Analysis
- user interaction
yes - max time kernel
2s - max time network
82s - platform
android-14_x64 - resource
android-34-x64-arm64-20260325.1-en - resource tags
arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system - submitted
26/06/2026, 12:42
Behavioral task
behavioral1
Sample
RTO-E-Challan-500.apk
Resource
android-34-x64-arm64-20260325.1-en
7 signatures
150 seconds
General
- Target RTO-E-Challan-500.apk
- Size 14.4MB
- Sample260626-pxt1jact2n
- SHA256 860b79ec3a237149b42c9c4756cbdd96b27d68fcb782b101c25d3bb506636b3b
- MD5 e477925826f9a99575a80bd4c60edda6
- SHA1 2eb34d1d5daf626e6c684f5bea63adb86b9b35a3
- SHA512 577b7904f2552421d2e096f8af72bb6a9a2791b27e10455055e2a7e0038d78689795af59c22aa09f3afede2dec75d63dceb8299e81f973c1a0f5e6ac3a6f0654
- SSDEEP 393216:Seu98GjSi5yEidv7+UgSfJOQ3gLzXo+Qi8h5MAW:1uPSi5yEit7+TSY0gLjEM7
- TLSH T185E622E7BBD55979D432A0B1982D27A5655B9D208F179B4BAC00371C38F72D83F88EC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
description ioc Process Accessed system property key: ro.product.model com.cyr.gujslzcrdciz - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.cyr.gujslzcrdciz - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.cyr.gujslzcrdciz - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cyr.gujslzcrdciz - Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.cyr.gujslzcrdciz - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.cyr.gujslzcrdciz - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.cyr.gujslzcrdciz
Processes
-
com.cyr.gujslzcrdciz1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Checks CPU information
- Checks memory information
PID:4403
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.cyr.gujslzcrdciz/files/PersistedInstallation1278127390294299951tmp
- Size 114B
- SHA256 bfe8081db9cb0ebd0fda3f48caf16d3d32a5d109233c6d9413e841c16ea510b2
- MD5 f39ba2a0c72b49a6a6eab2caf2e775b7
- SHA1 a81fe859e710438a2ad354148fcf82cd7231a304
- SHA512 28c86db6aaf27a0f0bd2ce3a8eeebdb1fc1797c7b76274afd69c649a3414ecec7ef55278c8e427619e9c4fee1676b67f20ad701185e0c95c7c837684cd72c4d9
- TLSH T1F9B0120407B8A98AC78EF3132C2D91653EDA18C40D0E8F054A0CE455E09C2DAE613EA4
- MD5 SHA1 SHA512 TLSH
- Path /data/user/0/com.cyr.gujslzcrdciz/files/PersistedInstallation3817463349018176680tmp
- Size 90B
- SHA256 e47eab9458a60fd94c7d244757ddc3fe2b1cfd682fd880b4e7fa135a71695fe6
- MD5 6970600d5ba4ad3b4d04dc0f42477d95
- SHA1 c66c4e5e7154adfeeab1c30c656c11017b1dbc67
- SHA512 89d5a66abc1b5e7ea7d49e7736b646f6a1d3339a4ad50cab122ef2e98d81d1648f3ec5f920c3a62fcb044f98b6e742524a4c39690064052fe7bd0eff81209b84
- TLSH T109B0120046B05186C6CDF2132C5C91412D4418440D0ACF050A0CE090C1851D9E113994
- MD5 SHA1 SHA512 TLSH