Analysis
- max time kernel
33s - max time network
152s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
11/05/2026, 12:11
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
clasha-android.apk
Resource
android-x64-arm64-20260325-en
3 signatures
150 seconds
General
- Target clasha-android.apk
- Size 21.5MB
- Sample260511-pc4dgacv5p
- SHA256 7da7dc5fd644ddce4dcbb25e8dcea2484ad9005325c64ef3a3c13fee4fd61936
- MD5 de2122d383b1ada354a590a9cff02281
- SHA1 0de1963124d1ce3bf134fca70a51f6d19256f920
- SHA512 182423835f41cd47ad5e5d45463039f10f04306e6fbd9c0dc9540537571652df4bc208bd79e7d79f14661fbfa5ddccd3d4a66d2dd42e51325586cb06046a6995
- SSDEEP 393216:vkEbYjjT1fNzk6pnVJXa3HcQWSx+bJBdfiYU20gWdl7oeCOsM+bBekpf9FAm3HEE:cAYjHXfnjKHcQeFBd6YU9gWdtoeC+4eO
- TLSH T1C6373344F318AA1FC5BB60324E76066612530E4F9982E643D961325C6EBBFC48F87FD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 4 IoCs
ioc Process /system/xbin/su com.github.ccg.clasha /system/app/Superuser.apk com.github.ccg.clasha:bg /system/xbin/su com.github.ccg.clasha:bg /system/app/Superuser.apk com.github.ccg.clasha - Checks the presence of a debugger
- Checks memory information 2 TTPs 2 IoCs
description ioc Process File opened for read /proc/meminfo com.github.ccg.clasha File opened for read /proc/meminfo com.github.ccg.clasha:bg
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.github.ccg.clasha/databases/androidx.work.workdb
- Size 4KB
- SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
- MD5 7e858c4054eb00fcddc653a04e5cd1c6
- SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
- SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
- TLSH T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
- MD5 SHA1 SHA512 TLSH
- Path /data/user/0/com.github.ccg.clasha/databases/androidx.work.workdb-journal
- Size 512B
- SHA256 d998c8f60997c8f034d3aee61b183b8786ee7cad90a02254d996568b7bf2764b
- MD5 e911ff28fce9a1f8761d878516a6ad83
- SHA1 9ad9ee1fce7321db29e927a59da487768d7e166c
- SHA512 bda0ab94e06876da7d8bbadbb8b8237b6675b0910bde9bc90c60ada0f8c1470cc0dc66835abc45f03c47d6048147e3562b128c4ee831bf4a2900d7980428d453
- TLSH T19AF012A013043511E38253FCF162C6500204304106B79919044E83001210D4A4041E80
- MD5 SHA1 SHA512 TLSH
- Path /data/user/0/com.github.ccg.clasha/databases/androidx.work.workdb-shm
- Size 32KB
- SHA256 f99797437ccb3b1ed74031d2f4bb062fe751502abb34090f85cdebbf2e761b21
- MD5 c8f78de61a6138e5bb0e19a17b94f80e
- SHA1 d2a9c472076235eed83047b8c741e57e1b043a4d
- SHA512 fab18062232bc46ad3ada298e895de6e97404a437d50bad3f29a20a39edb9b35919bd3933d01b7edafd2568568f705e487b3f2c571a02464c8833afd661ad4e8
- SSDEEP 3:wdWRiRWKZDvJVuXf0QghehoRAGFoMwAoydUt:wB5ZpzohMAGFoMfe
- TLSH T139E29BD60B09047BCB52343B6115524646790345D1C57E57859E390389100569F19641
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.github.ccg.clasha/databases/androidx.work.workdb-wal
- Size 16KB
- SHA256 b47d5515653a5ba669eded4c267016bc5fac146285664028830dd6a3b4325e56
- MD5 bf889eee1a7877298ac4ba1e20a98656
- SHA1 cd74d38312f2ebde961935a110530a71c6d0a122
- SHA512 5a4ae4f3235e761cd2c740226092a596b40c1f35f4acc10541eba9835af2f602f1cb7dfdb6500d35bc00b3f2c821e2379d6fb9110bf1eadb8625fc48c46267f6
- SSDEEP 12:YWdBvnsuftYBIchWRmBEyPbP/MF/8m1Ow2:YaBtYBFGSP/MC02
- TLSH T1C372C0A053483431D226437B9AA4C3000CA0324E9373C74B1DD249242DC1F86F185C04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.github.ccg.clasha/databases/androidx.work.workdb-wal
- Size 88KB
- SHA256 910cca354770dd1358836839eee20d6f5d9553ffd236b0b8487ec313c8ff5283
- MD5 74178fde5dd2eb7ae8e8f1aa2c6b3137
- SHA1 2357bcdc9422cd7152805fcd5349bb75dc471c93
- SHA512 714079294eb59450fa8304239cec85ef77616b2e0359a3e5b42da2804507b53362be05fff30f6c8c391fccf3ef25fa516c9284e9ff2ae3a86b8b2edf7f0c80ad
- SSDEEP 96:fGMv/4gRMpf83wSR+aw8Nn6266mPmpC6:f5vfMpf83wSR+aw8Nn6Lm
- TLSH T1D3931F8E0F5D3500C05998F296E00FB1793E416ED3B3E3E569929075ADC6A60EF28CF9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.github.ccg.clasha/databases/priConfig.db-journal
- Size 512B
- SHA256 aceba1a9577e05b5114b20bf613e0afae5220125ae79a49d56483f39b4ff672a
- MD5 c15fa992e5bf04a172f8d13a6ac3b7ed
- SHA1 26e5f7d874e95958ef4af090f64e070e71cad366
- SHA512 6923340d00d7739e4e791c5327f5aab548f4c65f481002ba8d3f83ae8aa5932a6befeeb77b2fedf8e0b0c82594674bb916399e9779891eeb0d3642d59bffdddd
- MD5 SHA1 SHA512
- Path /data/user/0/com.github.ccg.clasha/databases/priConfig.db-wal
- Size 16KB
- SHA256 6304a32273e754ca2350bf05409d06fcf2b37e7047f2c081048dd3fc6eebddaa
- MD5 069bc0b06b24f0e14debf65aeae9397e
- SHA1 385f238fdb9d81e9fcffb2553817de09989a1d89
- SHA512 41e6558632084cdbf229b4fefb8d3a9cd91c58154b086bf9ceeab1034478dec9909e0c7a7505f1431bcfd0c2418a5543cbaeaca7e560bcfb5984dcde63a2f008
- SSDEEP 6:KW6FKalO9FZde/kPlOERX4PBX4ogLugMBX4suuK+//+ll/mlwprOw2:KFUuIzdeWRmBEyPbP//+/+aprOw2
- TLSH T12272C29493912912C31D13FA90E5C38C1F68671AB653C74F66533859AC4228EA4A0D0A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.github.ccg.clasha/databases/priConfig.db-wal
- Size 36KB
- SHA256 e51c28bc094668a69f9fc7bbf5a0b990c873647c48aff0c99cf0eca398d0a133
- MD5 c0bea1eacb6480a5c1f5670a6262547e
- SHA1 031b8322f3521ba36866fbb8c94ab4e681735c91
- SHA512 833f2900cf0c7a0582e5587e307fd8c3fb1db497ae2f31816dc6d7e6996539306f64874fa12c0c03748040f855fb27ed4ba7fb31368fee765dc1caf3d5e099d2
- SSDEEP 24:2IvJlJo9qGg8EC0566up/3EGSP//er1RiW:2Iv/vGPEC0566Y/3TSP//er1RP
- TLSH T177F2008F4B391343C9A883B8E9B702D15E7D020FB3A3938266E634255C07A055470DF9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.github.ccg.clasha/files/Country.mmdb
- Size 3.9MB
- SHA256 ad1895ccf2c6fe0804e0506a92bd9eed1a9256a84f5443694c4fca67f9a47b26
- MD5 98dfa982051e2c4e256f243e3f01fb9d
- SHA1 86ea650bed0cb5cc0e011a2674bb0fcccac7b2b9
- SHA512 9be34ab8c6473fefe0702445be37239dfcacf3d4e8d569234769c403561dc8d37f7949341967e499904ebd9957cbd1afb371f740c20d30cf24179af7712aa8e1
- SSDEEP 98304:D3NpklKOp6w9gMVAq2bt9PnhNvDiKhuCuFC5OFCayWst0Iss3UVPFGluapcB3Ziq:HpiJmRETrWw
- TLSH T125167B73B7255F7AEF04AE02140982F050495F90B5E1BBD2CDF8AAB69C354A4B7B432D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user_de/0/com.github.ccg.clasha/databases/pubConfig.db-journal
- Size 512B
- SHA256 be871ec93badbbba1e36afe75a59ca8c77caf94e23b4a35de5d277ebc869592e
- MD5 6578e20eef10c0efa43c715a8cd8ce2f
- SHA1 36d891b6f8392cd77fcdb40a17ccef9191adf255
- SHA512 14dbebeeffd694ae3451c0dc84d9e6adede0c95acd7a22bc9f1e6956609a0cd29f741ab9753462622f1a409f6acc9b9add1246bc274bff8db8a341955fb46334
- MD5 SHA1 SHA512
- Path /data/user_de/0/com.github.ccg.clasha/databases/pubConfig.db-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user_de/0/com.github.ccg.clasha/databases/pubConfig.db-wal
- Size 16KB
- SHA256 9763783f0da26a5fe303c5aa0cf81d2912a99af8f52d3ac5291514b9704d9e57
- MD5 98415565d04339e421e4a6314a6b9b6c
- SHA1 969532a35421c27cf92508871089fdad89b7925a
- SHA512 c2514e7860bb84ccc971f9296a4562dce7b5851e39321774871f10f7975c8906de74a4c5530a68d9df0762a9d794356494e4ce4c33e00c88ee2a1a3ccef7d0f4
- SSDEEP 6:KLoTeo9FZde/kPlOERX4PBX4ogLugMBX4suuK+/uTvkljoXOw2:KqeyzdeWRmBEyPbP/w+yOw2
- TLSH T15A72C774B3881A92C1290333D0F9C3431E22A71CAB7AC74B1652A470BC42B88B2E1E28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user_de/0/com.github.ccg.clasha/databases/pubConfig.db-wal
- Size 36KB
- SHA256 46a33143bf01ba1d75eef79bb29c85cb37daef7a08a3c3dc35cfb1f06d57cd31
- MD5 80143b5af9d7cf78fd7d5cee90560e7b
- SHA1 707b0f3adc29a7ac732d2fe8675b562a2c3a96ff
- SHA512 c726f9c66139a3ddb343b3f6176f84c62cf8a9caa25543d11c9b4980cef8f7c74802e8a2b8b49ca64b83c5d8e4e83e3d00503589ef23ae096e09dbb5f7be831e
- SSDEEP 12:GmzQrpwtqYwemyYauIiCIcoHHlcbc0kv+/v+/uasn/3vRmBEyPbP/ggRkgYf0:GmzGRL/IhIc2Fnp66up/3EGSP/ghy
- TLSH T1DBF2CB697B8C3182D45543FBD2AB43A60F2C630983B2D68F3BB584347C07A00E8A9C68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user_de/0/com.github.ccg.clasha/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A01C8670222-0001-12D2-8A3247E5F994BeginSession.cls_temp
- Size 77B
- SHA256 f98e65817dabaf9fff75e52df7aae6f2badd70e2c416061bc6d4ec93a017c707
- MD5 7d9371fa2940016e8a42b047aaa03717
- SHA1 8d8ca88bc1fe2b279fbf3ddfcfe1b1a2848bd620
- SHA512 1671a55d58e25e066abd8aac237fc10df4c43c725891a23519011e00c6e47ac91cdbbd1ffb03a5acca16245504df5747c9296cd6184b3dfc9344e7fba0e4bfec
- TLSH T15BA022B2A880A03A800303CC2B030E82C33030B2308AF83808A3000003BB0F8033200A
- MD5 SHA1 SHA512 TLSH
- Path /data/user_de/0/com.github.ccg.clasha/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A01C8670222-0001-12D2-8A3247E5F994BeginSession.json
- Size 203B
- SHA256 17cfcb8518203529de6e288ea03820ab37b30b226e335de7ff507a0c4a945a23
- MD5 865a53ac54cda762a66d4630e0987aa7
- SHA1 0812a4001c55d991fc2ab5c4d23c43dcdba15acd
- SHA512 c043b95709a32e0bb63c037d960b5202fda6b2611b9079b00fd3b98d5cde0319f906bec72aa5cdcc718d8ba06f9f5cda1c677a5fea36220487fa92455f84234f
- TLSH T181D012B5EC7E3A6F4FD1E1C85C329E53FC6008751A8C7D2060F59D59158F894939982A
- MD5 SHA1 SHA512 TLSH
- Path /data/user_de/0/com.github.ccg.clasha/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A01C8670222-0001-12D2-8A3247E5F994SessionApp.cls_temp
- Size 116B
- SHA256 51af2f5ad61225faf83be714304fac818c796d3572dc9634ac6d64a20a25b8e3
- MD5 a39f00127616ac2b0da52a5f08e51cf6
- SHA1 746483292830b447d1b88af4d2d7b08a660d839d
- SHA512 3806f4eebf4d045864965dc1a3453a8e4a42466893622291b34572b0d693183ffa2472f6d066e6aea0e6ccf5bbe7981d9d80a3b0979c40571f717da16034071a
- TLSH T1A0B09BC60B09047B4B12341B6114524645790345D1C57D57459E390345100569F19641
- MD5 SHA1 SHA512 TLSH
- Path /data/user_de/0/com.github.ccg.clasha/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A01C8670222-0001-12D2-8A3247E5F994SessionApp.json
- Size 230B
- SHA256 57cee4207f04d0e7461ef9422a3f052abaefe8fab3d72829ae594da3b9a5ac68
- MD5 51a99b2b18fbf1d4371027ace1cc9aeb
- SHA1 cf4099ce329ea1204c71e222f2faea5a42f49021
- SHA512 56651fa2939e69815d6c1381876a15cc610bf41e93c49b7a242142be14b66d098e1d939169dc3966930481ebb1a91e17049848ed6a0f68cdca4e772dc85b440e
- TLSH T1B5D023E04F4DA4B30602322F8044417003F90263C0C43A041E4F2D02C3118CC0B18049
- MD5 SHA1 SHA512 TLSH
- Path /data/user_de/0/com.github.ccg.clasha/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A01C8670222-0001-12D2-8A3247E5F994SessionDevice.cls_temp
- Size 49B
- SHA256 ec664092a3596d487e39269cc43b1c24502473f0c666e4f91b808394a974a60f
- MD5 9678ee05e2c1d8edb5b2d5bc5fd3bd68
- SHA1 d17751c5903be86f5fb615e7c715d65af7ddc787
- SHA512 fff577233d552938e5865d94abce6ef6520abdb6bb9e110ed97e7b380d902f2004487e25b207af4e4e71107155bc9f4e77f4f73cc819df973dc355755067b95c
- MD5 SHA1 SHA512
- Path /data/user_de/0/com.github.ccg.clasha/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A01C8670222-0001-12D2-8A3247E5F994SessionOS.cls_temp
- Size 15B
- SHA256 94db7df32f7024d43abbedd5433d0a39a8dfe652621d40e7647af527fb5a2150
- MD5 8c751d367ca035ad56b9dc5865cf1780
- SHA1 20b437badd375403a9fb008bc3174d6f2f257932
- SHA512 f82774c2c74ef1527ab212c495cbbf55a0f21dbec8a0f9172f574ad0950762b8c45f19962da321b8297fb8985a23cb7d1fe77fe1b9535a27af952f3b2e328e94
- MD5 SHA1 SHA512
- Path /data/user_de/0/com.github.ccg.clasha/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A01C8670222-0001-12D2-8A3247E5F994SessionOS.json
- Size 56B
- SHA256 3a5df913db77290768c5dfbdfd65b218dfa34b7999441f5cc87797e4b65e445c
- MD5 66dcd98f1fd5bca64c229cc972cfcd9c
- SHA1 08e2eb6c7a4b34a5eba69d00099d5b30f1d84f94
- SHA512 362e92c6671814ec671a70aa7df0f0a5138ad93cfa3b0e88736536ae838ae70f45012b373d2e77835cf33da17f83020aa62821a1b4a78c93ec38da94403cd8f1
- TLSH T1FC9002769880A036101203545A555E51D37014726045F0245857041152A71B80231109
- MD5 SHA1 SHA512 TLSH
- Path /data/user_de/0/com.github.ccg.clasha/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
- Size 434B
- SHA256 87cc83b7714a36d91d26b3349c0b9e2b90984d717671f1df6ceecb64305a5c6b
- MD5 fe53df32715f3b0855808d1a21fab896
- SHA1 664fb8ba167fd68b87709750c9a2ebf6e7740a54
- SHA512 c9ffd6d844613367a603681d968f205447fb3f494bfbda73cb72f65c64eee4d34e615cb5d71f085f55ebf9ac6675f7f356b2cd3e7aabf773ae887054cc1e7ca5
- TLSH T1D0E0AB84C3081AFACB009B7CC42C889261B6AA37C2C1950D5E560A26CE9E0492376333
- MD5 SHA1 SHA512 TLSH
- Path /data/user_de/0/com.github.ccg.clasha/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
- Size 16B
- SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
- MD5 c33583fae4e0b61cde1c5b9227963237
- SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
- SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
- MD5 SHA1 SHA512
- Path /data/user_de/0/com.github.ccg.clasha/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_7cc124e7-3037-4e59-8e4c-91ee0c77ac82_1778501736046.tap
- Size 348B
- SHA256 ea00bf00865e13ce5067de395270cdefce1881234e9afabfe05f8659786d5efc
- MD5 e7401b1f6c3d737e1f626c558f57625b
- SHA1 11292d2c1f91a4ead397cb85e6cbe2fad7a30dc3
- SHA512 3d3fdb3041c2e6c2f9ed2f7f930c48b520950079810bfb49a72d2acd9a4ae5514539ec9d0ddc8802cae4d33cfb71eeecb15dba6d3b47d1c38cead70d3a44ea40
- TLSH T126E0C01C16DBE540EB8FC9747148990E9F08D8951A182FD13962205E548E52D18E5D70
- MD5 SHA1 SHA512 TLSH