0b76ab1b03a4ea153c5de738e5439a42711e870d208db7889a4efd41f57d0695 | Triage™

Analysis

max time kernel
121s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20251229-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20251229-enlocale:en-usos:android-11-x64system
submitted
30/12/2025, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1`25.apk
Size 2.8MB
Sample251230-wyncpsyrey
SHA256 6b685f39cafe6bb9bf8c4edc931fa5c869d4c5b70c5cd578a9a6e4cdd16b400f
MD5 d342b4806e5f3e3b5450a8d967e55b5e
SHA1 1d703017c8cbed223d0f1854458e0a9c95f14cc4
SHA512 964b270dae6fb380be8d090f6cf7b92f72ccd3d24de7f7d9ffa4b98b941073420ccb5e43fb6876c3337c335c65c610b84f558fa45cce68f950ea18d8b214cd26
SSDEEP 49152:zEuqfq3NolL0+JmNX7wy4W9swxpPW1l4FENv4IuDRSxONBgxNTou:SfqdolXJmJKW02FENv4IoNuTou
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access defense_evasion discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

Transmitted Data Manipulation

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.drnull.v3

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v3

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.drnull.v3

Queries information about active data network 1 TTPs 1 IoCs

System Network Connections Discovery

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.drnull.v3

Checks memory information 2 TTPs 1 IoCs

System Checks

System Information Discovery

description	ioc	Process
File opened for read	/proc/meminfo	com.drnull.v3

com.drnull.v3
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Checks memory information
PID:4785
- ping -c 2 -W 10 -v google.com
  2⤵
  PID:4841

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Discovery

System Information Discovery

System Network Connections Discovery

Lateral Movement

Collection

Clipboard Data

Command and Control

Exfiltration

Impact

Data Manipulation

Transmitted Data Manipulation

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db
Size 16KB
SHA256 f2a2c152be20cd03ebb9d882e24d874b23fc144ed10248a06a601ac5411b9870
MD5 b685a9154cc24c001c8aec73ee6db5b1
SHA1 5b79686b8d1dffdff7c586975e1ed9ac7d25a3db
SHA512 cc050e67977ec40a4461c53a7701b098b0f2a4fd93a4d51fd922c2822fe7c5bc1853e0346915eb0aab9b3e38d677926c915a0d81fcfa8116f8f2cf138d758c71
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6j:TLiEq9zmzrfRmBEyPbP/P+/0Fl6v7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db
Size 16KB
SHA256 bbd401c7ba4558aaa7cbe3664dc403bb3806c590b9b659999279efb745d7bd88
MD5 693a1d37bb9206af4f95bf1c99aaba3c
SHA1 76cf53912ae07773b2f78d96ea09a4f60978dde1
SHA512 6b1a2b47bc04c5da748a47ff3ef14c1fe37e0070d6a99f6eb781708a3722bf59903d9cf9604ea1188a38f0b59ba1bd43b41a5c4854ab02c3fb4ef383e63a9550
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFlUk1V+/0Fl6v7:TLopmzr0GSP/h1499FKClF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db
Size 16KB
SHA256 aa241cc3540c2ab1b224ca04ab92e17d51828fd0740ac09e3cab62ab36281733
MD5 fd91b31f4d8fec2d644c20652f86a336
SHA1 d9e5e01fd2be2878108f7eaba7371980be199a6a
SHA512 7830cea48342777ad04acf01d92f64b473df07a1374c6e47f91ccd60f9e2ec6371034b2bf48a9d0003235c48fd697201e606fda35ab0c60d1968458fa1a12b49
SSDEEP 24:TLYpmzr0GSP/9PKary5tETl/499FKClF+:TcArSP/9SaryzEZQ5KS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db
Size 16KB
SHA256 97049be354109dca42804ad835db25ddce6b025992cf42ce16324fa3e456c3a9
MD5 6a23b3faa34ebc07f5c8e0f99f6343c9
SHA1 b3957d6c882d36b93397b8999f84f3d46b61695a
SHA512 619ae4e208ce2950d0c4ebb110673ee4353370c5a468e07a975cfcaca2c7bae14a1004e36cd2b61515b80003acd633a9bf2373399794d69294e454ceeec10189
SSDEEP 24:TL6vpmzr0GSP/on/kOTMYtETFwPKary5tETl/499FKClF+:T2vArSP/oXFE+SaryzEZQ5KS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db
Size 16KB
SHA256 15d61947b4cf1f07bf00a8cdf0b965510251716324d817cc72bcf7a6ca40843d
MD5 45cd8cea800c296d31f26f8dd6330bb7
SHA1 027445eb6290e930628549f6612100628d790f7c
SHA512 e9b0effe78fd6615d106f39506405a88def6c2b3152758c82cbee21f3411d3a59f4d6d366c21c622ddd341fbceee812c49cb73d64fc9210460e117802dea0701
SSDEEP 24:TL4pmzr0GSP/50uHKaOJtEqgvXTROTMYtETFwPKary5tETl/499FKClF+:T8ArSP/WuqaQMXkFE+SaryzEZQ5KS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 abf19387a7334892f5453a7e2ea10b374dee8c1af37aa6d98e2f7498f8adc1d2
MD5 b35f2ef113b29271126a73522272b98f
SHA1 897728c7869184f7a3adf88ded3fdd8281c21698
SHA512 b7351095751aa7354d81b719bd6f56a1808298c266065d4cd516a41a6f629852ec0c2c4419ebc3612d3bc9ad0214624f2496aa63444e3a656376e25f781ff6b8
SSDEEP 6:7+/l9wEevg9bNFluls1EnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuKwe:7+twvqL8EA9zmzrfRmBEyPbK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 0550e41ffa3effbb0a3282e25a3f3148d8646954a02d03f8f5510d99ffa56153
MD5 75c274b06627c12586092a65a5e6be1d
SHA1 7e1ac3a37e24b3ef8aa685655596efe05a7fb48c
SHA512 3300f7a51daafb3d5a9896bba1b87833985d7c9e736923150c7d4583711e34bf5194e69d53e82b0b32f95f282fece57a0ffe4430ea4e480513b53b0b7c0638be
SSDEEP 24:7+tV/kOTMYtETFwPKary5tETl/499FKClF0+qL6vpmzr0GSW:7MNFE+SaryzEZQ5KSZq2vArSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 0ff0bc1fa930158d16f3ac6e9d562b119cb6e42475fc7434aa8a5086870ae70f
MD5 0809c6a71b9893fde8c5c3026ad68583
SHA1 32bf7ff04475221a73faa3b2b80e2d6ae0ddc7f8
SHA512 4d8aee0cd777efdb4f7cd5ef2e35732c1824eb92116f67c2540a47672087ef6a9efafc023d57c2f481e42a76e292b163b2618acaf802f85ab6477acf94677469
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 b8d0e3e3fce565de213da8f16eeb2fa4ba07df3efdb82b3295ff81d3094a4faf
MD5 b2e842c727543d17439338b642cdc19c
SHA1 7c782e4c7bc7b79723c71c6b8ce4afa563c80bd8
SHA512 3b9bfa22c659002b55e205ce717048a6b6fb5a779b58f9081b495fb1f38717ef11ed3732c8be35de032135f4959d3b2ba924d168763adc668221dbea9f0404b0
SSDEEP 6:7+/l9oGUHn1gGW2vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKsLn:7+tiG2vqLiuWdYRmBEyPbZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db-journal
Size 4KB
SHA256 5f3ced39ebd36dab4a5550d1562dc6d4d2713304b7f7ab85de5535c443fb2f59
MD5 97c0911738dad3ec388b00cc507101ec
SHA1 32945472a6e71709f9d0354a313e72b79fd9cb5d
SHA512 f8cd81386a8f1316fd8259df895a26aa82a93691dcdf38e6b13216cd1b36c90527a9626b04ab12e6edbc2ed6733457e4e7e6e5794d4c4d5f8251b992ecb88ca0
SSDEEP 6:7+/l2jPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKT:7+tKqLJdeWRmBEyPbI
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.drnull.v3/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 1f8a549463e17446506c14d505d12a0e6a01189b36660df2798289135b3ce8a7
MD5 1451482e342353244fdf028c591088cc
SHA1 693ee24433cec00ab55a44df53a2321c86191bc2
SHA512 9def73d9449b82f0e7520eb17eb0c94b1dff0120f014062f07278cce82113a2a56f5a636d38cdbb207f9aa146b4d5cd73e417190c85d8127f89decae6e89e93a
SSDEEP 6:7+/l9iEgPg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuKfUs//N:7+tkE4qLmqKRmBEyPbGUsN
MD5 SHA1 SHA512 SSDEEP

Submit Download

PersistedInstallation6979875094704399767tmp

Path /data/data/com.drnull.v3/files/PersistedInstallation6979875094704399767tmp
Size 569B
SHA256 7cbfff63f32a6ea869411895f605ee8e00bc26a2074432d958801874ba658bf0
MD5 29905315aa1bc3d782655fffefdf09e8
SHA1 ee8b7468de22077091eb2ee23d298b713cff9069
SHA512 1bd11948feb3910e752a86cbc3b6eb9945bce721592bfa66609ddb5320f93017d3f95b92ba4c36f98b08bda07519ff0c138c31fa67bd0fdd7ae1efb3e8bb839b
MD5 SHA1 SHA512

Submit Download

PersistedInstallation7065800286635792206tmp

Path /data/data/com.drnull.v3/files/PersistedInstallation7065800286635792206tmp
Size 90B
SHA256 edf7f9c9a2d7a8da9c15710f5374e1d1d1876546b59f5d1b48a988dfe3726a40
MD5 75bc86dc9e823ae59dd6232a1e2c00bf
SHA1 f5e00ade08422325f666398f2993ce4cc73ae2f3
SHA512 4356aadbb4f6a0c95c724ceb581ed7dbf70b9fbcd86bab7e87cb02334e408688ac24ab535bd440245931b7fa7323ce29f53df57f3b0ec755ab0d9d5c74a3a569
MD5 SHA1 SHA512

Submit Download

domain.txt

Path /data/data/com.drnull.v3/files/domain.txt
Size 16B
SHA256 34bc27dca44468d551f9a1a8794c7026ab4b63cfaf0d7300f6b547902ed06f02
MD5 42d2ca176f7a505a34cda233f220c27d
SHA1 0486e9ff2391927f6054b49c43fd0352bc02cd45
SHA512 3425e715169e76dacc82a7d2ad1d17732e4ba30281d3d845815695da384d0a83c7e36ccbb0b3a349ef2593a0406091dc1e5340dc2a74da80578e2c5848b57a1d
MD5 SHA1 SHA512

Submit Download

port.txt

Path /data/data/com.drnull.v3/files/port.txt
Size 2B
SHA256 d30af076b0dc85cc5b0074b403f74770b73af84a70c2f77f7a3609d0db23112e
MD5 318b2739ddc2c16c97b33c9b04b79f3e
SHA1 94563ec383e29aa3743abd9b337b2e084fb199fb
SHA512 4dd6cf34aec0721cf1289fee6219fb385ba2d94a812ea7af7f6707856c2cd4353376ba28975cdede220132a02093c1be025cc7f2f96cab3738230c870bed10c8
MD5 SHA1 SHA512

Submit Download