1d410585e6fdb74097d96e484ace3ad7116fa99394cacfeba34d84515e67f338

Analysis

user interaction
yes
max time kernel
145s
max time network
149s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
02/06/2026, 09:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Spotishka Web v1.0.0.apk
Size 2.1MB
Sample260602-lzqjcaaw5w
SHA256 1d410585e6fdb74097d96e484ace3ad7116fa99394cacfeba34d84515e67f338
MD5 611d8fb5db6b90e4bc3af238f3c85abb
SHA1 5628a54a722d8bbb5bba25b674589884de804c76
SHA512 4028c43a9c8ae589e045d2751688a00fee64af062ea4f326af8486aeeb483ea354bfbd4455c11c03d9d5b661e02033aa4249e49b3c014b5ecf216c38a4059df8
SSDEEP 49152:chC9QoLcXj+/Cz3R2PnxA3gu73KKoYSfWH:chC9sXBj2673KKDH
TLSH
T17AA59D4AFB48B96EC4F343360B7582AA21174C264F43D79B6945733C98BBAC44F56EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion impact phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	su.aprelteam.spotishkaweb

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	su.aprelteam.spotishkaweb

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	su.aprelteam.spotishkaweb

su.aprelteam.spotishkaweb
1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Checks memory information
PID:3354

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3354.tmp

Path /data/data/su.aprelteam.spotishkaweb/cache/oat_primary/x86_64/base.3354.tmp
Size 132KB
SHA256 17e9770428637b5e5b8c6dbf5c60be9df21bd5d947b4e7aab3f8953b0cf47393
MD5 93e9c0efda460da658e994fe077eb88a
SHA1 a5f6851a21fad98a4f9a70f18e5fe07738144c27
SHA512 fea12df9eade305c9819a60eee3ddb62dad322fa7647b8fb8831e26e7219b200f4e4c9ae407b64e61baa82dbc0870197ac0a47b4f711bd805a1e9c618e17e0b4
SSDEEP 3072:WTlvOlAhpxZWCSMPYrm0DEGq4pQ0MTM9j:SZOmhDZWCidIzTaj
TLSH
T1C2D3295FEA629051C1E7AEF7D78B56ECF92D8025134E2D0094717B7EA02AE11F760FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/su.aprelteam.spotishkaweb/files/profileInstalled
Size 24B
SHA256 aee0d67cb3da22f5a03c2bc5bfde0deb238a465ba46d533025606f20340ad220
MD5 7bef63ae5365321960f89c809c5e2775
SHA1 a35aa9c32ed3dd31196f214a604815747ea6e1eb
SHA512 a2888d0e84ca6ad57c53a6140162451f95f67e89b6956f2f42bda86888ba67f5b269166a5f98b846993a2329e8864f579c5c49b2f13ec89828876eebacfd5549
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/su.aprelteam.spotishkaweb/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 850416cc5eb2ea2f5372598144b948b29d8f1c6b84d794a24a513946dea4b3d9
MD5 d412586d3ecb2201b480e00f23927cbe
SHA1 4a0aefd4abf95b1c04640d023a56a1064662ae86
SHA512 93afc6c98e01fc49f01cae477769c529302fceedbd32d429d1eec69f60f89d72416e35c41eb568b43b92b8f80cfbcd41d0cf51e932a0092bba7ca951db1e7735
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/su.aprelteam.spotishkaweb/primary.prof
Size 1KB
SHA256 2fab532eaf773977282854fd3064b1ed7fd51b0b485ec95a8fbf9a89744dbf1f
MD5 35d303bcf5b8c537e8cad8e0248d1df1
SHA1 a2f0d27b651e3ce4d466bc6598091663f13d550a
SHA512 0e0f66233572e75f34e5ee851e13380db9986277697f37efc72beb1f6b001ca2241fed065daef2cd046aa55e0071bef01afb5e27f1eab1f91217805bcfa99af3
TLSH
T18F312BA4CFD626E2DC0E0D3A1E9A29E176B843C063D756B65F8B8012B8143D86E12250
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof.goqWDn.tmp

Path /data/misc/profiles/cur/0/su.aprelteam.spotishkaweb/primary.prof.goqWDn.tmp
Size 1KB
SHA256 30457a7e896cc844e94842a8a79b546137926d0c87925176a3070445c095b47b
MD5 bfea593fdacbe919eff0ef1aa414b40d
SHA1 fae5c4b89897a38f4032604d8ed0ccec4dcb212b
SHA512 ecb5c92a6b01cc67f30cffa02a6ab601cfb82bc3d6753d70fbabcc38c73e4db28531e2acc33549210fa29e5793d10eecf5fa12cdbb77a127df9eeab845ac4203
TLSH
T16931D70D897D12F3CE735EB9DF990C14240641C6F0F2E4DB188926962900FACE74AC9E
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof.wv96xQ.tmp

Path /data/misc/profiles/cur/0/su.aprelteam.spotishkaweb/primary.prof.wv96xQ.tmp
Size 1KB
SHA256 48779224a5bfd5dd3476bae31392d6f83d7efb199a8699cf2eb0d5949d8b5abf
MD5 6fe716041e0c2fceae2f1ce2d2a4fa4e
SHA1 d837d9b52a829918743eb4296077f726e3174edc
SHA512 a48a42452e3a8e8668dc613c30ff7f4685f1301941f933fb2a588b7b2abc00059287df5708ba8d702b68e176de679f5e6fc88dc3ae79effde1ca03ce68d5547c
TLSH
T13431E96D4D9634D6C4192EBB5B965E62A2133CD3D894E6C7038C26042C30FE8934F9AC
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads