Analysis
- max time kernel
140s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
05/07/2026, 12:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ev3rly.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ev3rly.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
ev3rly.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target ev3rly.apk
- Size 4.6MB
- Sample260705-pexnpsfz7r
- SHA256 8a833ca3ac2ed15c46603dd9e10c4b7ee213d0ca63d0f0f19299fdac31827a28
- MD5 4c2e9cbfc2e73e113ea2e70e9926d594
- SHA1 6e229a384e09f55300e786f955ac712516fa5d96
- SHA512 debbf0e11b4946d9f5b66241e5f342927945ae7ee46f8387e5f8f5c75da129dbd51e1b9b0bb705ac61983dd684d9b30c957a4d33a7eaa0ad8d8ffcabd74ec329
- SSDEEP 98304:mkueBTMYLoxBvK+XMwOVJCa1IGZeBiFRLuhWQd6qs0:mkNBDkC3uGQcn+
- TLSH T13E362282F7E59D2EDC3B89320FAB523046059E13CA83D70B9A58363C6C7B6D44E65BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.ares.eevee.audiobooks - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.ares.eevee.audiobooks - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.ares.eevee.audiobooks - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.ares.eevee.audiobooks - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.ares.eevee.audiobooks
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.ares.eevee.audiobooks/files/profileInstalled
- Size 24B
- SHA256 58485ffc4243f7125e3f181d150ed8a16f33c9641f02b4ccda8bcb831ad7016b
- MD5 0102f5ec8065e041e6cf24c89d963d52
- SHA1 60f029cca99e4ecc6f33c1a84d9290256b231f77
- SHA512 85b0a07f2d7881c88a7dcd338403dcdd1ee8b24d445b4be47d9215203d3f8b05fb72ecebcb3e2995be8debefc4f1eeef72d7b549387f1eb7bc3b4691d20553af
- MD5 SHA1 SHA512
- Path /data/data/com.ares.eevee.audiobooks/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 1092ef151676ef8cf713ef14e9498e58694e60dc095697cf99c501090b34f099
- MD5 ceae75963b6060173b05a82b253a1e2f
- SHA1 9727bd5fa9b903f9382cddf20cb752c7c24d2c87
- SHA512 387189b307daab392aa1886fcbbd977dcd9c8e85093280d4a53e91b2e23eafd2ee6470d215ffc6adf52f2f89b87aa4975df12f2f831ca31c0ba8f91b0fb79970
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.ares.eevee.audiobooks/primary.prof
- Size 2KB
- SHA256 c3ce835d866a08f0e75f8f2545726f8e9346aaf63a6c3de6370de5d2487eea4e
- MD5 75294153963385bb2b3d7ccd40e6f8cf
- SHA1 880d72ded25ecce2a04de7641d244a6debae6a63
- SHA512 44877a8c3eff14c056e43492ee86439690e8928f06fc5d4133ecae8528e6cf9a8bc6180142b61072d71e52b195dd8e52be73b85816703678ccde8c5aa0b8a369
- TLSH T122514D8D9635037C1B2532BD5034845FF6C636D5041599E4BABB43DD9DF42000D6D675
- MD5 SHA1 SHA512 TLSH