Analysis
- max time kernel
47s - max time network
153s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
06/07/2026, 12:17
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
V1A5bOPLszH6.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
V1A5bOPLszH6.apk
Resource
android-x64-20260325-en
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
V1A5bOPLszH6.apk
Resource
android-x64-arm64-20260325-en
6 signatures
150 seconds
General
- Target V1A5bOPLszH6.apk
- Size 9.5MB
- Sample260706-pf3lcaay7l
- SHA256 3f0ef7de595f88f8d521f40e707e8d302266f3555a698f03fff6363f36531b03
- MD5 7bd98a73dcbe2f8dfda3ef7e9fe7da61
- SHA1 1c5b364364ff07e62399fffe30f4b1bd71d9145f
- SHA512 bc30ed918f48b71fd7de92dd7a1b1b553ca49bc6cdbc018aedfdb07f88fb35db1f049722f088b6c044807f89680feba729985c59498bc2326346b34c815147d2
- SSDEEP 196608:9Drm4bAOjG1vyGSSu01Y3doC0RMy97WpViKD58aWs5Br:9fb2Vu0ooFMywpIKDbW4r
- TLSH T145A60197FB84A97AC4F3973108766322650B9C31CB93929B9950323C78F76D41E89ECD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.xkg.mjdpvo/[email protected] 5060 com.xkg.mjdpvo - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.xkg.mjdpvo - Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis
- Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
description ioc Process Framework service call android.content.pm.IPackageManager.canRequestPackageInstalls com.xkg.mjdpvo - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.xkg.mjdpvo - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.xkg.mjdpvo - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.xkg.mjdpvo - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.xkg.mjdpvo
Processes
-
com.xkg.mjdpvo1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5060
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.xkg.mjdpvo/files/assets_i/Google_Play.png
- Size 25KB
- SHA256 48a59feb4aa446c3c6c6343dc5163e127b4cf4609fbbbe4bdd1dcf3f0e5dc895
- MD5 862d282e3de9e4ad6e75572ac8c01c19
- SHA1 970d6879146e2b7155055f35c644afb11f7d448c
- SHA512 9b90dc3e27fcd25aac7c0fbcef1587cfe63c5ff1532b56829c80705d4cbba81db78f374ca977b61a23c27515d61a9392c038b29947e732aee43aa98b543f52fe
- SSDEEP 768:vt37Ml3lt2rPAIvAv1jrXf7hqTdzvm5t/5N8njmaVrV58a:137syrpAvBrXj2dqRyjzVj8a
- TLSH T1D3C2D05CF356A5F8395A006E686F9C585F08E2DD191193E880278F376DB19CFF2E13A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.xkg.mjdpvo/files/assets_i/b.apk
- Size 5.4MB
- SHA256 69f03c463b24aeb4feca658b0276bf0cb7da09ce150e8764b8bed78ff4a7b4f8
- MD5 7ebbbda21a8f2b74bd0edfbbcd48c41b
- SHA1 c1a7eef27e83fa7cd468d6b9f2ec8d530e22ca72
- SHA512 7ee7bc609c13e62d92cf60bf96681dde61e851e4ca1dc8e1f7fde3cede160072beceb7ee6288f8f9bdb5d79deb27e3281b20641e03ce09b013bf1ce42dfcf3fc
- SSDEEP 98304:f4MRAdVF+66tfWLUhDeJwGgLoX9cvO5St0IBYeYo/KrrqPbxLpnazw5U:f4MSg661NCVeN4St0E7DDazwC
- TLSH T18C46E057FB84587AF4F643B209366321E9479C268B539687A854313C68FB6D03F8DACC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.xkg.mjdpvo/files/assets_i/dexopt/baseline.prof
- Size 2KB
- SHA256 83c12efaf1b2338a1ae6899bbd543b19e01c0ba21d1130e72fb8a6868b2c409d
- MD5 059f3958ae58d8dd9f3dfb4785672a71
- SHA1 90a138e73d8a9b9ff99fae300474e28380230db4
- SHA512 996e08915a6b2c8affc29dc31bf60d0c0fd13638377de41fbfc58da088463b718a298965b0bb99e7fc5af9e3efe1178617e20371860b9c53ea39768bacfdef89
- TLSH T1E6515D172BD9A650C573D0E2DCCC12118B64C0F38FE805D6E0336AA4164E750603B467
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.xkg.mjdpvo/files/assets_i/dexopt/baseline.profm
- Size 240B
- SHA256 b17ef32451cfca08809c2044d28641f27323623ba9088e74e0952cccb0808a8c
- MD5 7469b1184098a5fd5f13940d81a53e94
- SHA1 2ef4ae059fb768ad5d141a2be6dbdd9362229d5a
- SHA512 61a0e3a653cbafb97fa305bf3efed8aa90c7567756231bf4751b2d7d40fdee1aabc791253c5e60ed61a2fe3c7e65477970e8804121a60f197578373893c7e321
- TLSH T142D095C438E4D3105A44B5D3407F977C714C0D79F40305454ACD031621E926343710E8
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.xkg.mjdpvo/files/assets_i/installing.html
- Size 9KB
- SHA256 be03a4c0b104170148faf6737b3a4d475f6a234ddbf2875e41bebb14c4e64526
- MD5 c37be0b1622c47106f3065b86d87171b
- SHA1 60f924c31567dc1546d7445b3f418de098d5b936
- SHA512 5d57f4884215f27be0481d8ab50820af266a63012a1cfd3830c950198b5d258e28f3887f5ac4be06c7324bf68dd8cf2ab46b84e2103b21eece3ace9e7e6b72d8
- SSDEEP 192:XXIYC0roWHbvGn3RvEV1cgxG5LiarAA2J3Mx4:oJ3dEVygxGli5Ae
- TLSH T1F012706A6191042189B7A7BE4FE31218FB6380535B0793543DEC1342AFB1B5849E3FED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.xkg.mjdpvo/files/profileInstalled
- Size 24B
- SHA256 af77061ebdc407a7457228b09a9ea7df7f4394ca9cd1dd96f6bf842b0a9a4521
- MD5 c0124bb3086fafa87162d051e74d12a5
- SHA1 49cd445896598a43eb92d46251dd5823c096c205
- SHA512 9b9de7d17216b25b48dedefe8a0a871e297745d451fcfc76b504ff25f6ecc7ec0e5b97c93979884e42ebc1edd5f1d28403a1f1966947230233b688f02627bf96
- MD5 SHA1 SHA512
- Path /data/data/com.xkg.mjdpvo/oat/x86_64/[email protected]
- Size 183B
- SHA256 5c0e206cbc9b18272d796b0f921f6c3fe10a25cb5ea6439f396c08dbb0fc79ae
- MD5 c166d07efa799676a4dcf5450d1475e6
- SHA1 4da1315c0b6b9057890c6d24019668a4c33bc622
- SHA512 8cc121e30fba26852c6486dd94afffc98b824f5a812fc8d7dc05b24737d1bb09779a712e9800b30b3133599444198d81e158101d53bbf3e4482fa5c722eeb825
- TLSH T134C0C0C3A7811C40C7CC3174078C06FC1C019CC7165141D03CE043EA7C230C0380420B
- MD5 SHA1 SHA512 TLSH
- Path /data/user/0/com.xkg.mjdpvo/[email protected]
- Size 8.2MB
- SHA256 5f7f892c1947ccbe4555d4f2114df3d1192a96bfd246d48d9c08ba0d12eceee9
- MD5 7b91a6354d04f158597d21c82e456cb0
- SHA1 39f622189b51e3997c5669954900129886ebc5f2
- SHA512 397ffadb7d9d2544c25093fe2820289d3974fd6571e0bfe9fd948ceb77baf6d28d0221237f9c519394cb33e175833d84339c35c1dc3878d95f5ae5f30bf32d7c
- SSDEEP 98304:NPhDmMq78mt3L/3WDBfGptGmD53uJeTeUwaaQP:NPhpDB6RuUi4P
- TLSH T13896AE0BB76A5933E56E833B18FB0315A3336286B7C75B4B154093BCBC962C54FA8794
- MD5 SHA1 SHA512 SSDEEP TLSH