Analysis
- max time kernel
71s - max time network
156s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
05/07/2026, 12:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ev3rly.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ev3rly.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
ev3rly.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target ev3rly.apk
- Size 4.6MB
- Sample260705-pe82qsct6v
- SHA256 8a833ca3ac2ed15c46603dd9e10c4b7ee213d0ca63d0f0f19299fdac31827a28
- MD5 4c2e9cbfc2e73e113ea2e70e9926d594
- SHA1 6e229a384e09f55300e786f955ac712516fa5d96
- SHA512 debbf0e11b4946d9f5b66241e5f342927945ae7ee46f8387e5f8f5c75da129dbd51e1b9b0bb705ac61983dd684d9b30c957a4d33a7eaa0ad8d8ffcabd74ec329
- SSDEEP 98304:mkueBTMYLoxBvK+XMwOVJCa1IGZeBiFRLuhWQd6qs0:mkNBDkC3uGQcn+
- TLSH T13E362282F7E59D2EDC3B89320FAB523046059E13CA83D70B9A58363C6C7B6D44E65BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.ares.eevee.audiobooks - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.ares.eevee.audiobooks - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.ares.eevee.audiobooks - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.ares.eevee.audiobooks - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.ares.eevee.audiobooks
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.ares.eevee.audiobooks/files/profileInstalled
- Size 24B
- SHA256 4797f3455f74c3002e95b748666948290fdfed9d59e0a3612d6813aa3ab974a7
- MD5 c1a2d6b896ac7a43a009a5bd93177fd4
- SHA1 cd6877146c45493b17911416bb164e2679db7fb5
- SHA512 684b7b3d18185cbf54e8b177c6a92f4fb867de2764dc6c52d26aee5b4164d445be0e94aa7ba126e473bf2abb2110f3a551ac6b82eb0689d13bb4b77de110837b
- MD5 SHA1 SHA512
- Path /data/data/com.ares.eevee.audiobooks/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 3dd8a599650af2d97472f69ca471fa2ec9f409938209e5ebd5ba0b870a88509a
- MD5 a2c370a72dcf15a30758c9ce72bd37ac
- SHA1 17ac9fe24fac6081c7f6c90f87b9421ee6ae11a6
- SHA512 ae8ec9502ee8b7da236bcb3c30849b6f7213b812ba1f2ac3c395e764a6276932e09e50b9845b59800d92a1a17946c089cb453f42bccf7484a4f058d55bbb4474
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.ares.eevee.audiobooks/primary.prof
- Size 2KB
- SHA256 c3ce835d866a08f0e75f8f2545726f8e9346aaf63a6c3de6370de5d2487eea4e
- MD5 75294153963385bb2b3d7ccd40e6f8cf
- SHA1 880d72ded25ecce2a04de7641d244a6debae6a63
- SHA512 44877a8c3eff14c056e43492ee86439690e8928f06fc5d4133ecae8528e6cf9a8bc6180142b61072d71e52b195dd8e52be73b85816703678ccde8c5aa0b8a369
- TLSH T122514D8D9635037C1B2532BD5034845FF6C636D5041599E4BABB43DD9DF42000D6D675
- MD5 SHA1 SHA512 TLSH