Analysis
- max time kernel
148s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
26/06/2026, 12:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Sugih4D.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Sugih4D.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Sugih4D.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target Sugih4D.apk
- Size 3.0MB
- Sample260626-petbaaa12z
- SHA256 880aacad44a215d88d66c6a9d9bae43e4766fdfadad5a015fc224f2be16f7337
- MD5 706c209aaedced212a487a2efb3563b0
- SHA1 325caa8747b01c9cdd0252d8ce92ba0034ad2970
- SHA512 ff1e489b1f811c9cff291ecc3c1d4bdaccb06321f6d26ad95397c26b6cccefa2c504fb2447c4541988b2ac21b0e529d518502320c8c38a32a735f9bd8122d686
- SSDEEP 49152:pftTK4kqjZJjVLLys4pP2WyPQqlcPPEK5P5pZWJ/wCkdldwjCjLg8YkSAvlO1Fgx:pR51ttVXsPjYQDEK5P5pZWtEdnjM8jt7
- TLSH T114E50182FF65D82EC4B744374EAA0335261ADE1EC693970789EC36186C772D80ED9BD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.p4d_sugih4d.app - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.p4d_sugih4d.app - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.p4d_sugih4d.app - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.p4d_sugih4d.app - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.p4d_sugih4d.app - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.p4d_sugih4d.app
Processes
-
com.p4d_sugih4d.app1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5064
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.p4d_sugih4d.app/files/profileInstalled
- Size 24B
- SHA256 93deb828bfde428beb4c4d2dfd427bb1b453ae324f12dbb85ae9a073da28d958
- MD5 42f84cfa5d3847fc18c65db25f0485bf
- SHA1 0bc11eef574966e789085d7c107d47a5fa5e22be
- SHA512 d29b4568ba3b97459d87834436b71e6008ed45a4ec5cdd3e2573f70288206d9a7f668d387f1391f8318f60b6a14e599c7d0deaa11841d57e8f2bdce1b73f6782
- MD5 SHA1 SHA512
- Path /data/data/com.p4d_sugih4d.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 bc16196276dc528254d2a0742a8776c9cd0301f8e1ce0e4a4f7a8e46ce3e170b
- MD5 6cce1bdbc3ab3b432b5a0084df1cabc8
- SHA1 8cb918a7618158fc2d112654c44c6949c8c4869f
- SHA512 7343330b5bdeeea4b711e58d6725f090dc444e793b6923bfe14ae1a1a5c663ada783b1d8e8c88418675c0bf54bef9afd5777e392d02441f6ebcbc59239850d2c
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.p4d_sugih4d.app/primary.prof
- Size 2KB
- SHA256 54bc742c5bd77a255dd2810b242d08936e58ab0c1dc3912415be305b49df0238
- MD5 5ad578d874e85dc570f4b239432548f1
- SHA1 d752a5ee6e4bb295e3bcd1dca14fe76d798de9b4
- SHA512 a4ecea57031c0df67543a449ad186fcd18b8b84d40d21615a3a6f44badde9eadc2e16a166e6d9bb1bbd05979d6f63e283a99a5d9fe444f89057510e8de22a130
- TLSH T14F415E32D8D4FD147C257023A8244ACF12459297908C363C2E35FC67C15A16A8F75F7C
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/com.p4d_sugih4d.app/primary.prof
- Size 5KB
- SHA256 ce6b45109362275c518a7a6c8075ac04b35f41c5626aeff5829549ece1f00689
- MD5 b8ce4c9da4b16c452f6e769904b25cb2
- SHA1 e0e0ad6737c449db82f84184b8ce279d719c578a
- SHA512 b70ed0391a81cff418137a559f109546a7ff2c2f8e9a1034b2f669fc7b41a5d626d26ab72f2ea7a9b59d7a3725bd0879d1f06b925caafdcf11d8eb2d6987b1c6
- SSDEEP 96:vn0x3lkMxfyA28Hkhlwfoo69fKvoSHOK89XdgM9HsvupaMjXu2UIgoW8y8Eix33b:vni3lk4YhOk9SwSuKQgFxMa2qoU8z3uY
- TLSH T1B9C17E093D11198D1A6E0E9707246D1B75A72C52BEEB44F70CEBCE7318BBB6348143A2
- MD5 SHA1 SHA512 SSDEEP TLSH