759948e04dfc9c433a7b820539f1844c3ddbb989811965d34befaca962b2f3c0

Analysis

max time kernel
32s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
16/04/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app-release.apk
Size 6.5MB
Sample260416-phex3aex3n
SHA256 759948e04dfc9c433a7b820539f1844c3ddbb989811965d34befaca962b2f3c0
MD5 af0cc1fdd944802be43dc22368b09cff
SHA1 1be4ee5817cf88e878b3008e08ddbf6a58781e2a
SHA512 6210676e54d919cc3e5cb0319ae89810dca4e62b1d961305c96855cf03679e74607174a6e18b1ceeffb6715064a16789561b876d6a7f72a5ad3b96bb2750d7f3
SSDEEP 196608:T44HpSy07DKRo/7usBbchPFPeeu47fTUz:E4HpHRo/nBwPFmeB7g
TLSH
T1EF66029EF7689A2FC47710B20C6A5231165B4C12D6839BA3696C371C787B7E80F4DBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4705	co.median.android.qdplryp
/system_ext/framework/androidx.window.sidecar.jar	4705	co.median.android.qdplryp

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	co.median.android.qdplryp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	co.median.android.qdplryp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	co.median.android.qdplryp

co.median.android.qdplryp
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4705

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

INSTALLATION

Path /data/data/co.median.android.qdplryp/files/INSTALLATION
Size 36B
SHA256 f6668d9923b04461430c0383daf1b4b8fa5de2fd9f2628cc2c1c53a159fa4dc1
MD5 c0bb07803b285792510f4a78ad5dcddb
SHA1 86c2af41fc22193794ed545c05b76767cb920639
SHA512 21860b3ff8688308a9564ba1a2d53dd34396d6c2e5768d4d9691d3e66b31ef49055b55bd89ca90bebfc042b4190f9068f76ac8f7f304f231d4c444b0a13d9c92
MD5 SHA1 SHA512

Submit Download

regexintext.json

Path /data/data/co.median.android.qdplryp/files/gonative-config/regexintext.json
Size 1KB
SHA256 5c8c872ca8aaa89d3195758ebf1679cddd024a3411a56353aa04824671899ac7
MD5 f9159c71c56dc8b3ca91b014f9b6cb29
SHA1 19c0398a7406d1178dc48f762fb56a9131aa4021
SHA512 e543524835b0a63874f9a9ff22f8475bee4900726ffcb7fe1bd00caa60e801a54e55c649f70b94885107ec38ba32e8c50fa4630f1d35e6ff78833ab2eb11a148
TLSH
T1B841E274C9680DB399C82864B26E421B7A72615F2FD6391DFB8C162C1F4C5BF69B820C
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/co.median.android.qdplryp/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 8db9ee8dbb32a82635a86352e420b6a1cfba03dbcccf756256a85a6f6a6726ca
MD5 faeb629cdd48de8176035f2ef459afd6
SHA1 895de8ab6617ebe50ebdf055703bc605be1e1c05
SHA512 f4c2b5db1829b3527869b590a61725965814f289da6300d9e41ff28948f55261be5cd3356221953958e4fb365e3e23ebf7b3d715248a6f89652065a544400bb6
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/co.median.android.qdplryp/primary.prof
Size 1KB
SHA256 ad604b9ba6a1b9e7cba4c43dac6246ad05a08c34d4613dba8ea0e8a1c2c7eddc
MD5 ef3b403df323556ec3e0cded4fc3fbde
SHA1 0d06367d219007446791fe5fd01e2bdb68876a68
SHA512 37c258b2b45db5c7d3ffa4c5e2222e2206f62ad922ba75bfe4ed01e93ad3c56415ec4b456ba7d20e8e1d0a8a09add36edb0c8b2ca26e00b494d72f6492cece9c
TLSH
T1BC412A098BE0DE36A647A96CBAC5381F6B40F0C66E4E943609AF03198C78A612918C96
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads