merger_class_name` `workspec`.`input` as `input` `workspec`.`output` as `output` `workspec`.`initial_delay` as `initial_delay` `workspec`.`interval_duration` as `interval_duration` `workspec`.`flex_duration` as `flex_duration` `workspec`.`run_attempt_count` as `run_attempt_count` `workspec`.`backoff_policy` as `backoff_policy` `workspec`.`backoff_delay_duration` as `backoff_delay_duration` `workspec`.`period_start_time` as `period_start_time` `workspec`.`minimum_retention_duration` as `minimum_retention_duration` `workspec`.`schedule_requested_at` as `schedule_requested_at` `workspec`.`run_in_foreground` as `run_in_foreground` `workspec`.`out_of_quota_policy` as `out_of_quota_policy` from workspec where state=1"), "SELECT `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `WorkSpec`.`id` AS `id` `WorkSpec`.`state` AS `state` `WorkSpec`.`worker_class_name` AS `worker_class_name` `WorkSpec`.`input_merger_class_name` AS `input_merger_class_name` `WorkSpec`.`input` AS `input` `WorkSpec`.`output` AS `output` `WorkSpec`.`initial_delay` AS `initial_delay` `WorkSpec`.`interval_duration` AS `interval_duration` `WorkSpec`.`flex_duration` AS `flex_duration` `WorkSpec`.`run_attempt_count` AS `run_attempt_count` `WorkSpec`.`backoff_policy` AS `backoff_policy` `WorkSpec`.`backoff_delay_duration` AS `backoff_delay_duration` `WorkSpec`.`period_start_time` AS `period_start_time` `WorkSpec`.`minimum_retention_duration` AS `minimum_retention_duration` `WorkSpec`.`schedule_requested_at` AS `schedule_requested_at` `WorkSpec`.`run_in_foreground` AS `run_in_foreground` `WorkSpec`.`out_of_quota_policy` AS `out_of_quota_policy` FROM workspec WHERE state=0 AND schedule_requested_at<>-1" (Source: q4.r.smali, Indicator: "select `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` `workspec`.`id` as `id` `workspec`.`state` as `state` `workspec`.`worker_class_name` as `worker_class_name` `workspec`.`input_merger_class_name` as `input_merger_class_name` `workspec`.`input` as `input` `workspec`.`output` as `output` `workspec`.`initial_delay` as `initial_delay` `workspec`.`interval_duration` as `interval_duration` `workspec`.`flex_duration` as `flex_duration` `workspec`.`run_attempt_count` as `run_attempt_count` `workspec`.`backoff_policy` as `backoff_policy` `workspec`.`backoff_delay_duration` as `backoff_delay_duration` `workspec`.`period_start_time` as `period_start_time` `workspec`.`minimum_retention_duration` as `minimum_retention_duration` `workspec`.`schedule_requested_at` as `schedule_requested_at` `workspec`.`run_in_foreground` as `run_in_foreground` `workspec`.`out_of_quota_policy` as `out_of_quota_policy` from workspec where state=0 and schedule_requested_at<>-1"), "SELECT state FROM workspec WHERE id=?" (Source: q4.r.smali, Indicator: "select state from workspec where id=?"), "SELECT id FROM workspec WHERE state NOT IN (2, 3, 5) AND id IN (SELECT work_spec_id FROM workname WHERE name=?)" (Source: q4.r.smali, Indicator: "select id from workspec where state not in (2, 3, 5) and id in (select work_spec_id from workname where name=?)")29:T2bc9,"DebugProbesKt.bin" has type "compiled Java class data version 52.0 (Java 1.8)"- [targetUID: N/A] "CERT.SF" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "MANIFEST.MF" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "libaoecore.so" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked BuildID[sha1]=a0420aee422246e3899ee4d428b4045b3ed702cc stripped"- [targetUID: N/A] "libaoecore.so_1706988685772" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked BuildID[sha1]=a430ccf07810d3c702a22a3a54aaea820137ed69 stripped"- [targetUID: N/A] "libaoecore.so_1706988685773" has type "ELF 32-bit LSB shared object Intel 80386 version 1 (SYSV) dynamically linked BuildID[sha1]=b7f7509e8362e65f05419caf7c85b6591c0e6b24 stripped"- [targetUID: N/A] "AndroidManifest.xml" has type "Android binary XML"- [targetUID: N/A] "libaoecore.so_1706988685774" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked BuildID[sha1]=08dad4710701a71168a7876a26a22b14bf45ead3 stripped"- [targetUID: N/A] "liblpcore.so_1706988685774" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked BuildID[sha1]=c5f58421d6d280323a739a85403909dce6655414 stripped"- [targetUID: N/A] "liblpcore.so_1706988685773" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked BuildID[sha1]=15f0c96c97fd1004028b0a0e4cbf2ac242c3e803 stripped"- [targetUID: N/A] "liblpcore.so" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked BuildID[sha1]=8a226a88974689213b7e8e27e8bcacc75effb65a stripped"- [targetUID: N/A] "field_mask.proto" has type "ASCII text"- [targetUID: N/A] "api.proto" has type "Java source ASCII text"- [targetUID: N/A] "timestamp.proto" has type "ASCII text"- [targetUID: N/A] "type.proto" has type "Java source ASCII text"- [targetUID: N/A] "any.proto" has type "ASCII text"- [targetUID: N/A] "duration.proto" has type "ASCII text"- [targetUID: N/A] "wrappers.proto" has type "ASCII text"- [targetUID: N/A] "struct.proto" has type "ASCII text"- [targetUID: N/A] "client_analytics.proto" has type "ASCII text"- [targetUID: N/A] "empty.proto" has type "ASCII text"- [targetUID: N/A] "source_context.proto" has type "ASCII text"- [targetUID: N/A] "CERT.RSA" has type "data"- [targetUID: N/A] "kotlin-tooling-metadata.json" has type "JSON data"- [targetUID: N/A] "play-services-measurement-sdk-api.properties" has type "ASCII text"- [targetUID: N/A] "firebase-measurement-connector.properties" has type "ASCII text"- [targetUID: N/A] "play-services-measurement-base.properties" has type "ASCII text"- [targetUID: N/A] "firebase-installations-interop.properties" has type "ASCII text"- [targetUID: N/A] "play-services-measurement-impl.properties" has type "ASCII text"- [targetUID: N/A] "play-services-measurement-api.properties" has type "ASCII text"- [targetUID: N/A] "play-services-measurement-sdk.properties" has type "ASCII text"- [targetUID: N/A] "play-services-auth-api-phone.properties" has type "ASCII text"- [targetUID: N/A] "play-services-ads-identifier.properties" has type "ASCII text"- [targetUID: N/A] "play-services-measurement.properties" has type "ASCII text"- [targetUID: N/A] "firebase-encoders-proto.properties" has type "ASCII text"- [targetUID: N/A] "play-services-auth-base.properties" has type "ASCII text"- [targetUID: N/A] "play-services-basement.properties" has type "ASCII text"- [targetUID: N/A] "user-messaging-platform.properties" has type "ASCII text"- [targetUID: N/A] "play-services-ads-lite.properties" has type "ASCII text"- [targetUID: N/A] "play-services-ads-base.properties" has type "ASCII text"- [targetUID: N/A] "play-services-fitness.properties" has type "ASCII text"- [targetUID: N/A] "firebase-auth-interop.properties" has type "ASCII text"- [targetUID: N/A] "play-services-appset.properties" has type "ASCII text"- [targetUID: N/A] "firebase-annotations.properties" has type "ASCII text"- [targetUID: N/A] "play-services-stats.properties" has type "ASCII text"- [targetUID: N/A] "firebase-components.properties" has type "ASCII text"- [targetUID: N/A] "play-services-tasks.properties" has type "ASCII text"- [targetUID: N/A] "play-services-auth.properties" has type "ASCII text"- [targetUID: N/A] "play-services-base.properties" has type "ASCII text"- [targetUID: N/A] "firebase-analytics.properties" has type "ASCII text"- [targetUID: N/A] "play-services-ads.properties" has type "ASCII text"- [targetUID: N/A] "firebase-encoders.properties" has type "ASCII text"- [targetUID: N/A] "firebase-auth.properties" has type "ASCII text"- [targetUID: N/A] "transport-api.properties" has type "ASCII text"- [targetUID: N/A] "recaptcha.properties" has type "ASCII text"- [targetUID: N/A] "integrity.properties" has type "ASCII text"- [targetUID: N/A] "androidsupportmultidexversion.txt" has type "ASCII text"- [targetUID: N/A] "billing.properties" has type "ASCII text"- [targetUID: N/A] "stamp-cert-sha256" has type "data"- [targetUID: N/A] "androidx.core_core.version" has type "ASCII text"- [targetUID: N/A] "iq.g" has type "ASCII text"- [targetUID: N/A] "androidx.health.connect_connect-client.version" has type "ASCII text"- [targetUID: N/A] "androidx.privacysandbox.ads_ads-adservices-java.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-livedata-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.loader_loader.version" has type "ASCII text"- [targetUID: N/A] "androidx.versionedparcelable_versionedparcelable.version" has type "ASCII text"- [targetUID: N/A] "androidx.fragment_fragment-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.savedstate_savedstate-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.sqlite_sqlite-framework.version" has type "ASCII text"- [targetUID: N/A] "androidx.activity_activity-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.browser_browser.version" has type "ASCII text"- [targetUID: N/A] "androidx.fragment_fragment.version" has type "ASCII text"- [targetUID: N/A] "androidx.room_room-runtime.version" has type "ASCII text"- [targetUID: N/A] "androidx.activity_activity.version" has type "ASCII text"- [targetUID: N/A] "androidx.work_work-runtime.version" has type "ASCII text"- [targetUID: N/A] "or.m" has type "ASCII text"- [targetUID: N/A] "kotlinx_coroutines_core.version" has type "ASCII text with no line terminators"- [targetUID: N/A] "ir.a0" has type "ASCII text"- [targetUID: N/A] "ep.a" has type "ASCII text"- [targetUID: N/A] "androidx.databinding_viewbinding.version" has type "ASCII text with no line terminators"- [targetUID: N/A] "androidx.core_core-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.privacysandbox.ads_ads-adservices.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-process.version" has type "ASCII text"- [targetUID: N/A] "androidx.legacy_legacy-support-core-ui.version" has type "ASCII text"- [targetUID: N/A] "androidx.print_print.version" has type "ASCII text"- [targetUID: N/A] "androidx.annotation_annotation-experimental.version" has type "ASCII text"- [targetUID: N/A] "androidx.interpolator_interpolator.version" has type "ASCII text"- [targetUID: N/A] "androidx.recyclerview_recyclerview.version" has type "ASCII text"- [targetUID: N/A] "androidx.viewpager2_viewpager2.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-viewmodel-savedstate.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-runtime-ktx.version" has type "ASCII text"- [targetUID: N/A] "com.google.android.material_material.version" has type "ASCII text"- [targetUID: N/A] "androidx.documentfile_documentfile.version" has type "ASCII text"- [targetUID: N/A] "androidx.appcompat_appcompat-resources.version" has type "ASCII text"- [targetUID: N/A] "androidx.transition_transition.version" has type "ASCII text"- [targetUID: N/A] "androidx.legacy_legacy-support-core-utils.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-livedata-core.version" has type "ASCII text"- [targetUID: N/A] "androidx.savedstate_savedstate.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-viewmodel.version" has type "ASCII text"- [targetUID: N/A] "androidx.cardview_cardview.version" has type "ASCII text"- [targetUID: N/A] "androidx.vectordrawable_vectordrawable.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-livedata-core-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.customview_customview.version" has type "ASCII text"- [targetUID: N/A] "androidx.coordinatorlayout_coordinatorlayout.version" has type "ASCII text"- [targetUID: N/A] "androidx.swiperefreshlayout_swiperefreshlayout.version" has type "ASCII text"- [targetUID: N/A] "androidx.dynamicanimation_dynamicanimation.version" has type "ASCII text"- [targetUID: N/A] "androidx.datastore_datastore-preferences.version" has type "ASCII text"- [targetUID: N/A] "androidx.datastore_datastore.version" has type "ASCII text"- [targetUID: N/A] "androidx.tracing_tracing.version" has type "ASCII text"- [targetUID: N/A] "androidx.appcompat_appcompat.version" has type "ASCII text"- [targetUID: N/A] "androidx.drawerlayout_drawerlayout.version" has type "ASCII text"- [targetUID: N/A] "androidx.asynclayoutinflater_asynclayoutinflater.version" has type "ASCII text"- [targetUID: N/A] "androidx.slidingpanelayout_slidingpanelayout.version" has type "ASCII text"- [targetUID: N/A] "androidx.localbroadcastmanager_localbroadcastmanager.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-viewmodel-ktx.version" has type "ASCII text"- [targetUID: N/A] "androidx.startup_startup-runtime.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-runtime.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-livedata.version" has type "ASCII text"- [targetUID: N/A] "androidx.media_media.version" has type "ASCII text"- [targetUID: N/A] "androidx.sqlite_sqlite.version" has type "ASCII text"- [targetUID: N/A] "androidx.vectordrawable_vectordrawable-animated.version" has type "ASCII text"- [targetUID: N/A] "androidx.arch.core_core-runtime.version" has type "ASCII text"- [targetUID: N/A] "androidx.legacy_legacy-support-v4.version" has type "ASCII text"- [targetUID: N/A] "androidx.cursoradapter_cursoradapter.version" has type "ASCII text"- [targetUID: N/A] "androidx.exifinterface_exifinterface.version" has type "ASCII text"- [targetUID: N/A] "androidx.lifecycle_lifecycle-service.version" has type "ASCII text"- [targetUID: N/A] "androidx.viewpager_viewpager.version" has type "ASCII text"- [targetUID: N/A] "kotlinx_coroutines_play_services.version" has type "ASCII text with no line terminators"- [targetUID: N/A] "kotlinx_coroutines_android.version" has type "ASCII text with no line terminators"- [targetUID: N/A] "kotlinx_coroutines_guava.version" has type "ASCII text with no line terminators"- [targetUID: N/A]2a:T127d,Heuristic match: "Le.KY" Heuristic match: "sT.pK" Heuristic match: "j[.pr" Heuristic match: "#M{.sK" Heuristic match: "=E.cY" Heuristic match: "Manl5.GF" Heuristic match: "I*^_/.Bz" Heuristic match: "Hg.Do" Heuristic match: "(?.cc" Heuristic match: "QJh.SV" Heuristic match: "{k.CO" Heuristic match: "4R/Ua.QA" Heuristic match: "record.metadata.id" Pattern match: "https://resource.[-A-Za-z0-9]+.[-A-Za-z0-9]+/tts/" Pattern match: "https://ttsverify" Heuristic match: "adConfig.id" Pattern match: "http://www.w3.org/ns/ttml#parameter" Pattern match: "https://exoplayer.dev/issues/cleartext-not-permitted" Heuristic match: "it.snapshot.storage.name" Pattern match: "https://leap.app/privacypolicy.html" Pattern match: "https://config.ads.vungle.com/" Heuristic match: "com.google.android.tv" Pattern match: "https://apidis.period-calendar.com/api/workout/remoteconfig" Heuristic match: "ro.miui.ui.version.name" Pattern match: "https://www.youtube.com/watch?v=" Pattern match: "https://developers.facebook.com/docs/android/getting-started#client-token" Pattern match: "https://graph-video.%s" Pattern match: "https://graph.%s" Heuristic match: "instagram.com" Heuristic match: "facebook.com" Pattern match: "www.facebook.com" Pattern match: "https://developers.facebook.com/docs/android/getting-started#add-app_id" Heuristic match: "fb.gg" Pattern match: "https://developers.facebook.com/docs/android/getting-started" Pattern match: "https://developers.facebook.com/docs/app-events/getting-started-app-events-android#disable-auto-events" Pattern match: "https://exoplayer.dev/issues/player-accessed-on-wrong-thread" Pattern match: "https://play.google.com/store/search?q=text" Heuristic match: "subDescriptor.name" Pattern match: "https://android.googlesource.com/toolchain/clang" Pattern match: "https://android.googlesource.com/toolchain/llvm-project" Pattern match: "https://developers.google.com/protocol-buffers///" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0//" Pattern match: "https://developers.google.com/protocol-buffers/////" Pattern match: "https://developers.google.com/protocol-buffers/" Pattern match: "google.golang.org/protobuf/types/known/structpb" Heuristic match: "Name: META-INF/androidx.localbroadcastmanager_localbroadcastmanager.ve" Heuristic match: "Name: lib/arm64-v8a/libaoecore.so" Heuristic match: "Name: lib/arm64-v8a/liblpcore.so" Heuristic match: "Name: lib/x86/libaoecore.so" Heuristic match: "Name: lib/x86/liblpcore.so" Heuristic match: "Name: lib/x86_64/libaoecore.so" Heuristic match: "Name: lib/x86_64/liblpcore.so" Heuristic match: "Name: res/drawable-hdpi-v4/abc_scrubber_control_to_pressed_mtrl_000.pn" Heuristic match: "Name: res/drawable-hdpi-v4/abc_scrubber_control_to_pressed_mtrl_005.pn" Heuristic match: "Name: res/drawable-mdpi-v4/abc_scrubber_control_to_pressed_mtrl_000.pn" Heuristic match: "Name: res/drawable-mdpi-v4/abc_scrubber_control_to_pressed_mtrl_005.pn" Heuristic match: "Name: res/drawable-xhdpi-v4/abc_list_selector_disabled_holo_light.9.pn" Heuristic match: "Name: res/drawable-xhdpi-v4/com_facebook_tooltip_black_background.9.pn" Heuristic match: "Name: res/drawable-xxhdpi-v4/abc_list_selector_disabled_holo_dark.9.pn" Heuristic match: "Name: res/drawable-xxhdpi-v4/com_facebook_button_like_icon_selected.pn" Pattern match: "google.golang.org/protobuf/types/known/durationpb" Pattern match: "google.golang.org/protobuf/types/known/typepb" Pattern match: "type.googleapis.com/google.protobuf.Timestamp" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0////" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0" Pattern match: "google.golang.org/protobuf/types/known/apipb" Pattern match: "https://cloud.google.com/apis/design/glossary" Pattern match: "http://semver.org" Pattern match: "google.golang.org/protobuf/types/known/anypb" Pattern match: "type.googleapis.com/full.type.name" Pattern match: "foo.bar.com/x/y.z" Pattern match: "type.googleapis.com/google.profile.Person" Pattern match: "type.googleapis.com/google.protobuf.Duration" Pattern match: "google.golang.org/protobuf/types/known/fieldmaskpb" Pattern match: "google.golang.org/protobuf/types/known/wrapperspb" Pattern match: "google.golang.org/protobuf/types/known/timestamppb" Pattern match: "https://developers.google.com/time/smear" Pattern match: "https://www.ietf.org/rfc/rfc3339.txt" Pattern match: "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString" Pattern match: "https://docs.python.org/2/library/time.html#time.strftime" Pattern match: "http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime%2D%2D"2b:Ta19,Found string "METHOD=(NONE|AES-128|SAMPLE-AES|SAMPLE-AES-CENC|SAMPLE-AES-CTR)\\s*(?:,|$)" (Indicator: "aes"; File: "h.smali") Found string "SAMPLE-AES-CENC" (Indicator: "aes"; File: "h.smali") Found string "SAMPLE-AES-CTR" (Indicator: "aes"; File: "h.smali") Found string "The encryption IV attribute must be present when an initialization segment is encrypted with METHOD=AES-128." (Indicator: "aes"; File: "h.smali") Found string "AES-128" (Indicator: "aes"; File: "h.smali") Found string "AESSettingsCipherMode" (Indicator: "aes"; File: "d.smali") Found string ";base64" (Indicator: "base64"; File: "i.smali") Found string "Error while parsing Base64 encoded string:" (Indicator: "base64"; File: "i.smali") Found string "aeSj6peo" (Indicator: "aes"; File: "i.smali") Found string "encodeToString(outputStream.toByteArray(), Base64.NO_WRAP)" (Indicator: "base64"; File: "f$b.smali") Found string "AES/CBC/PKCS7Padding" (Indicator: "aes"; File: "a.smali") Found string "SHA-256-Digest: 7YxoaESTTMLxMZrytJ4pgvR4x8ME2zDr+Ylt0RY7dzA=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: cA2uWKephJcq5aEsU7Mitv7VBskYCMPeT5aN6Yg+ahk=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: AfFE+DCOc9+vs8NTG7zAeSJBfUeqz2y1mtzZNYaeHpE=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: jAM0w7FkqR0TAm0fGN7OUEYrfI6TIXoEkxCjho1IaEs=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: ZN5VN5w9BupkXUTAeS+aVmFuDVAfa7066HoJjbo02pQ=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: AEsXaAyXlRSD9TcEV8rQJZyrz/IlgY7PPMLpNbQBl3w=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: JcKZurL5zLRy4ntD9HZv3CYvUAeSglZooDgCcDdIH9E=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: j4a9SeE+MwNntmrSa2+uPGFwe1Qyrn0M2ytY5JMGX5w=" (Indicator: "rsa2"; File: "MANIFEST.MF") Found string "SHA-256-Digest: TA/4g76qys69OnN4LAV8UOBMmtKKmqzMkAEsD+GlKSA=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: hnyDeYmMa7rHnKsDmiycVAWXCPKEoKjKMDzaEsiJulA=" (Indicator: "aes"; File: "CERT.SF") Found string "SHA-256-Digest: RmL++TuB4jMRAesW2iM8N0Fuh5fuFfiOQAX524TCsX8=" (Indicator: "aes"; File: "CERT.SF") Found string "SHA-256-Digest: 4i9/MPs1WLSrhVOEQP5hJwAEsmhWbUi/A5HzXSGXxgM=" (Indicator: "aes"; File: "CERT.SF") Found string "SHA-256-Digest: BZC6SdXagsTAESz9Qnb3GdRS2fEStNDlXMxol7OtwhM=" (Indicator: "aes"; File: "CERT.SF") Found string "SHA-256-Digest: oJv0EG9cZUL0aWxlkCapipzm1ho3fUb7dZRTovaeSos=" (Indicator: "aes"; File: "CERT.SF")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a2795f27607d2bc856381a9c786e3849e35c7991b30446a75b260cfc7f918b81","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":55,"unified_at_epoch_ms":1791154518376,"unified_at":"2026-10-04T22:55:18.376Z","metadata":{"hashes":{"sha256":"a2795f27607d2bc856381a9c786e3849e35c7991b30446a75b260cfc7f918b81","sha1":"d1d6c447068e6ad72a082384366fe4f16b261916","md5":"6e8c07584c84ab409a1fbc16b3f4258c","sha512":"661eca820ec7f55afac247b9b3804029f73c9bfbad4c66bff103327d96a5c1c13423c28f43b5684a1bbddbdb2a82af5206f7f1f5be516a7028e20f4f27db7826","ssdeep":"393216:zh7a5A0gjA3b63HPhdWWbF641gJqqMElgg/YZ/TblhQk3HgfGb7iQb05p5o3:zIOjyb63vzWd41u59qflqkXNnilFo3","ssdeep_chunks":["393216:zh7a5A0","393216:h7a5A0g","393216:7a5A0gj","393216:a5A0gjA","393216:5A0gjA3","393216:A0gjA3b","393216:0gjA3b6","393216:gjA3b63","393216:jA3b63H","393216:A3b63HP","393216:3b63HPh","393216:b63HPhd","393216:63HPhdW","393216:3HPhdWW","393216:HPhdWWb","393216:PhdWWbF","393216:hdWWbF6","393216:dWWbF64","393216:WWbF641","393216:WbF641g","393216:bF641gJ","393216:F641gJq","393216:641gJqq","393216:41gJqqM","393216:1gJqqME","393216:gJqqMEl","393216:JqqMElg","393216:qqMElgg","393216:qMElgg/","393216:MElgg/Y","393216:Elgg/YZ","393216:lgg/YZ/","393216:gg/YZ/T","393216:g/YZ/Tb","393216:/YZ/Tbl","393216:YZ/Tblh","393216:Z/TblhQ","393216:/TblhQk","393216:TblhQk3","393216:blhQk3H","393216:lhQk3Hg","393216:hQk3Hgf","393216:Qk3HgfG","393216:k3HgfGb","393216:3HgfGb7","393216:HgfGb7i","393216:gfGb7iQ","393216:fGb7iQb","393216:Gb7iQb0","393216:b7iQb05","393216:7iQb05p","393216:iQb05p5","393216:Qb05p5o","393216:b05p5o3","786432:zh7a5A0","786432:h7a5A0g","786432:7a5A0gj","786432:a5A0gjA","786432:5A0gjA3","786432:A0gjA3b","786432:0gjA3b6","786432:gjA3b63","786432:jA3b63H","786432:A3b63HP","786432:3b63HPh","786432:b63HPhd","786432:63HPhdW","786432:3HPhdWW","786432:HPhdWWb","786432:PhdWWbF","786432:hdWWbF6","786432:dWWbF64","786432:WWbF641","786432:WbF641g","786432:bF641gJ","786432:F641gJq","786432:641gJqq","786432:41gJqqM","786432:1gJqqME","786432:gJqqMEl","786432:JqqMElg","786432:qqMElgg","786432:qMElgg/","786432:MElgg/Y","786432:Elgg/YZ","786432:lgg/YZ/","786432:gg/YZ/T","786432:g/YZ/Tb","786432:/YZ/Tbl","786432:YZ/Tblh","786432:Z/TblhQ","786432:/TblhQk","786432:TblhQk3","786432:blhQk3H","786432:lhQk3Hg","786432:hQk3Hgf","786432:Qk3HgfG","786432:k3HgfGb","786432:3HgfGb7","786432:HgfGb7i","786432:gfGb7iQ","786432:fGb7iQb","786432:Gb7iQb0","786432:b7iQb05","786432:7iQb05p","786432:iQb05p5","786432:Qb05p5o","786432:b05p5o3","393216:zIOjyb6","393216:IOjyb63","393216:Ojyb63v","393216:jyb63vz","393216:yb63vzW","393216:b63vzWd","393216:63vzWd4","393216:3vzWd41","393216:vzWd41u","393216:zWd41u5","393216:Wd41u59","393216:d41u59q","393216:41u59qf","393216:1u59qfl","393216:u59qflq","393216:59qflqk","393216:9qflqkX","393216:qflqkXN","393216:flqkXNn","393216:lqkXNni","393216:qkXNnil","393216:kXNnilF","393216:XNnilFo","393216:NnilFo3"],"imphash":"Unknown"},"file_info":{"file_name":"Home Workout - No Equipment v1.2.16 Premium Mod Apk {CracksHash}.apk","file_type":["android"],"file_type_id":"apk","file_size":23159908,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1706988643000,"last_seen":1706988643000,"last_multi_scan":1706988643000}},"detections":{"summary":{"verdict":"malicious","score":55,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":15,"suspicious_count":1,"malicious_count":1,"total":17},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"$25","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.846328761468281","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$26","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$27","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$28","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$29","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"AndroidManifest.xml\" has type \"Android binary XML\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Disposition: form-data; name=\\\"%s\\\"\"; File: \"x$h.smali\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://resource.\"\n Found HTTPS url \"https://ttsverify.\"\n Found HTTPS url \"https://exoplayer.dev\"\n Found HTTPS url \"https://leap.app\"\n Found HTTPS url \"https://config.ads.vungle.com\"\n Found HTTPS url \"https://apidis.period\"\n Found HTTPS url \"https://www.youtube.com\"\n Found HTTPS url \"https://developers.facebook.com\"\n Found HTTPS url \"https://graph\"\n Found HTTPS url \"https://graph.\"\n Found HTTPS url \"https://play.google.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"libaoecore.so_\"\n YARA signature for AES encryption matched on file \"libaoecore.so\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"suspicious","category":"General","name":"Requires permissions that could be uesd for malicious intents","description":"Permission request for \"android.permission.WAKE_LOCK\"\n Permission request for \"android.permission.INTERNET\"\n Permission request for \"android.permission.WRITE_EXTERNAL_STORAGE\"\n Permission request for \"android.permission.USE_CREDENTIALS\"","origin":"Static Parser","relevance":10,"id":"static-27","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Bolonyokte\" matched file \"sample.bin\" as \"UnknownDotNet RAT - Bolonyokte\" (Author: Jean-Philippe Teissier / @Jipe_)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]}]},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"65be946042a8cadfa70fb8ae","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"malicious","threat_score":55,"submit_name":"Home Workout - No Equipment v1.2.16 Premium Mod Apk {CracksHash}.apk","analysis_start_time":"2024-02-03T19:30:44+00:00","indicators_count":{"informative":15,"suspicious":1,"malicious":1},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DebugProbesKt.bin","sha256":"ae8a082dd609313835ba93c3ef479a3af9903977d7bdc81df45bbd209ec7d0da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"CERT.SF","sha256":"59c2c55fa6ccd74722d6aa5d10735ce92840987f11d07f29e626da72791ada73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"MANIFEST.MF","sha256":"76c2e238023a3b98b9d11e1598dd815053c292ca219fe6b031d771203871f9b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"libaoecore.so","sha256":"45f4dbd9dd9370ea783698611e7ad5c303c3b296a305bad96a68f910a6c2f44d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"libaoecore.so_1706988685772","sha256":"7752a15dc26a606e57a89616b8b4e5a85da1a16ff02356f5ea3712bbc519f743","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"libaoecore.so_1706988685773","sha256":"a6aa7a0394d768db7b7625a78ffea539a6bc8093d3d4dfe4308205686a2075c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"AndroidManifest.xml","sha256":"8fb1f500856ec2b65ed20e10ea04d41b3e9626335579acbdea8335c9e7308cb3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"libaoecore.so_1706988685774","sha256":"2c615f354a251827479d2a2735bcb8680bba0f1618c3ee4c71d7aa15f2ec96df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"liblpcore.so_1706988685774","sha256":"3b550947fb9c5eaf5a9cb1b9e03443798811f0041190ea2f08bcf55e92f3e266","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"liblpcore.so_1706988685773","sha256":"bdfc610561cfdf23bc8e42f3b34ada7361832895a7b72c9cb6cea1597f18d276","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"liblpcore.so","sha256":"0a6b2ce2e1c9a1c2a60e2ac78fa3d3c12e9fe9f4b46cd6cb33bbef4f4e10ad5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"field_mask.proto","sha256":"ed78e81d3f16618964b65692a02d229da6591bbec6eafc2ee4f052eaccf25b8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"api.proto","sha256":"4d050ed6172b20717022f081e26ddaaa9e534c58fc7b4cf1e88bde62ebed3c9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"timestamp.proto","sha256":"9489462cbd4eff7c013d10de596be38da1087c7824ea34357669bc21bf5c0800","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"type.proto","sha256":"18e4e0335dd6a5cd0d52530d818496c954ad95a69b304f1c8103d7b2ca2d509a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"any.proto","sha256":"1aa80cf90ddbd380b73b1422bae51d76d99b82a4cdf0b183f21a802f72aafe8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"duration.proto","sha256":"099047097e8fe73657b49ef67af914a7a686ac6154f9d872882708b5eb3db04c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"wrappers.proto","sha256":"020c88776e814647da13c1cd5675031a3ffd35b016e64f721c5e066d375d4f43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"struct.proto","sha256":"da3ae94314e030bc6887a56b0f0a1b9f9731558fec7c68e99edd40e15e80f758","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]},{"name":"client_analytics.proto","sha256":"0c76732776772b260528558f9b675a49529cad785c421ca11b487179b8162610","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65be946042a8cadfa70fb8ae"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["65be946042a8cadfa70fb8ae"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample a2795f27607d… — Score 55/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a2795f27607d…. Threat score 55/100. 0/24 AV engines flagged this file. 1 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a2795f27607d2bc856381a9c786e3849e35c7991b30446a75b260cfc7f918b81"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample a2795f27607d… — Score 55/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a2795f27607d…. Threat score 55/100. 0/24 AV engines flagged this file. 1 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a2795f27607d2bc856381a9c786e3849e35c7991b30446a75b260cfc7f918b81"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample a2795f27607d… — Score 55/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a2795f27607d…. Threat score 55/100. 0/24 AV engines flagged this file. 1 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]