e7761fca81056ad89b0a5c914cb75393f9aafd6562a0c58d65edbf86858bd1ec

Resubmissions

28/05/2026, 03:17

260528-ds6b8agt4v

28/05/2026, 03:08

260528-dnbl2sev7j8

Analysis

user interaction
yes
max time kernel
52s
max time network
154s
platform
android-13_x64
resource
android-33-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
submitted
28/05/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ABG_Holding_com_karolsevilla_guidenewsfree merged_signed.apk
Size 19.0MB
Sample260528-dnbl2sev7j
SHA256 e7761fca81056ad89b0a5c914cb75393f9aafd6562a0c58d65edbf86858bd1ec
MD5 98132625312bcf187d39db7f1e6f9a82
SHA1 02a55522683f909c12cc68208c2fd4f54b2c7859
SHA512 7482657d98a2156fae2d1cf5790e6bdaa065a2a01b493bd8521a4d10f4ef18f48103fd4cae54edca4e88fe854a44dd9555cb71f62335c6bb97fd43b75f51278d
SSDEEP 393216:BohP9A+M5JkH4dFNWXiwZE5CqRnLUUKfb/cf7c/eYU41pj0gzRoVaOCHY/Z096n0:BSP9A+MfkH+0Sdj9LUUAbkDc/eYhXjLn
TLSH
T1E11723517901898AE0360D3274E2391851444F6BDCED4BAB5EF1F67937FFE806D22A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.karolsevilla.guidenewsfree

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.karolsevilla.guidenewsfree/files/abghold.apk	4250	com.karolsevilla.guidenewsfree
/data/user/0/com.karolsevilla.guidenewsfree/files/abghold.apk	4250	com.karolsevilla.guidenewsfree

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.karolsevilla.guidenewsfree

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.karolsevilla.guidenewsfree

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.karolsevilla.guidenewsfree

com.karolsevilla.guidenewsfree
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4250

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.karolsevilla.guidenewsfree.v2.playerprefs.xml

Path /data/data/com.karolsevilla.guidenewsfree/shared_prefs/com.karolsevilla.guidenewsfree.v2.playerprefs.xml
Size 129B
SHA256 9b1958617ed977bb53bcd9f7a16c7bd423e89adf9beb0f60105dfd865d31f141
MD5 6399d119f41e3cb4ecfd9ae569a0731d
SHA1 d166654957e6141d347f00257e195dee8afdc238
SHA512 fb07f7c51bacee3b43db118b7f72a233e8a06dfe6c068dd7dc89595e5ff55b33e8c86d5d821c276d7b2e7d3c76c90ad89fac57518f2ddd7610000c0606cb1f1f
TLSH
T1A9B02BF0D0F46D5259C0080544201A4422753663020838C05C23B4300FA8240026E110
MD5 SHA1 SHA512 TLSH

Submit Download

abghold.apk

Path /data/user/0/com.karolsevilla.guidenewsfree/files/abghold.apk
Size 1.9MB
SHA256 a1b916b84dca54ab4f8e970139c78a39f8654f9c56aca20c6c3c689eef10760f
MD5 c6ff1633d47cf53e883ab0b073d4eeaa
SHA1 3c6e82dbd3040dba7d36397b17c683df555e1e00
SHA512 007fdf168fd9c1c4458befaf09c1f83a24fecd1ceb03773967d21de3aed5ef187133d555d6f099ad58704e2a3023b64a1301cc603176b1615afbe416dc9c0247
SSDEEP 24576:EZjdA+Iq01MUULh74ne04mBOywXAXQXUX7PYLqCa:Gj9Iq0SNLhMe0BBOyaK627PYGb
TLSH
T192956B03A7424DBAD1EE833E79BB07057772B608A7534726280DD9B5BC833C55B9DA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Download

goldfish_pipe

Path /dev/goldfish_pipe
Size 2.2MB
SHA256 6103f3f9768bdb3a9c74be150c799a770712e7ba1f26b30beeec7aabcda7ce25
MD5 0b47fa053c3238433f1bb4d0c003cf3e
SHA1 d49c10e695098fd6ca0f2e367dfe37af787785a1
SHA512 b537ae6503866823fa886ddaa7f4f53b25ef5789345fdd0df00d0a3946975291ea01fb9ff4f48e3b475fa266021f5df060da6e27ab26910f4d8300c0dedd39c7
SSDEEP 49152:P/+vvcZp53OqN0mwdaVa3LSSgjVaMklJOILNju7MUBpbf88+K0iqRr9y9nhiXo:P/+vvcZp53OqN0mwdaVa3LSSgjVaMklo
TLSH
T161B5D65239019985E4350E3570E6380411544FAFECFE4BAB6EF2FA79B3F9E41392264B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads