Analysis
- max time kernel
51s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
04/06/2026, 12:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
update.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
update.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
update.apk
Resource
android-x64-arm64-20260325-en
3 signatures
150 seconds
General
- Target update.apk
- Size 4.6MB
- Sample260604-ph4leset8y
- SHA256 da13908a196f13c98b62e7cb7f000e2193d63b95c3a42ad7cd957c3c12dfff03
- MD5 25b4ab6ee1049b1eeee03f1f97ddd1e0
- SHA1 3c185f296cdf08889218d4b5552689584ada5336
- SHA512 31ef6f161da41b31f422d9b03d6d7535636c05b1d49572c2062d450280f7b6ac59874275fda031ecd805280b4b3ece6b92808fdde7611e39a3ae43b656eae267
- SSDEEP 98304:Knpe1G508FBksa8dagOG4qe4AoP6uoTYrXWe:GM1G5bFusa8daRG4qe4Aoee
- TLSH T1C926F1C7FB98592FC87710B689AE52B156578C138A83DF436C44361C687B6E82F4DBC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.example.sidhanathpay - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.example.sidhanathpay - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.example.sidhanathpay - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.example.sidhanathpay - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.example.sidhanathpay
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.example.sidhanathpay/files/profileInstalled
- Size 24B
- SHA256 25a4fdf75711a6a81cf88f67982e342d93f674cf156a8abcbcbbea1a984f9c7b
- MD5 ab8855d5ab30e956ce26efd91c6ed528
- SHA1 532c25168c8b616345b7abed9396f53be479683e
- SHA512 44e31bcbd37cbabd89ebe1eee35aa2dd0a61e104240de2540b4e632a4582683fb509f596cbf589cec55017912a4850d19e1ac4f42d5ee04aef1bffff0bcfb229
- MD5 SHA1 SHA512
- Path /data/data/com.example.sidhanathpay/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 b921dfaaa7127761e67c981b3d5cc7e237cb607e290200b08934744d7792628a
- MD5 b59c4376965151a4a8f04561c9f52b25
- SHA1 cf462dc417bfebf004c2effd7ed9c77eebb2d955
- SHA512 87596ad9111d033ef932577ae0ef3a4dd9bef4424b5281a8ce4ae7adab8acd8fa8aa0f36afc2e5a3a12d38d629be7ce0ee95aa43e1de166735aeae45867c2982
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.example.sidhanathpay/primary.prof
- Size 1KB
- SHA256 be959eae3be0830014b3c02285924b930e3a4af6a8b0f00820dfbb566f08fadf
- MD5 2e660bcd8343abc7678997ac41664f96
- SHA1 388ba8b059bf0295f2711e1f1eb010798e939095
- SHA512 432dcd1bfd0e8ad0b26e12048aa796f61821da83fa515927182a35d67c6b2c0519c01dd7e9cc44f4c5769a71b5051f4eba6eb7c04f8b4f035a3f1731df484db6
- TLSH T18B310BA45B40D5BD1C4DB7ED984F71470B9330662FF51E43E2784931849C6AF49F8509
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/com.example.sidhanathpay/primary.prof
- Size 5KB
- SHA256 5f3849b62937ede70c193ce275bc1de68f486b5adccff93871325010772280cf
- MD5 17af9dad6768befe56eb7f762d60a5d0
- SHA1 86e40d2aff5e6ee05442b5a3cc3f5ac25ae0a1f6
- SHA512 78ca657bd777f33c3af8e710e1f629fa473c45f8cb57e2ee3a63d934e0618cc2537c1c23c835bc8289d6a7a604ce43ad580659fdf7571820a1791773a340bbdb
- SSDEEP 96:aYYFVvDfWvCU4zrnXtA5KAGrqmXLzk6NfZqbQIRrf3ngNIKfCX8:sFVTWvCUX5KAGrj7zk6lZavgNIWCX8
- TLSH T1D7B1907978961E47252631E147BB41DA005F4CEBFD8D143A7B924AA531C1354F6B58A0
- MD5 SHA1 SHA512 SSDEEP TLSH