59e4a019d3449f5889fd28db26ff2f998a7af81092b26a9bd95b2ad1c55ef8ca

Analysis

max time kernel
93s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
01/07/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
maycash-1.0.4.apk
Size 7.8MB
Sample260701-g3tmyshy21
SHA256 59e4a019d3449f5889fd28db26ff2f998a7af81092b26a9bd95b2ad1c55ef8ca
MD5 d1d35d1b4d0cfb8a5c6f3b83c12d39b5
SHA1 98e4eadb2a86d991d6b0131a0b69ff08a86e8f41
SHA512 d065f42ecba5314387a4fb258c5d0b71331ade8629d1b4e2a257d7bd253483675b7e5e480a1cb8ae844649fb746be5fcf8c7045784bbb0936dbf9a21219652bf
SSDEEP 196608:xQ5nI2qWu7DKRo/7usBbchlgg8QrgIQgi9Iyadm:y5wWRo/nBwzJQgiyyv
TLSH
T1A386029EF71A992FC87710728CA5523312574C12A68357B37978331C78BB6E88F49BD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4763	co.median.android.mbdoedq
/system_ext/framework/androidx.window.sidecar.jar	4763	co.median.android.mbdoedq

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	co.median.android.mbdoedq

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	co.median.android.mbdoedq

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	co.median.android.mbdoedq

co.median.android.mbdoedq
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4763

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

INSTALLATION

Path /data/data/co.median.android.mbdoedq/files/INSTALLATION
Size 36B
SHA256 e314720d2d48ae27a82cfc0e811fbc0474b9277224676ff6dc1240d1b13e388a
MD5 4e24ee378a3a451afcc102825f3afe60
SHA1 0016049e1d25f19afe8f1594dfae9c8a05270d21
SHA512 17f53e3352aa0df13c6041d9d357395764b42d16c92cbda01023bb65884ef4a05bda6a0ea615fca7ef19831a2037b49a4dad826d39f7302bb07b423aa5984823
MD5 SHA1 SHA512

Submit Download

regexintext.json

Path /data/data/co.median.android.mbdoedq/files/gonative-config/regexintext.json
Size 1KB
SHA256 3aa41c17f0f6e74689a69377a9069f851b2d3ba2a4dd9558457909d8703f72de
MD5 c1672f822c972e1bdab333ab4a143221
SHA1 6e311ee5b4a71ba396f27831569d072cc054d652
SHA512 2a13aa4499bf75f784b299700d9a9345e4b2d8d7bbb1554c63c77295d82e2888ba055309b743dd875c1bc9075e91fd132cb31bbb72786c8dec7a5875e6467f2b
TLSH
T188410274C9280DB398C82864B26E421B7A72215F2FD6391DFB8C062C1F4C5BF69B820C
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/co.median.android.mbdoedq/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 4dbb1524581e6ea16ae3a367cdccdd11fe37c912bfd12c1497623bea8a34a5af
MD5 516a0c84bf8ba348883f98244c5e3989
SHA1 a011fa1378e5fd43b4c1c2cb30c7250c470b791b
SHA512 ef93bae240166829cb8b807d7c0b05150ca65d33d94871034a7a8e16bcdc113b6ab5af6a179780d7d20603a8340527a23a40e263e1f933720d146727e857f210
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/co.median.android.mbdoedq/primary.prof
Size 1KB
SHA256 99bf39902a2a76ac90518493480a37072ca6d9a464fce9078b84cbfd268cce41
MD5 125a99410890d798992d13425d407bf8
SHA1 2a2d92c2aa4da7aeeb9e380da3692930923a2799
SHA512 efa83c5e529cb7b1417a9e9e4f77e53b81748565ed9c7bd1807eda7b19a1654167d6abea7da5a5c619028fb60565ba47e9a0faac36659f079bdc4cb6b4397624
TLSH
T12E4119978409518F92D03F73E5E850A64A8AA43748ECD868713F89FAD4CE908791DB00
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/co.median.android.mbdoedq/primary.prof
Size 4KB
SHA256 dc79be95f9c0164d1a599c0aba666e21edd979c274ca69d695fc0d45d6f84fe7
MD5 9216ebada8a18e98849df4d6ed574d5b
SHA1 a8bca6bcda14989f78094da2a18ddb4cdb5ef64e
SHA512 55fe776c6619439dbf00ea82aab2b975d2c8d9d3ec1a83006534e9a81cc381440452c3d8cebc37541c742062b57bd6412f50c6ee3c3bc4c592f05abb3ef27123
SSDEEP 96:6wku9SOi8Jdy9it6OIGQmi2QzJZAYq7r3h/vU/7spmpq:5ku9Sj1OpNi2KHG1vUTs4q
TLSH
T1B8918E5B034AEF29DB1920E19CDD5A0AF93A312D5741428E5801FBF49462FCC18B7786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads