Analysis
- max time kernel
25s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
08/05/2026, 12:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
app.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
app.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
app.apk
Resource
android-x64-arm64-20260325-en
3 signatures
150 seconds
General
- Target app.apk
- Size 1.6MB
- Sample260508-phvnhsct3p
- SHA256 b0a7c77a06d6d948ab99d843e38a4c00a9477a07b20b8c2bbf2926753c76a15a
- MD5 c7bb61162aee93bd23567031494a5cb8
- SHA1 65a4ecbabf17d5a309fbc56bb1a46bf2ff9c47ed
- SHA512 b45450dc3a618547ea2ab57f6c2135924b8f53f4d6d25145400b602f31a617af2019cc380957f0d464619d2ec65f05e2593a466485b0f6b5bd2bf7d6a6709a59
- SSDEEP 24576:fo+cl/cmHZ9J1SQRs9l9JUM/XzDnQVG3VdWzsKcInCpJLTP1OThqslY0qvVVu5ht:A7kSI9l9J7zEU3VONcInCp5QNqvxu5ht
- TLSH T194750253EB08E4B7C9A7C137A275475696274CA44993E7930E44B12C0EFB6C09F9EF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener bp8q.nsvj - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone bp8q.nsvj - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver bp8q.nsvj - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo bp8q.nsvj - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo bp8q.nsvj
Processes
-
bp8q.nsvj1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5020 -
getprop ro.product.cpu.abi2⤵PID:5055
-
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /storage/emulated/0/Android/data/bp8q.nsvj/files/tbslog/tbslog.txt
- Size 15KB
- SHA256 139f007c13d1943dbd12b756ffb793f37d87e6cd325c8d055f17d2a3f0f12e56
- MD5 c435fb277fbac59635c96a0fa0086282
- SHA1 06fd06b98fe3861121aecedefeb427ca210f2af9
- SHA512 71e3ca7c22c744daf40766256c5a788759e818b816a9586c986d2b27089876adee1010f337357fab35e6aac76fd1e3e42d491a9e040d8e7f79e405a65d8465f5
- SSDEEP 384:2QskkOsJKQXpp6GNIFxj1sCagBdGcvPWrS3k:2QskkOsJKQXptOjqGhvRk
- TLSH T13F629E25CAAE4F0A020B5E5C9E57136802B7D7DD61423D88FD8F157BE298D3E3224D39
- MD5 SHA1 SHA512 SSDEEP TLSH