Analysis
- max time kernel
146s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
25/06/2026, 12:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
KapalSlot.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
KapalSlot.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
KapalSlot.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target KapalSlot.apk
- Size 2.6MB
- Sample260625-pergpabv3y
- SHA256 f92f657ed6645a409c100699034953a69ff27e22c238213a9b138312b8cbab77
- MD5 ffe109e4bdbde7c296b5576f1fc83f75
- SHA1 eec19746d40a26983bcf354ae4ac3c747a191d6d
- SHA512 217776b3e017b1e80548ed539c44afcf4f9474028196e4d520a6b5f1dd8f4f1821a8818825c9c60a0ca25282187aa0d49eae93f2b7f3939b2181d13aa06730f6
- SSDEEP 49152:AxE1kqEWzGA4qzVLEix0bkaWUYTQTTdK7o2N4prS4c/nldSjCWg8YAnlbgP6UDW:hKqZLES0bk1UYETTUiW/ldVF8pl3UDW
- TLSH T14DC50182EF65D92EC8B7043B4DAB0331165A9E1EC592974788EC362C68776D80FD9FD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.p4d_kapalslot.app - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.p4d_kapalslot.app - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.p4d_kapalslot.app - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.p4d_kapalslot.app - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.p4d_kapalslot.app - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.p4d_kapalslot.app
Processes
-
com.p4d_kapalslot.app1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5057
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.p4d_kapalslot.app/files/profileInstalled
- Size 24B
- SHA256 f2c2f89ee3b1fe5a63d5f77872b3678e2cd3801e2ecb43963fad71ad6f0b3f83
- MD5 31795efc0fcaae7e69907ff17a4c702e
- SHA1 965dc761b66b17cc96d45a53f68c36c911b7b086
- SHA512 4a96b0f437bd43aee8efca7379db3e4677436e2ef68e4cb24519df332ebcfefe9239307e804c0ddb2f26ad4a0bf4227949ab1f1a2baacaf6041baa148d8edc9b
- MD5 SHA1 SHA512
- Path /data/data/com.p4d_kapalslot.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 da638e069b86855c6a95fbe6278de40d8d2445963772c2385fb06c7eaec33c05
- MD5 45984c8f1496ed2c206ac66e3910a4a2
- SHA1 2dfee6c28a1be1b0d58cff38128137b2998365e9
- SHA512 f5c926ce7bb732f6b4fdf4187ab4913f93a69b495496a160a3fbd4288303272fe9367e2ecaba354c87925564760b2359ee97b94dc8d13545cbee7ee8742d2231
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.p4d_kapalslot.app/primary.prof
- Size 2KB
- SHA256 a973d73059993ff6402470055f2b4ca158ba3c5d0b66b2af774f4c26225d12c6
- MD5 18ac5c6d1773462e76cea75253e4b97b
- SHA1 f7347d4c2ac8ab8baf03b7db73a87dd74c5a47b7
- SHA512 8bfac8b4d104ff81b6d3b9185aa74bb26b6d6b0bcc17b1fa1f15cf484a6116677a333c8c626771778873422902d4ca5c617d31d3cd56359c3bdc20ddb2464361
- TLSH T155414BE7663B38745CD19852BC9B48E428A4DA1B1C79942EC58EC8808306B7BB388E60
- MD5 SHA1 SHA512 TLSH