66862840fe94e763eef5db410acfa8edc9b6400d1fbbded554b14923f3b11bf2

Analysis

max time kernel
63s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
29/05/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ag21-v1.0.apk
Size 8.8MB
Sample260529-pd9xmsbs8y
SHA256 66862840fe94e763eef5db410acfa8edc9b6400d1fbbded554b14923f3b11bf2
MD5 ffa961fbaa782b91e166d86021f9708d
SHA1 62e4ae90f5b58536f514f270b40e0303b07b90b6
SHA512 0fc75bc2dd3b5abb56c3967f065c42bc5768ee7474df60615169de38044af66d50b5531cb71535088d2ac8abb01febe5cee8c7b3e185c50e25f20234d4df8db8
SSDEEP 196608:Lom9L5QkIDrnbYplx73qskUlUb+yMUyBY+LO/PMQu4Ssw:UI4bYBOXUWtMtBYjHMQuiw
TLSH
T1B2962308FBA99F5EC833D0728D0A6635585AE963C303C787D8781799258FAF04F467E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4971	com.ag65.mobile
/system_ext/framework/androidx.window.sidecar.jar	4971	com.ag65.mobile

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ag65.mobile

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ag65.mobile

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ag65.mobile

com.ag65.mobile
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4971

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.ag65.mobile/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 5f33f6670c6e01e0d9aac4c42900ff4f7f8d8cba382f4867349e9258430e4095
MD5 f68e8a65fc73a74f0b79e3264d13df6e
SHA1 02bcb116f3269c2d21065f70b69410dc2f9b6ba5
SHA512 7f751208a6ba13b69df8a6445b14bdbbb2da4b5127beaceedc6c3518fac220dc3e393ec207afab12a8a59de5ce4448a0b93c8c4e54e86d66fa1f66cb955fced5
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.ag65.mobile/primary.prof
Size 10KB
SHA256 44d6b5f7d03b9b77cefc849b2f63a012bb919e4918062d7caacbd4137567958d
MD5 c80b29050263b73ba8b040dfb3f4df47
SHA1 73fd6923b1e23c4f479a23e1ccba346e2c0fe640
SHA512 5228f1ca3557c039fc2a3dc994598b162f4868d49ec2f140aca7d702db569f169e359002901b405571e532b30486e8342b8035b5913aa54f5242f56bb9f7101d
SSDEEP 192:4vta5ix5U6NQahR1xFzGVpGVngy6wy1MJwPo4c101lUARg/4Z/1To5RLekhlkN+f:4vtuix51NQan1xNGTeg5wy1MJCoo1Fgb
TLSH
T19B22AFF0B57267FE08114282D564680DA74738A3A44E9C9D3EF3227D9198BD8B445FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.ag65.mobile/primary.prof
Size 11KB
SHA256 bb3bdd5b8deb432fbbab4e4e32bb91fdf2df10ffdc43604450fdc7df502a717e
MD5 d044f5654cdfc2d367e934b9a9d5dd10
SHA1 53f64db02424d9e09c4b6ac1f35f0b2be4d400ba
SHA512 df3dd8b5d00c433583cce71335f8e137445843d69ae29114e064bcbe8d9485c76c6d90c5d482218c9496c6338d8135cd827f7d61daba12aa633aa936f0dac61e
SSDEEP 192:tDddZeRVHGEogF1/Dee9EUgDqnoakL6ontxo+siSombXwPYRscAVzoGPQO52ELeC:dddMqc16e9EUgDqoLLxFsh7TwwRhA2+j
TLSH
T11632B0B7BF794284FADFE5C32D0568C6BA82DE390824611DA9098FC5C2018E4D35B665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads