Analysis
- max time kernel
104s - max time network
162s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
16/04/2026, 00:16
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ARWSG.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ARWSG.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
ARWSG.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target ARWSG.apk
- Size 8.3MB
- Sample260416-akyevscv7m
- SHA256 4bf1339c9d6a1d382dd09beab215141923ba9e20f08d95cdf47bb124bba629ef
- MD5 5dfff2dc4846810f9a2b7d2450e78c6b
- SHA1 cc5119819697e9be657a33f277d1bfc69a99bee6
- SHA512 e9bc4b3d506c9355ddcbde0863ee6ad7a532b6a90be0716da1ec07686dfd61c05a1513e54cef7dddcf93bf4529005d92ef38def59b2b4b7a2aec1b46957be71e
- SSDEEP 98304:JbQ2zSGqcEBq7DCfAtaIF0robT7usDt0uchKjtat9RV5RUtckUVj6/l4UtckUmjd:JNrqZBq7DKRo/7usBbch6Ipswqwo6YSQ
- TLSH T1C196029EF7689A2FC47710B20C6A5132529B4C1297835763696C371CB8BB6E80F4DBDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener co.median.android.odxoodq - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone co.median.android.odxoodq - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver co.median.android.odxoodq - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo co.median.android.odxoodq - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo co.median.android.odxoodq
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/co.median.android.odxoodq/files/INSTALLATION
- Size 36B
- SHA256 f4b1622180819ed34f20af439b785eec107b8a169a06f823e1781bc309ba9ce9
- MD5 38a2a836ad3e60113d3fae48d5cf25c3
- SHA1 bfdb96f9cd2016a6f95c1fbc64cf41445840e5dd
- SHA512 77bfad702ead82b20979970cedb05b321ad542f16f766591e2d6ffe12c2dfd77274db6c45976df2ff9a52bfe9086b21a1e16d0d363114a455b0cc11693da9d6d
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.odxoodq/files/gonative-config/regexintext.json
- Size 1KB
- SHA256 6b5ca6ad052fe97b9235437b94555bb948683a53565d111b62b45aa80f2ce4ab
- MD5 4fa89601553345abc6683e422fec2005
- SHA1 cf8fc585567770c841043a42a3e8a49772fbf2bb
- SHA512 d72403503f021cb6138686bbd5524e51d77db75dbb8b3911e989c7d9faff19bc98e78323376362ce92e86cc7a1c0abd64fdc5244cc8d3d3a20a363814287cbd0
- TLSH T1B9412474C9390DB398C82864B26E521B3A72215F2FD6391CFB8C062C1F4C5BF69B820C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.odxoodq/files/gonative-config/splashpage.json
- Size 3KB
- SHA256 d1d19c50f9e135d3ddb1e554abe98f26ca0ea9dd3b473ab5b920ae5c710a95ab
- MD5 7b36d096a400c47de9c4526a40bb5ad4
- SHA1 733a7a6aaaade11f7311d55a5a4aa77ead312bcf
- SHA512 a560e9f83210da95ce69c169d0b15a2be35a1e8ac9b056720f862f6894972121c3b40984c60d394d37a9aa09df56a8011243ecb958974346c1e0ba1dcec5e42a
- TLSH T11D81967C06901CA2679533C7FE3CBA9E5633722B79C14C88099B314FD1A317AB469C65
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.odxoodq/files/profileInstalled
- Size 24B
- SHA256 c8adcf56cecda2d4b85e845cdee54fa1a82967d0eaaec0eb68cb499caf4472fc
- MD5 df9b184b547d728be3dfd4f0cda5613d
- SHA1 83914f211b20d69ffe322e649bdf06be228a65aa
- SHA512 4a8926e11d8ff86b3aa4b8b27dc9d0a526656265dd8c1c778d90be0600292b8094a29fc0128d7387d22543e9efb3379c59306be728f961c593682f29d63e4da6
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.odxoodq/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 71dd9c79e9022d93abdc9da91d7dcf5b45643ec0884b25a935433d3df58442d2
- MD5 053d47d69bc4c8f02f13edaf4c11d063
- SHA1 40b798f42b1ef8e04ef95fa97f0940868a2c0fbb
- SHA512 4fbb12d43d2c17ce15cd3e84e90c6a76aeed579cd813dc6f5a3ffda44714e75b90ccb0786346b2f9bfc3d8f83fd9e006c76c4cac0e28ead2d1e3a7bfc8d1d203
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/co.median.android.odxoodq/primary.prof
- Size 2KB
- SHA256 dee74f0079c704c2e4b5221aec80e64351af7d32d704986216e78f0a38209ffe
- MD5 62b637eb513a88d69a36cbce4356afa1
- SHA1 de8cf440a3af05a9c3c547de3cf3412117b4b48b
- SHA512 183e122245c31b80c4c922ab493ca8a324e89893a23dc8bb1fda957fb4616f8332143e684d1072f90a7f93e0dbfe39f976f547177664d19ebcb438409d791e9f
- TLSH T19C414B09AA943433F29C110B23D11FB828B7B6E1982817CE8DFB169CF2113E7B1A4076
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/co.median.android.odxoodq/primary.prof
- Size 7KB
- SHA256 a56691c9f84dd9e5e00d99459c982e036b3a9a0586ad9e4cec0cf43832fb70fd
- MD5 942331a5a2ab011c72ccbefe0599b9b1
- SHA1 06c51edf58cc2f1be4c73078e8d6b4c698f5ea51
- SHA512 c86dbdcfb0a8d6fefdbc2ad90742f02c689e6c085d648b01218c0de40b27a3546038c0850879057f65e18876234163fecaeca3fb9d493a82a705557c3aaf434b
- SSDEEP 192:i6sQB2qPUoEu5SZW7pfGjN2ItS9Dgo6FMUXBK2aFOQl8S:JsgP2u5EWpUN7EDT6GAgBFsS
- TLSH T14BE1AFC30A918D6F25B888CB55DEA2B937D2B487507C4127CC79E9DA99DF2F70D4C094
- MD5 SHA1 SHA512 SSDEEP TLSH