Analysis
- max time kernel
148s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
06/05/2026, 12:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
UdinSlot.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
UdinSlot.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
UdinSlot.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target UdinSlot.apk
- Size 2.7MB
- Sample260506-pgdzdaas2t
- SHA256 bb1bd5dfa4bf3f619a5c62cb26e9c649849e097360b08933b93844cfbbf977ab
- MD5 6f7823532ede214409fe63564c0696fe
- SHA1 92975458dddfdd925d72f3661063e7c7be9afe49
- SHA512 530048230af7a65e4689fa54577b3a39f87c1ec2b311290d72f26006913e7249960712dffc4b79350ead16a0a6b1405027abec94c31ef999884df27821e602d2
- SSDEEP 49152:pfKousz2gCoGTXf3Qf0XSCBiT0eupyMwlDCqmaHJWmkMldMjCBg8YSDDZw1lmgPc:pfKou3g1GTq0iCBg0epMwYEWadby8zeQ
- TLSH T109D50182EF65C82EC87748374EAA433512569E1EC6A7974385EC762C28376D80FD9FD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.p4d_udinslot.app - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.p4d_udinslot.app - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.p4d_udinslot.app - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.p4d_udinslot.app - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.p4d_udinslot.app - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.p4d_udinslot.app
Processes
-
com.p4d_udinslot.app1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5057
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.p4d_udinslot.app/files/profileInstalled
- Size 24B
- SHA256 fff2d6363201c7f68c8a103dceba5e5abd3a8946975373e277282038dc916c45
- MD5 691df18f97cc733b2bb5f94a606aaaa7
- SHA1 0963a6619a0f09ecc1263cc1cc3df2aa84016917
- SHA512 f2e145f954953922458f630dd3cfe44e7d0b66012df0ee9ad9fb72c0a1cbed727717eae00265c94413a170cd096f68aa055f74cdc438729a59a7b7a06d6a96db
- MD5 SHA1 SHA512
- Path /data/data/com.p4d_udinslot.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 da400d14dba458234007e74067c3d36dc98504da452782bfb05b5226ae13107f
- MD5 ec04294035e9ed4fd0c3b38da502a190
- SHA1 3c454a693aecb1a1c1e4fba1fd283259e6126790
- SHA512 ebc1f5d1a662905b883a7b7afcb962884ba7ce7552fc5f9bdc50592b472e90ecf5aa9190431be85abdb715ebe006895a6226c7c941bcc688fd52a9b715d1e133
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.p4d_udinslot.app/primary.prof
- Size 2KB
- SHA256 684d76e0d041b9c632c80f9195a91e9b1e170fd4f4150217d1c3d7862632f296
- MD5 2cd88bf4378e2163bd826a2b58f8d849
- SHA1 61915bc9dcc4db606400feb81b0568b715587745
- SHA512 09e337b2fd200288514ba03934dee55e436712148e3d496e2923065fce3c2dff6efdc3df3ae36a1ef9abcbdee350635920bde2c0b47efb6a6191561c4a4ed22b
- TLSH T1B14119293E51C377D03CC85025924AA572D7C038A563303CA0F66454EDB5DE28E90D36
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/com.p4d_udinslot.app/primary.prof
- Size 5KB
- SHA256 d8ef873f05b7cc3a10088d15e0e40c1084e13019fd0568395db517273cab9e1f
- MD5 78b06c3e2dbb00d93a4bc5674ec2df45
- SHA1 f0940f9e6d8f7ad08e7a61f17b8e8f50f84de0d5
- SHA512 21b2b00456ff1954cec2e64e39381f5660bf989a9c0b9178a0c9cdde0fd91886fc1eaf4dd3da60b929260c2c67a392dca10e437c84e95f2dcc6d63eb5e93ee54
- SSDEEP 96:3mduXQHUQtnE5ihd98/qsvoD+GYXIQzkdgUFdinYYHDzfavU3wAgvfHe+y:WduLQtEgPyqsvoD+GYYL9eYYHDzxPgv8
- TLSH T192C17DB07804149C1D701A730F92E9C53BA5AA1AE5433B3D1AC4782BE35BF3942B3AC1
- MD5 SHA1 SHA512 SSDEEP TLSH