26fbec09b4196260dca8ef94d2605dba8d4db6bb869a170c83ad99bdcb1eb70d

Resubmissions

05/03/2026, 19:15

260305-xyamaaax3z

05/03/2026, 19:10

260305-xvr26aax2v10

03/03/2026, 14:05

260303-rd357sat3x10

Analysis

max time kernel
113s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260129-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260129-enlocale:en-usos:android-11-x64system
submitted
03/03/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Battery Doctor.apk
Size 517KB
Sample260303-rd357sat3x
SHA256 26fbec09b4196260dca8ef94d2605dba8d4db6bb869a170c83ad99bdcb1eb70d
MD5 df4595ee727706d2cfdb7c9a1fe9e079
SHA1 e0180cc81fe303574a40cf64b680528628dcc0cd
SHA512 6ef28a9335cdb82069ad8608f019ae7b83b257ae48726545fe7e5758094d922a1bc3b43026df6feeedc8038ca499a40249b2702dd610d730773c237d17be02f9
SSDEEP 6144:NzAE/u4soffPaXw9jQSsWwQlrMJ7a4FFOKLtUMQVDDFzR7RhWrYr24:NzAHW3aQpdwQ+LDOKLtUnJDFzDhWMrJ
TLSH
T111B41287A3DA5974F6B71F39AABB10485C263DD06901CADD2251B44D0C77F008BADFAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.androiddoctor.battery

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.androiddoctor.battery

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.androiddoctor.battery

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.androiddoctor.battery

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.androiddoctor.battery

com.androiddoctor.battery
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Checks memory information
PID:4880

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...