43fcb5d765e9b83e0ae8c8ef0dabc140ea98543d28ed86f7c7d71f3170ca9b77

Analysis

max time kernel
126s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
29/05/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vastorapp.apk
Size 5.9MB
Sample260529-pgewnsbv7v
SHA256 43fcb5d765e9b83e0ae8c8ef0dabc140ea98543d28ed86f7c7d71f3170ca9b77
MD5 c671e845cd17feebe2707160c6da62fe
SHA1 d262dda27ae57bfb3601d89e0ea2d7e39bfa473a
SHA512 2fa9789fd1caab8e1a1de29be73387167ea00d0fbf0cc0f28d4ef5f35aabd9551fb86bb40423806b4a2d21eda8fc692372e8f365abb313d7d00d8dbaf0a71be7
SSDEEP 98304:j9r5KU7DCfAtaIF0robT7usDt0uchhBaZDgj4r41Tt0ryGfyp+:j9VKU7DKRo/7usBbchT8Dgj4bfv
TLSH
T1B856F19EF7199A2FC47710B28C76523312574C12A6435BB36968331C78BB6E88F49BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4767	co.median.android.odpjlrm
/system_ext/framework/androidx.window.sidecar.jar	4767	co.median.android.odpjlrm

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	co.median.android.odpjlrm

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	co.median.android.odpjlrm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	co.median.android.odpjlrm

co.median.android.odpjlrm
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4767

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

INSTALLATION

Path /data/data/co.median.android.odpjlrm/files/INSTALLATION
Size 36B
SHA256 b22333830bb4a4d7a942e47f5791c98171b5974c0b3d6af5a294b4922fcdb227
MD5 0429b8d5355817c8c64a44135ac78897
SHA1 0488c96c216f2713b3f68867487d8925ca022ad4
SHA512 cf45c5ee477cd5852f1f30250217e0413dbfa66173ea45a5c71dd20ebbc10379e473c8002310a3a16385d6c01dfbdfcefeea0bb1b009941373e041b8591e77b7
MD5 SHA1 SHA512

Submit Download

regexintext.json

Path /data/data/co.median.android.odpjlrm/files/gonative-config/regexintext.json
Size 1KB
SHA256 07a2eaf8c00a43b93041d9b86e163c2c4ebff4f046ca53df3e7d266d461826a0
MD5 2ebd3c67011155925972a2bc9d081dfb
SHA1 e18f943922eba5ce754c3fc2ef730bc73e034102
SHA512 a9e07d230d02707dfb3f064a9f76908e25a92883bffc1c6273fcec2b7c3069895848438231d00357794f697604b3be6288b48741b286478d960e5e363d4f4a54
TLSH
T15A410274C9780DB398C82864B26E421B7A76615B2FD6391CFB8C062C1F4C5BE69B820C
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/co.median.android.odpjlrm/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 0ce6bbf73c297d3f2f936f6e85aa9e43bbc59b5b1db501bffb92370477f4b7f7
MD5 27237b97a44ba6139ab98eeb72445d82
SHA1 2c820318f10b9d72c72c837db76fe74c69b76db0
SHA512 c65c60ee127e48f83f8435d76997154344c793411df0ff318248eb144339adc7a9b2f150f3e3acf89622e5d6cfdfd75ff2c97dbdb8742ce7dc7e19af512c9cb6
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/co.median.android.odpjlrm/primary.prof
Size 1KB
SHA256 a3fcabba4ad632e6501e9372f4f17ebe2f31abb236683a42c8cb65f465673ff1
MD5 e59bdc56719ae03d7b270730f599767a
SHA1 023ad1796207756d124f2766735a58e445a4fcba
SHA512 e6cd464e8338e59ff4bc5aba60c457638069ad31b7725fa217c26f249dab5be5c49f2692ec18f735d4a1eeb87003aa3fb1bd8a9c716a9947d0dd5119234ae33a
TLSH
T15E31FB19986EBDC6D13210F7BDE15A1A7701D7943D819FDC2D26A6C121C86E5580B8F1
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/co.median.android.odpjlrm/primary.prof
Size 4KB
SHA256 a3c33bbc4370883ebb0b5c00f6b1bcbc613e161202595b68427a6c733b3cd196
MD5 7bd6e71e18bd17046cf6a2009fa2e02f
SHA1 103446f8751087e98e646d285fabc563d3304f5f
SHA512 e4528a2aeb5e4164e5ba16172d5745631147ee1f0281b3bc0ea4dd7247fccc5d66e30a554ab21a4e00a3f06347e98b85d023448975bd7402c002fb9a36407847
SSDEEP 96:qLuqy4a3NKGf6I3hu3TcUrXaGlKzYWKOOVCCQC/cW/b9hNkZglf3Mf5zUq:qLuqnadJf6WAcUZu3IPQqnNkZGO5Uq
TLSH
T1B0916E650F667B32AB8D603FC19BA18214D776EC4A374EA0B41F0FA6CA65656D8010CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads