Analysis
- max time kernel
22s - max time network
153s - platform
android-13_x64 - resource
android-33-x64-arm64-20260325-en - resource tags
arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system - submitted
20/06/2026, 17:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Teardown-2.1.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Teardown-2.1.apk
Resource
android-33-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target Teardown-2.1.apk
- Size 5.9MB
- Sample260620-vr7bkaf16l
- SHA256 756ce1ce70dca354bd63ba6b19927f59385a6ba7325f3ccec7c19d53cc026f6e
- MD5 f41902e88d90c7f5614c7ba3c9862bcf
- SHA1 691f9e1cde8ce3bf1f22d60b66504478eea3ec55
- SHA512 99b876f58ae4a43d34d2591dcc251ae46247b3ae1a9d2751d0d238b59ee8ad5692cf95cf3d9bbe52e085f78989bceb1d7f2272ac504a9e0b88c075c8a7ce904c
- SSDEEP 98304:513IOFaS7DCfAtaIF0robT7usDt0uch7EEGwySyqe2Lm/Kr5FUxMg:v3haS7DKRo/7usBbchgEGwyQb/UxMg
- TLSH T14B56029AF758D92FC87710B64C7A527216574C23C7838B83AA58371C78776E80F89BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /system_ext/framework/androidx.window.extensions.jar 4155 co.median.android.xxrzjq /system_ext/framework/androidx.window.extensions.jar 4155 co.median.android.xxrzjq /system_ext/framework/androidx.window.sidecar.jar 4155 co.median.android.xxrzjq /system_ext/framework/androidx.window.sidecar.jar 4155 co.median.android.xxrzjq - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener co.median.android.xxrzjq - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo co.median.android.xxrzjq - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo co.median.android.xxrzjq
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/co.median.android.xxrzjq/files/INSTALLATION
- Size 36B
- SHA256 fffe25826d2b958ab802fd11ad3497c5a02304e16ab70b73215f9025f3554ec5
- MD5 96eb18e352ca6ba5524b945a621417c4
- SHA1 552185674dd4e280902385e607ba7ebc2437e455
- SHA512 6b60434c5879163e643f8a967da817dc911d7f91178b3582dcaa48a8d50c442bafacce83ae67f1ddeb4cbee09cffe58d5c8d7643b7e03939ab121f9fb1cf6442
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.xxrzjq/files/gonative-config/regexintext.json
- Size 1KB
- SHA256 d4cb0cd2dad5b28b44182532b095f2d5a4159fe13309da55467e7a38c5c89014
- MD5 29b4e3d5887ff15decf44573ba3a4371
- SHA1 a2fb64db1b8e2eac67e45d02b2ee0b7ebe747a64
- SHA512 a0cbc15d05fafc0e56e648ab6944bce6145b4f5f52235fdc07e17d6ccb0d9a6e93e3984b895745a661b9dc86860dea5958d82729875e97504bc72f75e50b1fd0
- TLSH T1C341F474CC790DB399C82864B29E421F3A76221B1F96392DBB8C551C1F4C9BF69B920C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.xxrzjq/files/profileInstalled
- Size 24B
- SHA256 ddd8be0d30e1ce5418fe0d7a6b3acff0c495e1799c61e17ab38f14c1cac029d4
- MD5 b92b574938c1e897b1803851d823702a
- SHA1 10fbc465968c09eee2405174a2a8aa4f74ed163d
- SHA512 154bc92288fbcf3e6dad51b0702149ac0bfc60c2fcb68ca506c13bd32a7ff692e0723c8753164c95519e32de2a3475b012a63e28758144f5121a6b3773f56f72
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.xxrzjq/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 5774d715e05f5100b4b3771b79f7e1e737e67de38d13bdd334fd2ab6623e82c9
- MD5 1670b6d2259ca30f0b310831483238ba
- SHA1 01a6a373a8056fc833bcac08002bd660f75275cc
- SHA512 e3cdd112f41f6dbe8b9b097799d5ae8e05796908d4839cc0170f270ebf7578f02f926f15932cc22d27558f069f228f2c2327bf9ef417eed1a2526186c7afb844
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/co.median.android.xxrzjq/primary.prof
- Size 4KB
- SHA256 ec5b71f37ff832ac671ebe3909d4b68f956572795bc9fcf6443f9c5fbd6cf618
- MD5 beb474e72b422f04a1f2c3fe817ac153
- SHA1 1845390e77aaddfbf9e1b8ce8d8cfe061af58fc7
- SHA512 a594c0d620151c6a5b71c8bd62182e7234e642561305e2613cbb8497e40598878352dbc303c25feb0f70836f391c9bd6d1ccefa9a3a6c6de4821c3974a9c7119
- SSDEEP 96:KHufRnJsstVBX49q3Vznel4ou0yGeGHrLKyey4kB22ESl:KOpnJsE4WVznel+PGLjeH2ESl
- TLSH T16E91AF870EB323D2CB721C38B1443291F564F22CA811478FCD46C65D5937FBA5E21006
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /system_ext/framework/androidx.window.extensions.jar
- Size 123KB
- SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
- MD5 3056e1bdb7d4e19789d0319eff484bd0
- SHA1 6791ae47aa9466fe0bca27ad6643f846853bbee4
- SHA512 c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658
- SSDEEP 3072:8Pmsa8v0v8FYNMhpjLXZ/pziNQdysk4p26PQ:Qmsa8vXhRLXXOQGJ
- TLSH T19DC31951FA4159A1DEAE933B959B1301AB30A648AB2383137654D0BCFCD73C39F87AD4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /system_ext/framework/androidx.window.sidecar.jar
- Size 25KB
- SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
- MD5 29469324e59dfcc052f24b5af4e7b2c4
- SHA1 10c1e17ac6f598037bb51baa07945663645de4eb
- SHA512 5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2
- SSDEEP 768:bjydnTmp8WNAupUuvkg5NrtsESOMXIpc3dRwQA0:bjydCpF0uhtsxOQIqdSj0
- TLSH T1A5C2F716E7400C63E9FF9A3B6A5B13009F35E3A4AA43471B640585A4BDC63D3D9EE7C8
- MD5 SHA1 SHA512 SSDEEP TLSH