Analysis
- max time kernel
14s - max time network
153s - platform
android-13_x64 - resource
android-33-x64-arm64-20260325-en - resource tags
arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system - submitted
06/07/2026, 00:40
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Ellipse-Rocket-Pioneer-1.0.0-mod.apk
Resource
android-33-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target Ellipse-Rocket-Pioneer-1.0.0-mod.apk
- Size 193.8MB
- Sample260706-a1b7kagy21
- SHA256 7d597fe51ca0b3d9d96d5b63804b952573655c1bab3955c5aaddf4707e30fc15
- MD5 3ed213483cbc938207732e937dd732a1
- SHA1 d40e7dede4db3ef8288cb1a999682d5623a03341
- SHA512 d21e663b4186e001f03e8dccd9847ff7c12cd970b9cf288be6119eb371df820473f923866f249c16d167cbfa4d3318cbdd0068745c40777923bf3ce96015c278
- SSDEEP 3145728:8HTXLV9eq6KObVTFmVx7z+KCKftzPuWixURDSimvufVv70Vt19/Q:8XV9e/pmV5+KPkTxUJSimmJ7gb9/Q
- TLSH T1A2A823D2A5D94EE6E27B16341BFC3FFC70363EE09B55120D221AB5142FB72B62B20549
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.Astrelix.Ellipse/[email protected] 4256 com.Astrelix.Ellipse - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.Astrelix.Ellipse - Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.Astrelix.Ellipse - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.Astrelix.Ellipse
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.Astrelix.Ellipse/oat/x86_64/[email protected]
- Size 404B
- SHA256 8f95d75700810f1d8960e2a2ee693d44cfc9a2dc6c99363fbaeb80beaa2e6acd
- MD5 ffa8b6fb9adb2236bd7ec33962658419
- SHA1 e5f39ebd91563ea1d86ea2ea3172e2ef2dfeb092
- SHA512 d2a6506229ebf342380b2af5235968c7b27b5e7a483fe308e3bea7d3085bf57d81dbaf8a6561dddc9b99aa01ced5d109f7e0d74dea425f2a47e2c991b7b05b9c
- TLSH T18EE0CDB5F75D8A53D65C113C205EF083DA54C34AD716C622D8051DCD77C137115E1D15
- MD5 SHA1 SHA512 TLSH
- Path /data/user/0/com.Astrelix.Ellipse/[email protected]
- Size 8KB
- SHA256 460af80321f8410e688a8a3975b94c629e78b50f7d170894e41e3005b6b296af
- MD5 016617e60bff401854c47ec9d4d56b37
- SHA1 b6da861209b4fdeb2dba8c57511eb65b558c9131
- SHA512 30439f5bb51806fd31d4c2debfdc3032b01b252f08b463939dfc51d508b956344e6924b0546f2ec289477e8bedc2b2cd7d34dc80213da0f09b6946b72fa84bde
- SSDEEP 192:CI7ObQCjbgMTEdVgd06v5pKDBquUnqhOz:CuKbpYP4TvLKDBnUvz
- TLSH T109028583FB16DDB3C5ACDB7F646E135123B143411303535E8928C8996EC369A9B8EBC8
- MD5 SHA1 SHA512 SSDEEP TLSH