9efc2c854988df935ec57dff1acbf9cb04cdb259b5b5a5e75bd4b8ba61996db0

Analysis

max time kernel
131s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
04/06/2026, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
android.apk
Size 6.2MB
Sample260604-g3eh2aby2n
SHA256 9efc2c854988df935ec57dff1acbf9cb04cdb259b5b5a5e75bd4b8ba61996db0
MD5 7eae40105999d34fc7963b2a96b3e6c3
SHA1 d248b7c79b1b64418353ef9b2b9f9460dbaf2164
SHA512 a4089653d5391664f4db508a0ba23b05dd96811dc4049e1d955038a0c861000acc07a0ceaea73bb7400e3865160c6a0904f9c5ceac9a5d0524bca08d112bba19
SSDEEP 98304:T44xf0zGpsnLc0i97DCfAtaIF0robT7usDt0uchQVzQ14GlEoraL5D48ftRr1Wh8:T44HpSy97DKRo/7usBbch5n2oGLSh8
TLSH
T15A66F19EF7689A2FC87710B20C6A5231125B4C1297875763696C371C78BB6E80F8DBDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4773	co.median.android.nmjpqpr
/system_ext/framework/androidx.window.sidecar.jar	4773	co.median.android.nmjpqpr

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	co.median.android.nmjpqpr

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	co.median.android.nmjpqpr

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	co.median.android.nmjpqpr

co.median.android.nmjpqpr
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4773

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

INSTALLATION

Path /data/data/co.median.android.nmjpqpr/files/INSTALLATION
Size 36B
SHA256 1b76d86024a6f8943fe7f59b12d146aa20ada88995602da322dae481e4616321
MD5 fc5374463643a3b04902da8831959e2d
SHA1 63f376dce68d23d525284d1bbb7a3d37d2de4d6b
SHA512 b97a21bbc9dbf2dbeab7581601fe29990adc47af29d1f165a40f690a899b78026c2877c6d697e7dae0aea677937752d4b7adf623326ee2481a0feb7b6560212d
MD5 SHA1 SHA512

Submit Download

regexintext.json

Path /data/data/co.median.android.nmjpqpr/files/gonative-config/regexintext.json
Size 1KB
SHA256 4bfac1bf3c58ce0b6f5ce5cc412783af4a7a1459c834085cdf0e0d158006e204
MD5 af395eb8a8030ab86bf751d160ba0acf
SHA1 f45fe380b11c24131175623d79f07c098d325d46
SHA512 43f5e8737e8f04095d50d4257104460c826e2fbcbdcab7c460aaa94dea3632e24341230db0b5d4fd799b81030886204789398c3fbd66672154d09a586784dbde
TLSH
T1D041F474C9790DB399C82864B26E421B7A72615F2FD6391DFB8C162C1F4C5BF69B820C
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/co.median.android.nmjpqpr/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 80c4d54a02b7bdb117b9df99e80b9994f0ebcfeb42ce4da5fa43f05300f07f0c
MD5 8ffdee9352d5906bdb22b52119a8b784
SHA1 02c1e45e09453b8f8bb3bfa75fcf630bb4d881fb
SHA512 798c09f44850dcdccbd41ef6ffbc071b7a6efdf5c7460c3034aae8a37e74ddcb15db0f8424691ea34f6e2642cc0ab02b8a558ec8e1facb889147c45bec3e7652
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/co.median.android.nmjpqpr/primary.prof
Size 1KB
SHA256 ad604b9ba6a1b9e7cba4c43dac6246ad05a08c34d4613dba8ea0e8a1c2c7eddc
MD5 ef3b403df323556ec3e0cded4fc3fbde
SHA1 0d06367d219007446791fe5fd01e2bdb68876a68
SHA512 37c258b2b45db5c7d3ffa4c5e2222e2206f62ad922ba75bfe4ed01e93ad3c56415ec4b456ba7d20e8e1d0a8a09add36edb0c8b2ca26e00b494d72f6492cece9c
TLSH
T1BC412A098BE0DE36A647A96CBAC5381F6B40F0C66E4E943609AF03198C78A612918C96
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads