4bf1339c9d6a1d382dd09beab215141923ba9e20f08d95cdf47bb124bba629ef

General

Target
ARWSG.apk
Size 8.3MB
Sample260416-akyevscv7m
SHA256 4bf1339c9d6a1d382dd09beab215141923ba9e20f08d95cdf47bb124bba629ef
MD5 5dfff2dc4846810f9a2b7d2450e78c6b
SHA1 cc5119819697e9be657a33f277d1bfc69a99bee6
SHA512 e9bc4b3d506c9355ddcbde0863ee6ad7a532b6a90be0716da1ec07686dfd61c05a1513e54cef7dddcf93bf4529005d92ef38def59b2b4b7a2aec1b46957be71e
SSDEEP 98304:JbQ2zSGqcEBq7DCfAtaIF0robT7usDt0uchKjtat9RV5RUtckUVj6/l4UtckUmjd:JNrqZBq7DKRo/7usBbch6Ipswqwo6YSQ
TLSH
T1C196029EF7689A2FC47710B20C6A5132529B4C1297835763696C371CB8BB6E80F4DBDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4721	co.median.android.odxoodq
/system_ext/framework/androidx.window.sidecar.jar	4721	co.median.android.odxoodq

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	co.median.android.odxoodq

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	co.median.android.odxoodq

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	co.median.android.odxoodq

co.median.android.odxoodq
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4721

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

INSTALLATION

Path /data/data/co.median.android.odxoodq/files/INSTALLATION
Size 36B
SHA256 f41337536fe4f4af0e357c1672e7355c5cbd17eba9e3ac80ceb22bdb60a83f2a
MD5 a3f129826b5a151e8531fabdd8420c13
SHA1 7c49062c636a79a5c3cc5e004137fb56b42c51e9
SHA512 b4c51e524c6110cf46a8c5b73131838a83a8558865b016157c5a630f4286f19efcca6513268a021d3e0e2029657d4ce90dab435affa254a6c5de6eeccdf94af0
MD5 SHA1 SHA512

Submit Download

regexintext.json

Path /data/data/co.median.android.odxoodq/files/gonative-config/regexintext.json
Size 1KB
SHA256 6b5ca6ad052fe97b9235437b94555bb948683a53565d111b62b45aa80f2ce4ab
MD5 4fa89601553345abc6683e422fec2005
SHA1 cf8fc585567770c841043a42a3e8a49772fbf2bb
SHA512 d72403503f021cb6138686bbd5524e51d77db75dbb8b3911e989c7d9faff19bc98e78323376362ce92e86cc7a1c0abd64fdc5244cc8d3d3a20a363814287cbd0
TLSH
T1B9412474C9390DB398C82864B26E521B3A72215F2FD6391CFB8C062C1F4C5BF69B820C
MD5 SHA1 SHA512 TLSH

Submit Download

splashpage.json

Path /data/data/co.median.android.odxoodq/files/gonative-config/splashpage.json
Size 3KB
SHA256 d1d19c50f9e135d3ddb1e554abe98f26ca0ea9dd3b473ab5b920ae5c710a95ab
MD5 7b36d096a400c47de9c4526a40bb5ad4
SHA1 733a7a6aaaade11f7311d55a5a4aa77ead312bcf
SHA512 a560e9f83210da95ce69c169d0b15a2be35a1e8ac9b056720f862f6894972121c3b40984c60d394d37a9aa09df56a8011243ecb958974346c1e0ba1dcec5e42a
TLSH
T11D81967C06901CA2679533C7FE3CBA9E5633722B79C14C88099B314FD1A317AB469C65
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/co.median.android.odxoodq/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 4593049b68ac4c85d2b38dfac97a2936a9a97b9d60d49825ffc33f2c7c5564cd
MD5 ee3fb9adb57ab00ba8d47d50a2d6605f
SHA1 a57f7e9a563d2f0d73178459b3cbd5b68509e0c4
SHA512 682b6af2f8f2284f6d2a945f3cb5bb2ca54cb1fad19329a54da4525819b83621b2df1e0d3883f4442421758452d91f5255314a8353f0158a5b717ce5d376fbaf
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/co.median.android.odxoodq/primary.prof
Size 2KB
SHA256 dee74f0079c704c2e4b5221aec80e64351af7d32d704986216e78f0a38209ffe
MD5 62b637eb513a88d69a36cbce4356afa1
SHA1 de8cf440a3af05a9c3c547de3cf3412117b4b48b
SHA512 183e122245c31b80c4c922ab493ca8a324e89893a23dc8bb1fda957fb4616f8332143e684d1072f90a7f93e0dbfe39f976f547177664d19ebcb438409d791e9f
TLSH
T19C414B09AA943433F29C110B23D11FB828B7B6E1982817CE8DFB169CF2113E7B1A4076
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/co.median.android.odxoodq/primary.prof
Size 7KB
SHA256 8acd2ed7e2a440c2e772faa62ec86c31bd2c21f6e869ebba10cad0ce3a09975c
MD5 be60170f320b21e43a683910ae5448af
SHA1 b8b1b19d5a9d27a0cbafe6d5977f9d9fb937fe81
SHA512 e40cb2bdeaa8a48e94e5f9d40d4b74c05f896979392d692095158285d8167f20f944966ddd7e5c78d4e5fd5472ff358a8daecaa555a6a44c85d4f08a2fad9fcb
SSDEEP 192:sX23mFCt2eAlpfDQv12PhgEWBl2A3RqZ8gr4PH7Xxy:DW4s/lpfo2PhgtBnBqnsPH7By
TLSH
T1A4E1AF20C4FC924D47BB56944137E489FF0132D361EA0C7675DB86D634985AFC8F89A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads