Analysis
- max time kernel
135s - max time network
151s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
04/06/2026, 06:19
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
android.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
android.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
android.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target android.apk
- Size 6.2MB
- Sample260604-g3eh2aby2n
- SHA256 9efc2c854988df935ec57dff1acbf9cb04cdb259b5b5a5e75bd4b8ba61996db0
- MD5 7eae40105999d34fc7963b2a96b3e6c3
- SHA1 d248b7c79b1b64418353ef9b2b9f9460dbaf2164
- SHA512 a4089653d5391664f4db508a0ba23b05dd96811dc4049e1d955038a0c861000acc07a0ceaea73bb7400e3865160c6a0904f9c5ceac9a5d0524bca08d112bba19
- SSDEEP 98304:T44xf0zGpsnLc0i97DCfAtaIF0robT7usDt0uchQVzQ14GlEoraL5D48ftRr1Wh8:T44HpSy97DKRo/7usBbch5n2oGLSh8
- TLSH T15A66F19EF7689A2FC87710B20C6A5231125B4C1297875763696C371C78BB6E80F8DBDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener co.median.android.nmjpqpr - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone co.median.android.nmjpqpr - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver co.median.android.nmjpqpr - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo co.median.android.nmjpqpr - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo co.median.android.nmjpqpr
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/co.median.android.nmjpqpr/files/INSTALLATION
- Size 36B
- SHA256 976ef30db13d8b4f9cce76d848cfb5fdab5a42d5d27795d9424a4e81e468f723
- MD5 230c10a74e56cf6669257a8095ebf822
- SHA1 714c86a174ea6832e247abe90d04b99867cf046c
- SHA512 3a4005723a26f05f01746c6feb8659c0f2fbf8bd22c2ca4e506a0bfd008866f287c5b86b18bac6bb93e489f4354649826668d1dd26293394401bd3e58c270af3
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.nmjpqpr/files/gonative-config/regexintext.json
- Size 1KB
- SHA256 4bfac1bf3c58ce0b6f5ce5cc412783af4a7a1459c834085cdf0e0d158006e204
- MD5 af395eb8a8030ab86bf751d160ba0acf
- SHA1 f45fe380b11c24131175623d79f07c098d325d46
- SHA512 43f5e8737e8f04095d50d4257104460c826e2fbcbdcab7c460aaa94dea3632e24341230db0b5d4fd799b81030886204789398c3fbd66672154d09a586784dbde
- TLSH T1D041F474C9790DB399C82864B26E421B7A72615F2FD6391DFB8C162C1F4C5BF69B820C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.nmjpqpr/files/profileInstalled
- Size 24B
- SHA256 969dabc494fc1ec76625e6b7f1aa7b379bdfa3d705eb957b82573de2d65d97a6
- MD5 abfdbe375340cb49fd3ac5b53ddd1562
- SHA1 1e64f565999e52446a4acd424f0e769207cfa0a2
- SHA512 4e7fe4697812d352950ca28726d25e1f64f626afe6b024fd7af747b42d0a8b254d27fc5ce0309a3529b083a008c067f18a37875b7eada3ed76e1cb9d40806943
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.nmjpqpr/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 7aea21b28a783ef7ed94825ff3e8f3444a3c5cc9f2abb0c619d5227cf2c9bd49
- MD5 0b32a87ceea04e06cdc6fcac0e0be008
- SHA1 2bfee011c8a5d9cb73d009a10f8e22c80b374db8
- SHA512 05e84d3c3d3357b4ac2f121ce69bd40393d0144075c2a706604e728a973173110d117e0d350eb71f8b54e189c37ad7e3c5f68d455401c8a5ee03b5fa02d5c2e2
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/co.median.android.nmjpqpr/primary.prof
- Size 1KB
- SHA256 ad604b9ba6a1b9e7cba4c43dac6246ad05a08c34d4613dba8ea0e8a1c2c7eddc
- MD5 ef3b403df323556ec3e0cded4fc3fbde
- SHA1 0d06367d219007446791fe5fd01e2bdb68876a68
- SHA512 37c258b2b45db5c7d3ffa4c5e2222e2206f62ad922ba75bfe4ed01e93ad3c56415ec4b456ba7d20e8e1d0a8a09add36edb0c8b2ca26e00b494d72f6492cece9c
- TLSH T1BC412A098BE0DE36A647A96CBAC5381F6B40F0C66E4E943609AF03198C78A612918C96
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/co.median.android.nmjpqpr/primary.prof
- Size 5KB
- SHA256 0f7511c38fab10f70e775e0eaf08c17063a757199f81f98945ff2ed57fc049d1
- MD5 777774eb4571eda53268de566f23cc09
- SHA1 654a2d263f9f21873fa51d2b60be97cb52001fc6
- SHA512 3c931ce76c2a8fc772144cb6099ea54c8b869b711d5b7a9490a07c985dfddeb466db77ec25d7ddd6fbc697659b09eeac20a9ccd93f4006ad014d5a23da71909e
- SSDEEP 96:cek6UsRs6xLZ0uoYQlmnqffLIcJuVi0I7ufYB55zD7oag3DM2TFmf9txUBJtKBKJ:ktsSyV07lmnWIcOO6wr7AtRmTxutHfVH
- TLSH T17AC18DB2C694341537FFD29141A723E366C9199071E63E28EF60BDA4AE4340B5A2CC7E
- MD5 SHA1 SHA512 SSDEEP TLSH