759948e04dfc9c433a7b820539f1844c3ddbb989811965d34befaca962b2f3c0

Analysis

max time kernel
133s
max time network
154s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
16/04/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app-release.apk
Size 6.5MB
Sample260416-phex3aex3n
SHA256 759948e04dfc9c433a7b820539f1844c3ddbb989811965d34befaca962b2f3c0
MD5 af0cc1fdd944802be43dc22368b09cff
SHA1 1be4ee5817cf88e878b3008e08ddbf6a58781e2a
SHA512 6210676e54d919cc3e5cb0319ae89810dca4e62b1d961305c96855cf03679e74607174a6e18b1ceeffb6715064a16789561b876d6a7f72a5ad3b96bb2750d7f3
SSDEEP 196608:T44HpSy07DKRo/7usBbchPFPeeu47fTUz:E4HpHRo/nBwPFmeB7g
TLSH
T1EF66029EF7689A2FC47710B20C6A5231165B4C12D6839BA3696C371C787B7E80F4DBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	co.median.android.qdplryp

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	co.median.android.qdplryp

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	co.median.android.qdplryp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	co.median.android.qdplryp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	co.median.android.qdplryp

co.median.android.qdplryp
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5090

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

INSTALLATION

Path /data/data/co.median.android.qdplryp/files/INSTALLATION
Size 36B
SHA256 65c6db882f36c1df7f17549b0747cfb2d897254cd7b778bff1476473c37ec408
MD5 596b508f5b09dab553ab61c113ea8107
SHA1 14266a5219c6bd4c6b0a4c4b90fb5e2221355444
SHA512 324ea6c43430aede90207d5d3f96dd65adf9c43a1ecb65478da25906a8115954ed3a1e7468909624530ba6d909958af884b8860c9c30b042c2377a0374f3f9a9
MD5 SHA1 SHA512

Submit Download

regexintext.json

Path /data/data/co.median.android.qdplryp/files/gonative-config/regexintext.json
Size 1KB
SHA256 5c8c872ca8aaa89d3195758ebf1679cddd024a3411a56353aa04824671899ac7
MD5 f9159c71c56dc8b3ca91b014f9b6cb29
SHA1 19c0398a7406d1178dc48f762fb56a9131aa4021
SHA512 e543524835b0a63874f9a9ff22f8475bee4900726ffcb7fe1bd00caa60e801a54e55c649f70b94885107ec38ba32e8c50fa4630f1d35e6ff78833ab2eb11a148
TLSH
T1B841E274C9680DB399C82864B26E421B7A72615F2FD6391DFB8C162C1F4C5BF69B820C
MD5 SHA1 SHA512 TLSH

Submit Download

profileInstalled

Path /data/data/co.median.android.qdplryp/files/profileInstalled
Size 24B
SHA256 95439c2a4edca53d7369231e7ca7f0e44b92b2614b68935e0a94c86eb112ff36
MD5 30af640ef3b2e24ebaac315324320e0c
SHA1 78171ab5c66a5676965592047cc8333fea175883
SHA512 44645c0f57beb95f56bba356dd7fdcc027ce164ea1aea8c5e553d5c82dbdd5ec69f65d02a6df7c4832b952539d998f7713ed8b41961cb4deb3aa3e86b5309c40
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/co.median.android.qdplryp/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 04e2d980f9b0c05c9a945c40ddb47155d80fabe7a1b1ca66ed8846ef67342b5c
MD5 110934e57553e38f35bc9640b98704fe
SHA1 710797ed388bac989d08ea09688f44f05dacf452
SHA512 62087315e96c244ac898a58e68d91d73ceb5b4d90530b1b87fa06860d7ff958ca23993d2cb43a10cf71d5490cf66b3942bed691f5505263dfb2a0a5daf6aaa10
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/co.median.android.qdplryp/primary.prof
Size 1KB
SHA256 ad604b9ba6a1b9e7cba4c43dac6246ad05a08c34d4613dba8ea0e8a1c2c7eddc
MD5 ef3b403df323556ec3e0cded4fc3fbde
SHA1 0d06367d219007446791fe5fd01e2bdb68876a68
SHA512 37c258b2b45db5c7d3ffa4c5e2222e2206f62ad922ba75bfe4ed01e93ad3c56415ec4b456ba7d20e8e1d0a8a09add36edb0c8b2ca26e00b494d72f6492cece9c
TLSH
T1BC412A098BE0DE36A647A96CBAC5381F6B40F0C66E4E943609AF03198C78A612918C96
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads