Analysis
- max time kernel
78s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
29/05/2026, 12:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SafePal.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
SafePal.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
SafePal.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target SafePal.apk
- Size 7.5MB
- Sample260529-pf2daacs2q
- SHA256 9dd14eb979c110800f3df18c8afab15d6ef575bba8a799863464edabad075143
- MD5 c51920fa7e57207b0cf9db927084ff1f
- SHA1 bc5d802a91be4d74726eabce688a57c76cd0835e
- SHA512 f18721f04bd8126e4f66dd40a841241ff26bb8dcf50d93d60b342cf84eef773cc47256b2eb4704338e4aa59f702504c01e076438111e3476f2c19cb5c77515ee
- SSDEEP 196608:4KE7f5D22RqY6daCUeRWwv63vtM7nnhW17c:XY2aH9C6FahWW
- TLSH T108860186F749D92FC437703249BA5731568B4C168E83D793A9583E0C68BB6D40F9AFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.trustmoni.safepal - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.trustmoni.safepal - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.trustmoni.safepal - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.trustmoni.safepal - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.trustmoni.safepal - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.trustmoni.safepal
Processes
-
com.trustmoni.safepal1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5091
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.trustmoni.safepal/databases/http_auth.db
- Size 20KB
- SHA256 e54dd1b963b06ed82b4aabf9fe03404e06ed1f2e511be949553f39535d59bab4
- MD5 df11fb20a99697a591d5b82315f43b16
- SHA1 8d20df8344a44902f467150dea59c83613406690
- SHA512 10c13f47c0472037d3fed766825fc54c52ac12d9b69763eb1bd1fcd509ad613b99e09dcea4dfc17f57fbed0134106e4d2a1a5362587daaf6aae70e13b6a608cc
- SSDEEP 12:TLyKEwwR6YDRAXk3GMmJVMeNZ/tgVNRmBEyPbAVOw:TLy9wwRV6/MmXNZ6V2GSE
- TLSH T1B492F1C3B7745312C0086272C8D193C09FF5DA6F462AF78314F410547C43588B8B0CDA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.trustmoni.safepal/databases/http_auth.db-journal
- Size 512B
- SHA256 b9d3110de699cb26a283e5360f253af5a99e52802af6482d812ac412d25457ca
- MD5 17798ac4b25e5a0cb5eac7231c3f0515
- SHA1 e4ffb9fd42672f6898957b633559fa98643e32ec
- SHA512 cb1429e654aa81ebdde440427fac5d90c8b4d14f34ba58387bf1542ea710827f12a8d018b1a05ab8bb15550f949bf342d4f8b758b944a5d521f55f3d3fb21844
- MD5 SHA1 SHA512
- Path /data/data/com.trustmoni.safepal/databases/http_auth.db-journal
- Size 8KB
- SHA256 5486696df4a96f6525661fb5f66c4e304a4653900e43b56cbf04a1d5d3726893
- MD5 12c107eefb82152397df67f0ee3a6da1
- SHA1 b9e24a48104ce5451a58ca49e3d7781ca810dcfa
- SHA512 e5e6d03592cce52efa7077035135247827a414c6ebcb75d63510f4583a6bfec1b8f7e188213ab3e9293105c4556fa1532ae7550ad72aa03104dec9fd79c73b48
- SSDEEP 6:7+/l9Bn1qpg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKr:7+tEqLiuWdwRmBEyPbM
- TLSH T12A02C08E63800823CC5D1AB798E683500D94F719C9F1CF17176008E8BC036CCE4A0D04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.trustmoni.safepal/databases/http_auth.db-journal
- Size 8KB
- SHA256 044dcaeec769d89c33305315554b734f62bfeabd7ea88f2d606369201064544f
- MD5 7a2cd20030d592318e6dc194eda81abd
- SHA1 6da0710fe607b5de8795b2f75ea0009b102013b4
- SHA512 d765f893d14c88c4b746ad3da49d0ab0d56302bcc1fa602fb707d218d9d0df1cc2b02b2e24a8f32868e7d20bccc56dd4a39afef2e08057d369b492c09cf78d20
- SSDEEP 6:7+/l9iHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKs70/J:7+tYvqLJdTRmBEyPbGJ
- TLSH T177021299A7420913C5196BB7E0DD83552F50A7199673CB5729A208A87C476CCE8A0D54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.trustmoni.safepal/databases/http_auth.db-journal
- Size 12KB
- SHA256 6154d9f3fd65227329860f6729e84828915e277923b9fa26469ffeae41211b1e
- MD5 5561d53992897c41a508eccfe5d96e75
- SHA1 ebddbf456b129fb3fbea1f111d04175d117c4be9
- SHA512 810f26b7d1fd59c64f32e99609495874639279a3c7bb78b9b6d59d81be42ad3e7c3095458050bd9024f9a8eb1c9def3caa1f31ed33c160cbe0f82cf3f91e7c03
- SSDEEP 12:7+tV9/qLm6wR6YDRAXk3GMmJVMeNZ/tgVNRmBEyPbJ:7+tV9qL7wRV6/MmXNZ6V2GSJ
- TLSH T11042ABC7ABB44722D0586AB2C8E103959DBBDB6F426ABF9304BC00587C43DC9A0F5CD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.trustmoni.safepal/files/profileInstalled
- Size 24B
- SHA256 fabd5088d8652a19f439ad3bfff7380f2057e4b8235d9390cd476bf44ed39b67
- MD5 9b05b1cec24cf50f30f85c2880e9a9f5
- SHA1 91c59c62784f918455e8a731c8f35e5e5d01e6fa
- SHA512 6f18892a97e020e128c1456bc9bbaeaa250747e47260eab1f0622ffe742d98c9d4d8d7c39c18f7f37e01b7c4b2fe5b0097d96341cfa4885681aee5584a84f788
- MD5 SHA1 SHA512