General
- Target tv.medal.recorder_5.15.2-534_minAPI26(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk
- Size 238.0MB
- Sample260627-kzvbvsav6p
- SHA256 64952f027cf31f77142ea60986cd05277717763ca47f763899acb1b6a250d4f7
- MD5 ae29b8c72d06296c21f9585836831750
- SHA1 5bfcafd58d0d25f95f945a85f6d26828f497ddba
- SHA512 7f3078076c4a7cb092743a83ffddd680084ae7592743924a0b9d042fdea2e29017da1002fd5988145882fe38a5f0df9f4b490c89325d5337533a869ad5e7bc1d
- SSDEEP 3145728:+ii+ioLV/1L61NgiDL1/EY0OL5C/N5nSLN/mTfeChv:+izLV/1L61NrL1/50OL5C/NNSLN/yd1
- TLSH T13AC8E006F6468469C8B5A8789E4ED273F72538088F6292977A41FB143E777D09F3A3D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
tv.medal.recorder_5.15.2-534_minAPI26(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral2
Sample
tv.medal.recorder_5.15.2-534_minAPI26(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk
Resource
android-33-x64-arm64-20260325-en
Behavioral task
behavioral3
Sample
tv.medal.recorder_5.15.2-534_minAPI26(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk
Resource
android-34-x64-arm64-20260325.1-en
Behavioral task
behavioral4
Sample
tv.medal.recorder_5.15.2-534_minAPI26(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk
Resource
android-35-x64-arm64-20260325-en
Malware Config
Targets
-
- Target tv.medal.recorder_5.15.2-534_minAPI26(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk
- Size 238.0MB
- SHA256 64952f027cf31f77142ea60986cd05277717763ca47f763899acb1b6a250d4f7
- MD5 ae29b8c72d06296c21f9585836831750
- SHA1 5bfcafd58d0d25f95f945a85f6d26828f497ddba
- SHA512 7f3078076c4a7cb092743a83ffddd680084ae7592743924a0b9d042fdea2e29017da1002fd5988145882fe38a5f0df9f4b490c89325d5337533a869ad5e7bc1d
- SSDEEP 3145728:+ii+ioLV/1L61NgiDL1/EY0OL5C/N5nSLN/mTfeChv:+izLV/1L61NrL1/50OL5C/NNSLN/yd1
- TLSH T13AC8E006F6468469C8B5A8789E4ED273F72538088F6292977A41FB143E777D09F3A3D0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Checks Android system properties for emulator presence.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-
Checks the presence of a debugger
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
3System Checks
3