Analysis
- user interaction
yes - max time kernel
16s - max time network
303s - platform
android-15_x64 - resource
android-35-x64-arm64-20260325-en - resource tags
arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system - submitted
22/05/2026, 10:13
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
ΙCΙCІ Crеԁit Carԁ.apk
Resource
android-35-x64-arm64-20260325-en
6 signatures
300 seconds
General
- Target ΙCΙCІ Crеԁit Carԁ.apk
- Size 10.2MB
- Sample260522-l83v2abw71
- SHA256 d69b813ba7aa8914206991549ba2f8120d136af80d0e0a15f397653f454b089a
- MD5 e8f7728337b17c8c9597997ad7a894f4
- SHA1 152319ed36c52316912b04ccca5a295066e334d1
- SHA512 7c5c4bb8f294499dd1ed0629e8f641bedc7f761e9a6d64cf9f003f7e8acb61ece929a0d0a4cf3863aed280448f9b68129bc907e7932ef4f048cd5920a8a1c8dd
- SSDEEP 196608:LYpcQiVMjuJrmJnn1rBNKnhrq3CRWR4donryS9hsbl8CA6R1z/7Bxmv:cpHMJrmJn1uhHRW6+10l5A6w
- TLSH T12DB6330CDAE4482AD075B671E23B5F29226DBDBEF89399273D20B74DD13544C2327B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
description ioc Process Accessed system property key: ro.product.model com.qeuyiah.rlelctj - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.qeuyiah.rlelctj - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.qeuyiah.rlelctj - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.qeuyiah.rlelctj - Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.qeuyiah.rlelctj - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.qeuyiah.rlelctj
Processes
-
com.qeuyiah.rlelctj1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Checks memory information
PID:3394
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.qeuyiah.rlelctj/cache/oat_primary/x86_64/base.3394.tmp
- Size 16KB
- SHA256 c237b04c480cdd2df60ccac7eedd8d3529fc3898e684acda33027001803a1a29
- MD5 459428963d3c2ad4ec3db9ce6061d4c4
- SHA1 6a150e0e34ed614a4fd324df11803eaf6dbd54c4
- SHA512 d3ee99283d20df2f0a90ee24d9ab35c1aec670f52991e4931b6924d8094315eeae7089225096d9d85c93a3335cabc81c638baf0b77e5dee5d4ccdfcd1c37635f
- SSDEEP 96:RYNgISay3eFenY7FO0THsP3uf7oXj+Qz07YtBLGljdU5k5:RYNgIQnY7QWHsP3iGLqjt
- TLSH T15772FE2F875050D1C0E3B1FE97CA1620EAB702E14A193E0A9C76C73F7D14B145FA6B98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.qeuyiah.rlelctj/files/PersistedInstallation3257511603028057265tmp
- Size 90B
- SHA256 9f16f79f12673c7c7fe1265a9602c44b261a207156cc3a39bd53e1cd6f9a042b
- MD5 7aa30793441adb094b86710351a325a3
- SHA1 8a465d3c3a185c52d9ee09ae1668c84a75b64932
- SHA512 5206c91a6a5d1135472e254e6ec4bf6a788269eedfc799d1eaab2291eade9fe855d61c82896ded98b885c51f03034ef2107ee0b5ca0e8c81cf5f59005d6fb9b9
- TLSH T172B0124047309243C9ABA2031D4DB2405E8218C0080BCE194E0CD08001922DAA2139E9
- MD5 SHA1 SHA512 TLSH
- Path /data/user/0/com.qeuyiah.rlelctj/files/PersistedInstallation4124101438158575485tmp
- Size 114B
- SHA256 4054ccbe628db098a1b20f9a79f68c133411992f131eb9acb92440070cbbca87
- MD5 08bfff7d3eddb1de4e8d141501b6ccb6
- SHA1 2ef1cef09589b8bd3455ad3c32ee637821a6cbdd
- SHA512 5ddca3e9c0be14bb3c895defe5f63ee59944b7fc834dcc4acafc1ad683d4d99d029ccd8b119f5a799bde240494696a2a29c8c2154789e33a8f4a8f0c16f79599
- TLSH T1B6B092440738A6478A6BA3031D0EA2602ED318C0081A8E199A1CD44510A96DAE613AAA
- MD5 SHA1 SHA512 TLSH
- Path /data/user/0/com.qeuyiah.rlelctj/files/of3grwny
- Size 265KB
- SHA256 154975300a8e52f2b20b9c9daa94b43cd2da8ec982ee6f60039feae6f2287ee4
- MD5 6c3b46381673492e4968d2807dce6b0c
- SHA1 e1eb660495d2792ba23bc89c0b5ccfaa21965887
- SHA512 03e10eda42ed88d03ac63de14d8ae5af2e693b784b9f0f2654d308554c22a5ae0fde9b37871368dbb13d919120c4ddac457caf3c4ca46b938ee5b297ff0d8ad4
- SSDEEP 6144:BhGg8lY2HfOSRU5+Q6O+Y0SB0z3FFVAVWqtFeWM346zlZDk:BhPIYKf/RUAQ6O+Y0HLFFaVWqTeWMfvA
- TLSH T1E74423FFEBB49F1B4236AE6B88AC6D18385593171C4324EF61901929A5D9EDD2310F83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.qeuyiah.rlelctj/files/rn5jHQB4
- Size 13KB
- SHA256 bd191a4533ee1529e633fa8ed4741064ce48ae27e200183d229562c77e7b433d
- MD5 f676f2e06a64dd54bfeb06a8df97c7fa
- SHA1 d0545a1e74784790bc41ef0f44193dc728e23723
- SHA512 78356ab140dedcf0700e2ba72e67a7df6a832c1c5006e626d7912ce8953ff90b6076e49ead68c80f9b38eac34d932af8c853e979bcec39d0475d4ba22ff2cdcb
- SSDEEP 384:/+HQMXVlTSIKJd0lBZUZpkAbvjbmk/AJAo44V:/+vVlteZpnbvPmapg
- TLSH T1E4522A42E7F686AAF37317389F7243910A35FD664B77C73F00048A1DDC814909E9A7AA
- MD5 SHA1 SHA512 SSDEEP TLSH