Analysis
- max time kernel
141s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
08/05/2026, 12:18
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Emperor268_0.0.1.apk
Resource
android-x86-arm-20260325-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Emperor268_0.0.1.apk
Resource
android-x64-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Emperor268_0.0.1.apk
Resource
android-x64-arm64-20260325-en
2 signatures
150 seconds
General
- Target Emperor268_0.0.1.apk
- Size 5.4MB
- Sample260508-pgqceab18l
- SHA256 65c96b2ec4f3045b1a68ea6a3d6e731db0bfab8d44e87701676ffe143c6e5ec4
- MD5 153fdaa5f5bf7d6d98fb05b906545bc9
- SHA1 9a32c603dccbf415cc73c057fd6b7444c1c8b7f4
- SHA512 5448249c12178005b215b487b57bd07899781daf82edb8814ce69f9382a082bd59e0512ac48e262e7f3d62cdfde8b8a5ffa70fb0396af1fadd93838d198aca8a
- SSDEEP 98304:vLavvBHW9/dxU7ezQhggS+KlIWstZeIpppW3WY/Amv8c9N42djbQoTYrFg:vLwvBHCQvQjRs3erFN4G3V
- TLSH T1C946F1C7FBD8592FC87700B2C9AE52B156478D028A839F43AD48361C697B6D41F9DBC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.asiasigma.agentEmperor268 - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.asiasigma.agentEmperor268 - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.asiasigma.agentEmperor268 - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.asiasigma.agentEmperor268
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.asiasigma.agentEmperor268/files/profileInstalled
- Size 24B
- SHA256 596c175261a4def69d2569e40a306def9decba6f3dfa8aba9d7abe031bafd6e3
- MD5 fbc250fcc41c43e97c645354f9a7fc25
- SHA1 e911b8a357631565a5a93d96f7823ef22bbddadf
- SHA512 e7c7af564061dee3327a85e2ee601baeeadc3d68879257c8da0ea6df02a68d13f1783dcc6bd243d7857460543c76f25f278d265ebc2d6dd97f270edc335d3ec5
- MD5 SHA1 SHA512
- Path /data/data/com.asiasigma.agentEmperor268/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 1fe4f6ceedbdd540a66aa1ef1f38e75a3e96b6616d58d16ae641ceeff6fe8836
- MD5 c3f17f5f2104ed4360d9ccc1503e634e
- SHA1 0f2b3436cb2b375f5b694678ae0c3b00951a9601
- SHA512 dfc06ebc2ff6fba5d58c5e5273f2d9cb652efcd8ae776963b61279d3ecb15b70dc65dd9fe876bdff063d400be8f62710a4cc01f39bff766e8445454275072f86
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.asiasigma.agentEmperor268/primary.prof
- Size 2KB
- SHA256 272eda9ece0958b8b0fb9dddca2be0497440b9266c27208e3f95ab5930f294a4
- MD5 009b83ed0fd0a4e9b52ec2ffdf186e89
- SHA1 23f976c7cd6f4767172afaa29e88cee58dae5626
- SHA512 1939bcb0c46f7edb968fc539d9f2975897d73e84eb4250b165d46b80eae9841a971309eaf75df3bcc291734408da748a9cd58ad86bf7af4338d5ea6980035a5a
- TLSH T10C515C6346B94C49872C45304283FEF4CF4F3FDEABF152AB1886A822B440B38C51BB10
- MD5 SHA1 SHA512 TLSH