30b0b3b0d4733f3b94517ab4e407214e82abf6aad3adf918717ff842e28d672f

Resubmissions

05/07/2026, 16:46

260705-vaej8ahy2j8

05/07/2026, 15:24

260705-steyzsc1918

05/07/2026, 15:24

260705-ss2rcsc19y

18/10/2024, 17:22

241018-vx12qsyfng8

Analysis

max time kernel
46s
max time network
150s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
05/07/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30b0b3b0d4733f3b94517ab4e407214e82abf6aad3adf918717ff842e28d672f.apk
Size 3.3MB
Sample260705-steyzsc191
SHA256 30b0b3b0d4733f3b94517ab4e407214e82abf6aad3adf918717ff842e28d672f
MD5 12bd9dce0c25eef1cfb47a35d998a179
SHA1 3067221875ac9093d0b2efbff4c2fd6e1616cd8c
SHA512 aab5889ae6cd0d146a7eebf6bd637d789b59de524f414f65df6828a9a3e3ea593c3c74d0eb6e00002f81a3821f69fba21e484f4558479d9b4030c70ed6b0ba42
SSDEEP 49152:RPY4HEHIyICHVBwr+ItQlZ+0VxSUe8cQiF/C1TCbKopU7VoJhR4B4IXOIquUDPt5:VDHKIy9oIggzAC1+Qi/+OIqRDrkjnK3
TLSH
T1FEF50292F7C9E86FFCF7C7368B75865E46468C168B47E2834954323D09B79C04A86EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.motorlu.vergisorgulacalc
/system/xbin/su	com.motorlu.vergisorgulacalc

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.motorlu.vergisorgulacalc/cache/1582435991586.jar	5020	com.motorlu.vergisorgulacalc

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.motorlu.vergisorgulacalc

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.motorlu.vergisorgulacalc

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.motorlu.vergisorgulacalc

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.motorlu.vergisorgulacalc

Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.motorlu.vergisorgulacalc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.motorlu.vergisorgulacalc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.motorlu.vergisorgulacalc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.motorlu.vergisorgulacalc

com.motorlu.vergisorgulacalc
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5020

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1582435991586.jar

Path /data/data/com.motorlu.vergisorgulacalc/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
TLSH
T1C412AEB4BF77093CD0DB0DB8CA67E800A05F25841AA7D514E0656066BFD47B5F1E315A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6A4A7757030B-0001-139C-492A66F2BFB5BeginSession.cls_temp

Path /data/data/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A7757030B-0001-139C-492A66F2BFB5BeginSession.cls_temp
Size 77B
SHA256 4ca854b95aa9f2549b68fc97043d98eb3c3b7b70de087df703bb1d935de8e0da
MD5 9d771fa3105774610854eba35920b9e3
SHA1 793a8ad1d7cce40c25abcfb69940aaa7d211e4fa
SHA512 32f5a359e326c3aa5a12865ee53c680aefd6adecef1d89df27f6336862941bc0e92479e48f588cbfa2c98677ec405b7117d3f3809a81aac0fbde418256223c04
TLSH
T1F0A012080210251686958390F634E51014E010443D718608042542003B414860041D80
MD5 SHA1 SHA512 TLSH

Submit Download

6A4A7757030B-0001-139C-492A66F2BFB5BeginSession.json

Path /data/data/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A7757030B-0001-139C-492A66F2BFB5BeginSession.json
Size 132B
SHA256 c40cffbc97382be27839aabd56895eb57c33a4fbc095fa2adf757c7d08744574
MD5 546b8e05a67909caad63991b4b6e0124
SHA1 3d42ba3ab60cd5dbf622103ddfd9f37bff0f80d5
SHA512 97a3a88753e7a6d5687febe81b242fcf76f99444863f0e8ecca4ad4777de6d7084a376b14ad642e10c7104d207037eadc2f92f10ccc990a9f7978bb3ea2d5210
TLSH
T17BC02B2807D0243440A2D6478639EE3009F113087A21C94D24F8420C6790C41400BD80
MD5 SHA1 SHA512 TLSH

Submit Download

6A4A7757030B-0001-139C-492A66F2BFB5SessionApp.cls_temp

Path /data/data/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A7757030B-0001-139C-492A66F2BFB5SessionApp.cls_temp
Size 122B
SHA256 64d9b7f4ee54096e4d3682666cecdb93f63e86774656861d2678def74650dcd4
MD5 18d1c3821b8c10e5f496ab2fe99b1377
SHA1 43cf19ac7560497d6ee3a188b42a212b07e8e3ff
SHA512 95c0c773c9fab0bfde18655c0aa26f614d901bf28b9ba8e65d1b1271f0d6be23d09b0bd5fe040971d4e9f385676c6987452ae008f76d3f8bb1577e644e814c60
TLSH
T16BB02B407CBDDDA3218B25C0C7C1001990A940C0C040D33002D12333D4850D61509103
MD5 SHA1 SHA512 TLSH

Submit Download

6A4A7757030B-0001-139C-492A66F2BFB5SessionApp.json

Path /data/data/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A7757030B-0001-139C-492A66F2BFB5SessionApp.json
Size 236B
SHA256 c22902f536fd42798d0b011f1dbe2e812bc5c55ef10e7116ee657d366fa19947
MD5 9b1ed89b695e1533a7a288b0ceb6fa4d
SHA1 7ab44df2ed379b9bdecaf506e9093d568690aadb
SHA512 0363389f1225739871a5791576a9c81545dedcbabbd11c5a1df66b61cf022870f56c28b643883d0dc0fe159043ce942e92bb14424ab486918764de364204f0a0
TLSH
T123D0A7107DAEEEF7259F5BE4C785042543FC00E0815463741B951A13D7929DD1A09949
MD5 SHA1 SHA512 TLSH

Submit Download

6A4A7757030B-0001-139C-492A66F2BFB5SessionDevice.cls_temp

Path /data/data/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A7757030B-0001-139C-492A66F2BFB5SessionDevice.cls_temp
Size 49B
SHA256 8103c28e4cddc0f3581e6189c4fc01bdce57c4c4ed292222989d5d1f765fb20b
MD5 f83ff1dc2a108a27dadd3915c8f94d79
SHA1 ecfb7d8fa462c12b2ebadf780fc3614eee556795
SHA512 21d70f9305b2b1a6a44063a8a082f8e315e9c750e9b63b65a9367d23d56b88e836a44c01be4b257b3ed1d5cc804bbef05a80090c25bc73051ee327521d5a0a8f
MD5 SHA1 SHA512

Submit Download

6A4A7757030B-0001-139C-492A66F2BFB5SessionDevice.json

Path /data/data/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A7757030B-0001-139C-492A66F2BFB5SessionDevice.json
Size 203B
SHA256 ad84853a5603914d57ca3bcd4979a64c35a750e0be0b504f10dc92dc17ec388b
MD5 f77bed0ec0b300fbe7bcaad8b9ecf32d
SHA1 91b3712d3b7f3882757ebbd960f1aa445a9ca90a
SHA512 b07bd03268a46e7db99082c8df639166e5e4290202ee27b517c86ed4957e1864a08609373ecde55fb1fb3934d432361223760e00e49985e990a2fa08e0f5cb5c
TLSH
T110D0C9B5EC7E3B6F5BD1F1C45C225FA3BC6508342A88796060F88D55194B89493A9429
MD5 SHA1 SHA512 TLSH

Submit Download

6A4A7757030B-0001-139C-492A66F2BFB5SessionOS.cls_temp

Path /data/data/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A7757030B-0001-139C-492A66F2BFB5SessionOS.cls_temp
Size 15B
SHA256 e78068dac7c1adce8676a309d60abb8be4d31ab3dd5c6bdce85284b7ca8e8761
MD5 2daf2b277a00b1d8fe4d9f2822d620ab
SHA1 e8c957a66faae7ec6109bfd3d210f1b996c5dfc4
SHA512 87765b53049b0be5b1de19b2fdfafde73c3b2d63882dd53c6aa29a70a1f8cce3a84a6301164435264aaad8abe842df72caacdbe3de8c23acf19c3445212f1fd1
MD5 SHA1 SHA512

Submit Download

6A4A7757030B-0001-139C-492A66F2BFB5SessionOS.json

Path /data/data/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A7757030B-0001-139C-492A66F2BFB5SessionOS.json
Size 56B
SHA256 64d3a7187919847c88d444cc98ef3c113a63e8d7ca641fb259f4e9d3548327b4
MD5 edff603af91e76da13b01041eab16104
SHA1 785720343098ab1cb15227cc831360a37b20cd88
SHA512 94a92f2af71409c359fe423f3fb5a8ea67944f2178fb0ea17aa847f3539e2324204c165a722ca301b3d088312b1c659cec7eaf068d5286781e58e771c7554fb1
TLSH
T1D69002769980A036101203545A555E51D7B014726045F0256857041113A71B84231109
MD5 SHA1 SHA512 TLSH

Submit Download

session_analytics.tap

Path /data/data/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Size 1KB
SHA256 cb974f0ffda36a3cd1d1f8a24f9fa171748530d070c67fa46eb4dfa93f93d8d4
MD5 70c6c44c416f13f569d93171b1e8f357
SHA1 a5e7a5b9954291fdd4016821c12df93359bc6b30
SHA512 ff79c12d667c6374c020782268b78475a9a4a27f77f2235a1c610a86fce9d6bb40c7beeca3964e4c0228f1fead7d34d4b0f6a5f3abe299f4804eea1a28d04f0d
TLSH
T1A221CD91BB5C9FBA120BD3AE8F65440612FD957A82D0D37C7B400738480F6C8112D52F
MD5 SHA1 SHA512 TLSH

Submit Download

session_analytics.tap

Path /data/data/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Size 440B
SHA256 4281338172eceea7c88d5e0207b931a00f576ce8d0e568faecc0bc42f7626422
MD5 beb153624b7beb33169ee0de838d51ca
SHA1 d6f04328b76f38eb7d3d196dc2623a44f4b95035
SHA512 1a4f2dba0a992fad8d94a69823c04d2bb668c802d532114cef9bd83432feb74e8ac2cdfeaaddbd31f97ae7d2a1f95c8ea84a6a4e19ecd68a6b2fadacd7a580fe
TLSH
T1B2F0A351675C4FBD5605D3BD9765440722FDD63F82D1935C6B410725455F48C012D637
MD5 SHA1 SHA512 TLSH

Submit Download

session_analytics.tap.tmp

Path /data/data/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
Size 16B
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
MD5 SHA1 SHA512

Submit Download

sa_a159070d-7969-4731-953b-90813f91970a_1783265112161.tap

Path /data/data/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_a159070d-7969-4731-953b-90813f91970a_1783265112161.tap
Size 354B
SHA256 669415c92f00fb86667a9e47a7d9ad5b40ce052aa525aacaf60d9c0d14cb7492
MD5 4f77d6a0a54d796fafea5959bebb3c1d
SHA1 6ed44be4c96fece7d40ace2c474021ac6a9e2057
SHA512 1836b4481453ea805960bc15aeed332b3e3c250d2bad133474e51720ea120c14bfd08ce59ae7b9218782d3ba67fc8938e3f549a415e1a441f5e6d5596595a2c2
TLSH
T1FBE0C0615E08C53DF1067230158D24086EA5F8789E442ED027D21D2B590C15E095B9F7
MD5 SHA1 SHA512 TLSH

Submit Download

1582435991586.jar

Path /data/user/0/com.motorlu.vergisorgulacalc/cache/1582435991586.jar
Size 20KB
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
SSDEEP 384:Za0jn+huC5sMvRuvypj6f2ZzJgm+poK+l8m4qxXpj/7wyxBLBiok+9VQ3AKm8:ZU5sMvu/f2/gm+pDAPzj/Dip+9y3AK7
TLSH
T1D592A457B3918563D57CCD3F3A3ED390EB20B210CA23970728459AAEBDEA3D525D1AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads