General
- Target Starpatcher-Shizuku-LP-Integration.apk
- Size 4.5MB
- Sample260415-13rm5saz5j
- SHA256 5fc08b4c4197d94016ec27e3cf09d4943891921519b489ade3c9494d71fe4715
- MD5 5677937197c16866323174d1881c8629
- SHA1 95972d83ca1122065eb3e5f5368467e3363cca71
- SHA512 00971f2540077b8be211b4ef84b845c593ba4d3b55f35b71ef4af4e6a5f2990dad8f64b8047303f93fd61710940d2553e23e67aab96a9d30073b2ddcf16e7d9e
- SSDEEP 98304:/BSnUU0Y7xprhASuQRKgF+rjD0eAD0RfD06D0E9D0nAvD0/D0GD0Rot:/B80Y7LIw8DmDGfDtDPDCsD0DJD6ot
- TLSH T15526337B8AB7E257E1AB0B3E00B5095B0EAFD125DED3C11B7CE0366C18D359063D6A91
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Starpatcher-Shizuku-LP-Integration.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
Starpatcher-Shizuku-LP-Integration.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
Starpatcher-Shizuku-LP-Integration.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Extracted
-
copybara
-
213.109.147.74
Targets
-
- Target Starpatcher-Shizuku-LP-Integration.apk
- Size 4.5MB
- SHA256 5fc08b4c4197d94016ec27e3cf09d4943891921519b489ade3c9494d71fe4715
- MD5 5677937197c16866323174d1881c8629
- SHA1 95972d83ca1122065eb3e5f5368467e3363cca71
- SHA512 00971f2540077b8be211b4ef84b845c593ba4d3b55f35b71ef4af4e6a5f2990dad8f64b8047303f93fd61710940d2553e23e67aab96a9d30073b2ddcf16e7d9e
- SSDEEP 98304:/BSnUU0Y7xprhASuQRKgF+rjD0eAD0RfD06D0E9D0nAvD0/D0GD0Rot:/B80Y7LIw8DmDGfDtDPDCsD0DJD6ot
- TLSH T15526337B8AB7E257E1AB0B3E00B5095B0EAFD125DED3C11B7CE0366C18D359063D6A91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC)
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1