30b0b3b0d4733f3b94517ab4e407214e82abf6aad3adf918717ff842e28d672f

Resubmissions

05/07/2026, 16:46

260705-vaej8ahy2j8

05/07/2026, 15:24

260705-steyzsc1918

05/07/2026, 15:24

260705-ss2rcsc19y

18/10/2024, 17:22

241018-vx12qsyfng8

Analysis

max time kernel
26s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
05/07/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30b0b3b0d4733f3b94517ab4e407214e82abf6aad3adf918717ff842e28d672f.apk
Size 3.3MB
Sample260705-steyzsc191
SHA256 30b0b3b0d4733f3b94517ab4e407214e82abf6aad3adf918717ff842e28d672f
MD5 12bd9dce0c25eef1cfb47a35d998a179
SHA1 3067221875ac9093d0b2efbff4c2fd6e1616cd8c
SHA512 aab5889ae6cd0d146a7eebf6bd637d789b59de524f414f65df6828a9a3e3ea593c3c74d0eb6e00002f81a3821f69fba21e484f4558479d9b4030c70ed6b0ba42
SSDEEP 49152:RPY4HEHIyICHVBwr+ItQlZ+0VxSUe8cQiF/C1TCbKopU7VoJhR4B4IXOIquUDPt5:VDHKIy9oIggzAC1+Qi/+OIqRDrkjnK3
TLSH
T1FEF50292F7C9E86FFCF7C7368B75865E46468C168B47E2834954323D09B79C04A86EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.motorlu.vergisorgulacalc
/system/xbin/su	com.motorlu.vergisorgulacalc

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.motorlu.vergisorgulacalc/cache/1582435991586.jar	4760	com.motorlu.vergisorgulacalc

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.motorlu.vergisorgulacalc

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.motorlu.vergisorgulacalc

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.motorlu.vergisorgulacalc

Checks the presence of a debugger
defense_evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.motorlu.vergisorgulacalc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.motorlu.vergisorgulacalc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.motorlu.vergisorgulacalc

com.motorlu.vergisorgulacalc
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4760

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1582435991586.jar

Path /data/user/0/com.motorlu.vergisorgulacalc/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
TLSH
T1C412AEB4BF77093CD0DB0DB8CA67E800A05F25841AA7D514E0656066BFD47B5F1E315A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1582435991586.jar

Path /data/user/0/com.motorlu.vergisorgulacalc/cache/1582435991586.jar
Size 20KB
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
SSDEEP 384:Za0jn+huC5sMvRuvypj6f2ZzJgm+poK+l8m4qxXpj/7wyxBLBiok+9VQ3AKm8:ZU5sMvu/f2/gm+pDAPzj/Dip+9y3AK7
TLSH
T1D592A457B3918563D57CCD3F3A3ED390EB20B210CA23970728459AAEBDEA3D525D1AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

6A4A77570317-0001-1298-1800588991E7BeginSession.cls_temp

Path /data/user/0/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A77570317-0001-1298-1800588991E7BeginSession.cls_temp
Size 77B
SHA256 2595449c0c7c47ca5f187637c93c8cf16c161c3e1b77c997652a8dbc3373c577
MD5 1ca575c7e9a9bf63e1392bbc8b40a195
SHA1 e76240b41673ad13ae7a13f81f4b48435778d6cc
SHA512 5359f1c739e9c0b55ab506e2b39224aaed7a35ac1d1b4cce8fc98ed24d1853a2b663b415b4ebd90ae42495da21d0ff21682993be71f0e408bfd753de13535a87
TLSH
T12EA0125012042817D255C358EA18C300165550844773C105047287801A508458042EC0
MD5 SHA1 SHA512 TLSH

Submit Download

6A4A77570317-0001-1298-1800588991E7BeginSession.json

Path /data/user/0/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A77570317-0001-1298-1800588991E7BeginSession.json
Size 132B
SHA256 21d5c2e36e22eadc4ba1e6c919e79369336e7e4c9c01efefd0ef5c388511b7b0
MD5 15d6921a0d4383609f3977b0c3235119
SHA1 0b2903fe750d68d4be2092ab17e93c77903913c5
SHA512 8ed44a4c77fd7d9f30b962b4d29d9ccdd2a520bc0d3d66edff0ef1ddbface7dee85abaac383fc6bd16c0e58d609562bef65214c85baa656b6c6572279e8880d0
TLSH
T1B1C02B3017C0283491A2D70F8B1DCB200AF7534C9316CD0A38F5031916A4D01C00BE80
MD5 SHA1 SHA512 TLSH

Submit Download

6A4A77570317-0001-1298-1800588991E7SessionApp.cls_temp

Path /data/user/0/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A77570317-0001-1298-1800588991E7SessionApp.cls_temp
Size 122B
SHA256 14a1056178a8018ed8451c04883d856f54b6ab98ca1e6b43f8dbb37da3c0a347
MD5 4d83a24693212ed2f10154d91597b190
SHA1 308fe99d4d49ade2a8fe4ca00d3e5bb41f7d921d
SHA512 4b5b5e1964c6bf133c444a82a6705760281c5ab4fd34e6f727926761e028c642cddc74ef9512eaf1a1073ff4ad9d900c475172fd30cc31e03c4ddf43fca7f8bb
TLSH
T1D3B02B81FDEDE096144B099DC5022029412510C0C042E0700241722350C3891550C113
MD5 SHA1 SHA512 TLSH

Submit Download

6A4A77570317-0001-1298-1800588991E7SessionApp.json

Path /data/user/0/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A77570317-0001-1298-1800588991E7SessionApp.json
Size 236B
SHA256 8ec19f969fda50ef0e09d682a1792a18f7207ecea2c404ee87841a60ea803f82
MD5 d53582f7edaece66654a22582ff6a0a3
SHA1 4da349ae7fa5838bd70dcdaa8b02a5ac781cd7ab
SHA512 09e7e93caaade6b108f81a67bf7a3667f43c1699ebcf5b54ac6237704565b80b6c639350934bcff4756f6b8d4ca0015f3877f835a3075bc89550db1fa718dff1
TLSH
T1F6D097207DEEF5F3250F0BD9C245102503BC00A0804172B027011A03C393DD80A08624
MD5 SHA1 SHA512 TLSH

Submit Download

6A4A77570317-0001-1298-1800588991E7SessionDevice.cls_temp

Path /data/user/0/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A77570317-0001-1298-1800588991E7SessionDevice.cls_temp
Size 49B
SHA256 ec664092a3596d487e39269cc43b1c24502473f0c666e4f91b808394a974a60f
MD5 9678ee05e2c1d8edb5b2d5bc5fd3bd68
SHA1 d17751c5903be86f5fb615e7c715d65af7ddc787
SHA512 fff577233d552938e5865d94abce6ef6520abdb6bb9e110ed97e7b380d902f2004487e25b207af4e4e71107155bc9f4e77f4f73cc819df973dc355755067b95c
MD5 SHA1 SHA512

Submit Download

6A4A77570317-0001-1298-1800588991E7SessionDevice.json

Path /data/user/0/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A77570317-0001-1298-1800588991E7SessionDevice.json
Size 203B
SHA256 17cfcb8518203529de6e288ea03820ab37b30b226e335de7ff507a0c4a945a23
MD5 865a53ac54cda762a66d4630e0987aa7
SHA1 0812a4001c55d991fc2ab5c4d23c43dcdba15acd
SHA512 c043b95709a32e0bb63c037d960b5202fda6b2611b9079b00fd3b98d5cde0319f906bec72aa5cdcc718d8ba06f9f5cda1c677a5fea36220487fa92455f84234f
TLSH
T181D012B5EC7E3A6F4FD1E1C85C329E53FC6008751A8C7D2060F59D59158F894939982A
MD5 SHA1 SHA512 TLSH

Submit Download

6A4A77570317-0001-1298-1800588991E7SessionOS.cls_temp

Path /data/user/0/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A77570317-0001-1298-1800588991E7SessionOS.cls_temp
Size 15B
SHA256 94db7df32f7024d43abbedd5433d0a39a8dfe652621d40e7647af527fb5a2150
MD5 8c751d367ca035ad56b9dc5865cf1780
SHA1 20b437badd375403a9fb008bc3174d6f2f257932
SHA512 f82774c2c74ef1527ab212c495cbbf55a0f21dbec8a0f9172f574ad0950762b8c45f19962da321b8297fb8985a23cb7d1fe77fe1b9535a27af952f3b2e328e94
MD5 SHA1 SHA512

Submit Download

6A4A77570317-0001-1298-1800588991E7SessionOS.json

Path /data/user/0/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6A4A77570317-0001-1298-1800588991E7SessionOS.json
Size 56B
SHA256 3a5df913db77290768c5dfbdfd65b218dfa34b7999441f5cc87797e4b65e445c
MD5 66dcd98f1fd5bca64c229cc972cfcd9c
SHA1 08e2eb6c7a4b34a5eba69d00099d5b30f1d84f94
SHA512 362e92c6671814ec671a70aa7df0f0a5138ad93cfa3b0e88736536ae838ae70f45012b373d2e77835cf33da17f83020aa62821a1b4a78c93ec38da94403cd8f1
TLSH
T1FC9002769880A036101203545A555E51D37014726045F0245857041152A71B80231109
MD5 SHA1 SHA512 TLSH

Submit Download

session_analytics.tap

Path /data/user/0/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Size 1KB
SHA256 d3afd5767db89f4d21968151c8ca970f1ca4ed08774609e01ded2c1a29a35fdf
MD5 ad07b1fc02571acc42b0ad14089aa4b5
SHA1 f7451e4439e9e65a6d9957b4179307656c374a21
SHA512 c66c20e7e69c30e5f3807d8f30fb8e57305ca7294e3a6a76f557c32de1cf708904ff08b21c0a2c5b5bd68d18c64fd409528e2e839108f5c3a7ac37dd30371309
TLSH
T1F331ADE1BBAC6BBA5307D37E9E15900616FD693681E0D228BB00433C444F598626E23B
MD5 SHA1 SHA512 TLSH

Submit Download

session_analytics.tap

Path /data/user/0/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Size 440B
SHA256 b75f4e7e3bc4de8eacbddc692a3d586489a944766160670fb1a4022498ce5919
MD5 bb8bd8cb48009a5484f4ee07b250ef56
SHA1 17a69ecd8fb9ef49aff7a26997d88547a4b4bd64
SHA512 26c2c923d55bacb74c50e80ec7a0161cdc4ffe922c0207e10db5226713a3fad54778e70ab875086a46a37f8251df94c059c30ae29432cd1d6cc31d476322d5f2
TLSH
T128F0ABE16BDD5BBD8601977EA929500126BDBE3682D2921CBB41473A009F88C626E332
MD5 SHA1 SHA512 TLSH

Submit Download

session_analytics.tap.tmp

Path /data/user/0/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
Size 16B
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
MD5 SHA1 SHA512

Submit Download

sa_c597792f-ed02-4d17-a5a7-11b2e143d13a_1783265112198.tap

Path /data/user/0/com.motorlu.vergisorgulacalc/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_c597792f-ed02-4d17-a5a7-11b2e143d13a_1783265112198.tap
Size 353B
SHA256 96a5c5363c78154ee68a5f305991264c21afcfae6cc61a7fff5992f0d7c5e92d
MD5 ef4ee502527edb8ef1c5dab1426a55a8
SHA1 ca1b835d0238d342047c0a13bae4e59b36f5ba2c
SHA512 f6f0fd08c98aa90f3dcfff8023bd9b872e43d263efee20de86910f75d2d3f32ba8f5157bb02e66e69a1988a32ea0bb7d40c35afcefa17254fe95e2d1b9996660
TLSH
T124E02D2F44AFF46BC19481BEB6476868383E38012EF93458C1B360020D2B1613B2EE58
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads