0b76ab1b03a4ea153c5de738e5439a42711e870d208db7889a4efd41f57d0695

Analysis

max time kernel
6s
max time network
153s
platform
android-10_x64
resource
android-x64-20251229-en
resource tags

arch:x64arch:x86image:android-x64-20251229-enlocale:en-usos:android-10-x64system
submitted
30/12/2025, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1`25.apk
Size 2.8MB
Sample251230-wyncpsyrey
SHA256 6b685f39cafe6bb9bf8c4edc931fa5c869d4c5b70c5cd578a9a6e4cdd16b400f
MD5 d342b4806e5f3e3b5450a8d967e55b5e
SHA1 1d703017c8cbed223d0f1854458e0a9c95f14cc4
SHA512 964b270dae6fb380be8d090f6cf7b92f72ccd3d24de7f7d9ffa4b98b941073420ccb5e43fb6876c3337c335c65c610b84f558fa45cce68f950ea18d8b214cd26
SSDEEP 49152:zEuqfq3NolL0+JmNX7wy4W9swxpPW1l4FENv4IuDRSxONBgxNTou:SfqdolXJmJKW02FENv4IoNuTou
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access defense_evasion discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.drnull.v3

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v3

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.drnull.v3

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.drnull.v3

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.drnull.v3

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.drnull.v3

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.drnull.v3

com.drnull.v3
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5063
- ping -c 2 -W 10 -v google.com
  2⤵
  PID:5119
- ping -c 2 -W 10 -v google.com
  2⤵
  PID:5267

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

~test.test

Path /data/data/com.drnull.v3/cache/~test.test
Size 4B
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db
Size 16KB
SHA256 2ce89c3f1d00bdaeb01a832317b786612079f971b5ecc7da95bdb9a5e839d9b9
MD5 de63f6626f5c557ba1b7ccf4006a28d5
SHA1 0587581eff3c6c25a4241355d87ecc149d5fb8d8
SHA512 aea09c74e432e73ea5153c95889ead6b7211b726daeece7b537170f434936cbb398f701796799e708e0ed068126620f9189c5230cbc86873a92932956c5c2f21
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6cEH:TLiEy9zmzrfRmBEyPbP/P+/0Fl6cE7n7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db
Size 16KB
SHA256 1ba9a75a4d068d6cbfe57cd12cbc37f3751480b8706f796cabc104091235eb93
MD5 e182b5f12bfe4608027e03966c1b83bd
SHA1 9fc51c17f9c0f5da94cfa20816a24bee5fab1a05
SHA512 4311ce954d0833c6e18ddeac633e5ccf3846399e8d508be1cf71072bf41d3a35d74d7f547d7de2c3c7e1c990bf0766efef257f4bf83161ed793b34e64bfe3769
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFleEV+/0Fl6cE7n7:TLQpmzr0GSP/h1499FflFbE77
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db
Size 16KB
SHA256 509b6d2170eeeb2a755e732b0ebe4cfab18dd943fd6b6eea37ac192b83b39d5b
MD5 dca2ca47a4c22feca4d5a9c749c6f8d4
SHA1 437520192e2fa5301514e6ed854c1bbd8f208650
SHA512 f02b49b5f88c1b6093870c56654c8988747a52b3aa1770d4fbdb8f1bbd5f7fa7abafa50d926afd4c3e39cb3e30a9fa4382759b2c4c25a863bdfb7d6ae8721118
SSDEEP 24:TLEvpmzr0GSP/9PKary5tm7Y499FflFbE77:T4vArSP/9Saryzm5Pa
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db
Size 16KB
SHA256 6c3c130d501fe50189c479c3bfbc7d0fa3c73cc28eb36ddc856c8992c0e30205
MD5 51b0b4c735f6725770721f8553fd08ad
SHA1 b90aa920a0ba240cc9901cc67b4fdaae0972704a
SHA512 99af2b5c2b52bd96d0b033c47ca3c85a91a24ea15fb612900b0ed7bd33979518dcc98c84462e5b58603ceb684920e3b5ca43e25d36257fe85bef9d7667d64ae9
SSDEEP 24:TL6Xpmzr0GSP/on/kOTEtm7qPKary5tm7Y499FflFbE77:T2XArSP/oXYlSaryzm5Pa
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db
Size 16KB
SHA256 1c74d6c83d3a3555869a6586c14efd5af881e2ea09c9a78aee96a4ff97b97b73
MD5 3ce5bd7864f78d68ae0043f499258c1b
SHA1 66657337f643c8f3339a5216b3a1860d28bfbd2e
SHA512 c68cc43838fc3f4d029946e91a1b8602a8fac291531d0ea67a3b5d951a0e083d671660a427b3bbf1f4c1fd43893343be9edb0b38d799a5c56e49ed547ee69d9f
SSDEEP 6:l9bNFlmls1QlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WG:TLUEQ9zmzrfRmBEyPbP/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download