Analysis
- max time kernel
132s - max time network
151s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
04/06/2026, 12:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
update.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
update.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
update.apk
Resource
android-x64-arm64-20260325-en
3 signatures
150 seconds
General
- Target update.apk
- Size 4.6MB
- Sample260604-ph4leset8y
- SHA256 da13908a196f13c98b62e7cb7f000e2193d63b95c3a42ad7cd957c3c12dfff03
- MD5 25b4ab6ee1049b1eeee03f1f97ddd1e0
- SHA1 3c185f296cdf08889218d4b5552689584ada5336
- SHA512 31ef6f161da41b31f422d9b03d6d7535636c05b1d49572c2062d450280f7b6ac59874275fda031ecd805280b4b3ece6b92808fdde7611e39a3ae43b656eae267
- SSDEEP 98304:Knpe1G508FBksa8dagOG4qe4AoP6uoTYrXWe:GM1G5bFusa8daRG4qe4Aoee
- TLSH T1C926F1C7FB98592FC87710B689AE52B156578C138A83DF436C44361C687B6E82F4DBC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.example.sidhanathpay - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.example.sidhanathpay - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.example.sidhanathpay
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.example.sidhanathpay/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 eeb0a100418fbbc78d7cb49f76fcb4bb616c575f749e8a4fcb11262389c6fcf7
- MD5 079c50384c4a5d6c695a76a1b388d980
- SHA1 1a2942434b5019f07161b444275ba41201b43556
- SHA512 e0aa45b417ea0624dcaed0e5810f3618f85f98d5b0204eb3799f541bcb8354d051595343c3c6095e17756a2894cf17fca8c0c9cb042d62e84a5a969a6c101339
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.example.sidhanathpay/primary.prof
- Size 1KB
- SHA256 be959eae3be0830014b3c02285924b930e3a4af6a8b0f00820dfbb566f08fadf
- MD5 2e660bcd8343abc7678997ac41664f96
- SHA1 388ba8b059bf0295f2711e1f1eb010798e939095
- SHA512 432dcd1bfd0e8ad0b26e12048aa796f61821da83fa515927182a35d67c6b2c0519c01dd7e9cc44f4c5769a71b5051f4eba6eb7c04f8b4f035a3f1731df484db6
- TLSH T18B310BA45B40D5BD1C4DB7ED984F71470B9330662FF51E43E2784931849C6AF49F8509
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/com.example.sidhanathpay/primary.prof
- Size 4KB
- SHA256 8c319bb520a4bcb41bc1fb2e1c448a7ab36e9844dda2e5ead1b8b3571b448e40
- MD5 0aa5dfee8a5b6973c588c845625cf518
- SHA1 035a3c25d08149de3677a6af6c0a5d13103e514d
- SHA512 9ad85dc0ef0b7aadd5446ea364ecae009dd1327e6a7a43f584f9dade61b6342bc3664fab759f6b219ecdd3854228604a404d673f11ec0eff5f72e1fc9d56bcb4
- SSDEEP 96:eMSrNjADhBwA1juo4hvhNC1KOPFCrfvIqr8krcUa4dgdHAChy:NREABuo4hvm1ZPFC7drxrcUa8zOy
- TLSH T144A16BE02B74C39F439178D7186E925EC57BC18EDC4283D781F85B4C96AEA0F4115A6C
- MD5 SHA1 SHA512 SSDEEP TLSH