Analysis
- max time kernel
46s - max time network
153s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
02/05/2026, 18:18
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
86_00059488.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target 86_00059488.apk
- Size 1.6MB
- Sample260502-wxswsshv2k
- SHA256 01498fa486a42fbee774b38221195537c0fdacfe87ed963ee3eecf8a77b867ba
- MD5 5a02392fb9617a0c76b8ab0dbd880f7d
- SHA1 a050d9f281bdade932d4a5e9dddfdc9b125630a2
- SHA512 161dbb9ca62aedef14238eeac8dbdbed508fd6b944aa6513bd424cecefb72b0c6b1e759026eb181a7e1de3f34118d48dcc6e77ff56d0ce822f6abb2b055b44f5
- SSDEEP 24576:rh0/HHUZjgIgFxfhR5sdkN7Fr4Iod3ZfhTWSZ0qQ7t/0qq6sR07:rKH4jSxfwkN7OJ3nGt7tR7
- TLSH T133758C81FFA8DE2EC87700330D5A5635161A9D2FC7429343DAEC366868776E44EC9BE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.kOkiziaQ.mNbzhyfg.iOpqlakF.zjmshiUj - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.kOkiziaQ.mNbzhyfg.iOpqlakF.zjmshiUj - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.kOkiziaQ.mNbzhyfg.iOpqlakF.zjmshiUj - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.kOkiziaQ.mNbzhyfg.iOpqlakF.zjmshiUj
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.kOkiziaQ.mNbzhyfg.iOpqlakF.zjmshiUj/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 559e77776157982dce2831dbf50d1f76678de8c3826cf69f3c3f36ae9974ec77
- MD5 5c49ca8a8937ad0d0cde6247e88fd183
- SHA1 a323f909a6dd2afa254350a5c2ee248f34025487
- SHA512 d05aa0882355d6915a307a22c80440e03d4418fc49dba018768914014c9735fa06fa84237eaf32ef1f873f96ca6fdd624e15699eb0f2f4dc0c70f67ba05336f7
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.kOkiziaQ.mNbzhyfg.iOpqlakF.zjmshiUj/primary.prof
- Size 877B
- SHA256 e87a4a232d2bfca9f02b087cfa089463a1a5b67b465743e6b27171dbfaeb233a
- MD5 e7bc825e9e6c8cf1306120f81029075b
- SHA1 6956f0451a8257c3da8c767703ce7bb744a48cec
- SHA512 cb194e4b0149dc6d74b06c985e6796ce2fe8ab71413c613475633c47aba0b4f07c33b832a0c9d3b5f32caa1b75a201b9a40dc212bfb4d910437bec35cc3756b2
- TLSH T1E911E6AA9DA404790DF0B745281EA00DE3CFC4001C8AAC0053F511B8CE25415631C236
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/com.kOkiziaQ.mNbzhyfg.iOpqlakF.zjmshiUj/primary.prof
- Size 1KB
- SHA256 64b89a06333096cc771373ba57b4b366b10cebd35c8de7ca77b31023f9f39820
- MD5 9b8be4ab2929f697a4d4351bd33645bc
- SHA1 f640cfb36fc5be4304e6009f3e0e400d045c8414
- SHA512 fb9826e07de78eeb4b4b717e3a3d1643e1ab4a8c58b82cdef8812916618a407c517729ea56003c8b7f53f48481a7cd91d02197f460131456e8fe717ba625b666
- TLSH T1DE21B3061F022D9C2DB94011366A960A143B12CA2686FAA086B4E91378099FF203E8A2
- MD5 SHA1 SHA512 TLSH