9dd14eb979c110800f3df18c8afab15d6ef575bba8a799863464edabad075143

Analysis

max time kernel
140s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
29/05/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SafePal.apk
Size 7.5MB
Sample260529-pf2daacs2q
SHA256 9dd14eb979c110800f3df18c8afab15d6ef575bba8a799863464edabad075143
MD5 c51920fa7e57207b0cf9db927084ff1f
SHA1 bc5d802a91be4d74726eabce688a57c76cd0835e
SHA512 f18721f04bd8126e4f66dd40a841241ff26bb8dcf50d93d60b342cf84eef773cc47256b2eb4704338e4aa59f702504c01e076438111e3476f2c19cb5c77515ee
SSDEEP 196608:4KE7f5D22RqY6daCUeRWwv63vtM7nnhW17c:XY2aH9C6FahWW
TLSH
T108860186F749D92FC437703249BA5731568B4C168E83D793A9583E0C68BB6D40F9AFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.trustmoni.safepal

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.trustmoni.safepal

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.trustmoni.safepal

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.trustmoni.safepal

com.trustmoni.safepal
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4783

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

http_auth.db

Path /data/data/com.trustmoni.safepal/databases/http_auth.db
Size 20KB
SHA256 4a6138e9cfc21bab57e76080ddf346c6cd30d4eba2ebbc15584e028f730b874f
MD5 204fb2b23647c18512c61649b73e0f6d
SHA1 9fd05e94fffb2544c57778017abe043ccfff9ac9
SHA512 f706839994c3504731c48c3156d0929ae09c2ca22b2b0a460d14aae143ecd2f426e8f01a7e19204fd943b20155d3c638fb865a150c92e3a7be4cfb3849ac144c
SSDEEP 12:TLyKLwR6YDRAXk3GMmJVMeNZ/tgVNRmBEyPbAVOw:TLyGwRV6/MmXNZ6V2GSE
TLSH
T1CA92ABC3A7645312C0185272C8D183809EF5DA6F462AB78314A410507C43588A8B0CDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

http_auth.db-journal

Path /data/data/com.trustmoni.safepal/databases/http_auth.db-journal
Size 512B
SHA256 c0273ff7d6fe555954cea1dad1596694b375339e08e2832bfaf34a2fa1769a37
MD5 ef471f83c2862135b60f974ab4a93c82
SHA1 b99b7652c76e95d3627298dcaf37752c4599c939
SHA512 04903ff78c2d45863704ac95a19df277488c540ad576bab58a0341f37c59bf02ff518fdb9392a8ea9cb6ee42ba40fa83521c1b733f54416793a168b568fccc3a
MD5 SHA1 SHA512

Submit Download

http_auth.db-journal

Path /data/data/com.trustmoni.safepal/databases/http_auth.db-journal
Size 8KB
SHA256 18e33ddfe97722be05f2d0df4f7c346f796d1dc06fc33d63960d28b5fff6785e
MD5 3470e0cf9287a463ba8f3b896cebbdf6
SHA1 c673ba005e16632d33c47a2774057e188befc0c5
SHA512 7d8c8426f5b2d692eac4f8eb66894f251f4379db30f20c57de865dfdcb24c580bec66f448eaba4983c6ecd2bfb6c217a3c79659866fd88bb298b7e41616c2ff0
SSDEEP 6:7+/l9Pn1Ug9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKA2:7+t0qLiuWdYRmBEyPbi
TLSH
T11B0222CC67800A12C8291E7B90E483600D14A728B565CB6716D208A4AC474CCB4A1D84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

http_auth.db-journal

Path /data/data/com.trustmoni.safepal/databases/http_auth.db-journal
Size 8KB
SHA256 f7adbdd1b0c0aac6c733b3c870c4f41ee28eca40c65f2670aa292aa9f75be535
MD5 f30d11618c7c41788c96e1c47963dc2c
SHA1 676e994042153d596424ce03d0b286b5b09f0c1c
SHA512 76008f9a405f1047a6fc169c9e326516b8c4dd2a38f1dd39b83006e8c650eb3e2d2eee724a26436437b0613bc844dfbd5363253ad9adb39f115e56aa164820fd
SSDEEP 6:7+/l9Z230FPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK79kt/an:7+tKqqLJdeWRmBEyPb8G1a
TLSH
T12702228863500803C12D7FBBA0C8C3811E10A728A223CB073A9208982C066CCA8D0D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

http_auth.db-journal

Path /data/data/com.trustmoni.safepal/databases/http_auth.db-journal
Size 12KB
SHA256 1fd6873540b4b70f39b6c7ffb07830279ad486e4ef7a39e0ac72ec2b4eab7707
MD5 cd931b9ba8db894c031d3dcd167217c9
SHA1 faf3f6f746d1a05cab93c962b63cf474d8c29281
SHA512 2942b5db020d1e0b0bdcd4a4c02dc91209059d9c8e83f3f5b7de5155dab1ef8d5d0d20144f0b5d77917b074cdfd5a897f892a32c179ad2925a95504df769dec5
SSDEEP 12:7+tYjrPrfqLmCwR6YDRAXk3GMmJVMeNZ/tgVNRmBEyPbu:7+tkqLDwRV6/MmXNZ6V2GSu
TLSH
T17F425CC2AFA40612C019A172C9A503809D75DAAE41BFB78318A810646C435D8A0F1CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads