Changing the IMEI, Provider, Model, and Phone Number in the Android emulator
Summary: Cisco Talos analyzed the Pincer Android malware family and found code that checks the device IMEI, line1 phone number, network operator name, and Build.MODEL against default Android emulator values, including IMEI 000000000000000 and 012345678912345, phone number 15555215554, and models sdk and generic. The post then details hex-editor patches to the emulator-arm and emulator-x86 binaries to change the IMEI, the emulated SIM's MSISDN (stored in reverse nibbled endianness), and the phone number, whose last four digits are limited to even numbers between 5554 and 5584.
Why it matters: The malware's emulator checks caught a generic AVD on every value, so an analyst's standard test environment is itself a detection signal - and the patch method requires keeping each value the same length and leaves the last four phone digits predictable, which a more intelligent author could check for.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026