443e697ec78fa0eecbf9f8d79a357f4ce16b3fd1fc02e66b62af63e6dabd4be4

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
46s
max time network
899s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
07/07/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PCF.v1.0.apk
Size 4.2MB
Sample260707-e7xt3aez5l
SHA256 443e697ec78fa0eecbf9f8d79a357f4ce16b3fd1fc02e66b62af63e6dabd4be4
MD5 66da20512145a9c09f73bf11e7897068
SHA1 73f04e0f1c30f933e4a8e0e033b3513ce60c02d3
SHA512 d864fedca509ca1c04cb661ad64a2a8d201ce683c4cb739429532cd6666dd5d74650e1b5d62ddcfbd5fac8e0625aa7e0c09165752a15215f8c6866e3cd0a4937
SSDEEP 49152:Y53P+xCJi7tVkRjMws9jNqUMyCU8py5/vNCuW3NTb+cIPhDocp641v1B3hQ:cPgEjMw0MyCCpjW3NTbxWY41v1B3hQ
TLSH
T1F9168D0BB7219A27C47D523B56B647682332DE429B8347172105B5ACBFB32D82F8D7C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/data/local/su	com.professor.pcf
/data/local/bin/su	com.professor.pcf
/system/bin/su	com.professor.pcf
/system/sd/xbin/su	com.professor.pcf
/data/local/xbin/su	com.professor.pcf
/sbin/su	com.professor.pcf
/system/bin/failsafe/su	com.professor.pcf
/system/xbin/su	com.professor.pcf

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.professor.pcf

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.professor.pcf

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
27	sites.google.com
28	sites.google.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.professor.pcf

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.professor.pcf

com.professor.pcf
1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Checks memory information
PID:3279

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3279.tmp

Path /data/data/com.professor.pcf/cache/oat_primary/x86_64/base.3279.tmp
Size 312KB
SHA256 15c6388e25b8d4212500adbf4321500c7e4b26c4cf07f25ab180e891d6a0b7c5
MD5 b6543964c2aae1a5cecf15623053ea86
SHA1 08c2415b6a84b029d32fd127ef7e4ad742ea7e4b
SHA512 963df9c724fc1aa6ace8d6b67a8992d44997f460d99a0f957f9831dca494f890747a855100ae1ff9727cc44304b95ec7ae5c42b9615e0fc7f71a135e54647bfe
SSDEEP 6144:T1tgZiEcf/SzwzO6nz6psRRP6CNC5efKpL0ZkCt9WwEdOFVMPbbP/d7zO:TKck2OE6C3fKmZkgAOFVMPbBO
TLSH
T1A6644B5FD6639011C1FBEEF3978A46ECF92E8025125A2E009461777EA41BF15EB70FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartApp-d6864f2502af7851

Path /data/data/com.professor.pcf/databases/StartApp-d6864f2502af7851
Size 16KB
SHA256 e70694e896785aee07ee43be5f3ba13b3d686cfebb8d63c8e92a5305ebf66c0b
MD5 b0f934cb0e6512fb4ed62e431217862c
SHA1 bcd14f5bfef409fc7a85dbc3556493346ac2fb4e
SHA512 d588edb72395d3c3566d713edc1094709188f82e0ad535eda48c5dbfc7cc066b7f5c913ae6be5adc3d8b9d2e91ae77952d31f0d3d2ecef949985e305f82f9e49
SSDEEP 24:TLHmtO0iMncvJRAFyz8b818MM4k0GSNmg4zGQ9g:Trmpn6cFyzgcBgSgg4bm
TLSH
T18E72898D9F803344D0A64173EEE182573EBC766E07626346196018F14C7BE337622AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartApp-d6864f2502af7851-journal

Path /data/data/com.professor.pcf/databases/StartApp-d6864f2502af7851-journal
Size 8KB
SHA256 e90b57f59106e4cd3811f808a3b4dca703d6a9e25e2f9348f221c048046e88f6
MD5 c45c22a02ce4fc075407c1f2b21d6176
SHA1 b69ded4892af153a202fddceef28c956a38e53a7
SHA512 e59e9f314a0ef7b8d289feba9d39970b41d293dc5ca3490c2abc1bf0c0c4b74fb242f84d1c30bd5aa898627ab572ad5aad39432f28ed9f1ee71984ac99ce2380
SSDEEP 24:7+twqLnmtO0iMncvJRAFyz8b818MM4k0GSF8:7MwqLmpn6cFyzgcBgSF8
TLSH
T12302418E5F802341C0AA4172EDE281973E7C766E07635355182009F59CBBE33A122AE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartApp-d6864f2502af7851-journal

Path /data/data/com.professor.pcf/databases/StartApp-d6864f2502af7851-journal
Size 8KB
SHA256 7b31f87cbedd216c3f06e267862586f749eda947efb793cd1e7922e40749ee95
MD5 06a4ddf362b8e7fc6d1d4731b78acfe2
SHA1 12b61d4c9eb58548a0520bd947961cd55d5a0ea0
SHA512 ff56c2acda8831d5a827a124c2fe593f0affbfa6917c50e73529920b265a161cedb0d56ea2a5998ba06a5f989b34ba7201d8f657819cec6d0850610af1849f1d
SSDEEP 24:7+t/keIQ9HqL3mtO0iMncvJRAFyz8b818MM4k0GSK:7MFpqbmpn6cFyzgcBgSK
TLSH
T1CB02898E6F802344C0B60176ADE281673E7C726D07636395186019F15C7BE336222AE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartApp-d6864f2502af7851-journal

Path /data/data/com.professor.pcf/databases/StartApp-d6864f2502af7851-journal
Size 512B
SHA256 9cf2e308c768b9720851dd48f33bf0477e5e1ab422e19dac097be0d072897cba
MD5 46c06a941841a6d46bb4375b4530e60c
SHA1 4498f2904cfefef1fbce1c2c60749d6b44b02d11
SHA512 9e11b7e93fd84f21782011b410f87e835b24795123d4ed2ff2dc4954479569b68a0b694bee56fca1eecafa0a371bb3b08a164232176821b91497c8910d8aa961
MD5 SHA1 SHA512

Submit Download

StartApp-d6864f2502af7851-journal

Path /data/data/com.professor.pcf/databases/StartApp-d6864f2502af7851-journal
Size 8KB
SHA256 40cb4603503e09935a79cbd6bc3ba80808cce57bf845ed95412f02b4178b48b5
MD5 22dc97306e4e065586408d1efe2981bb
SHA1 87a27fca86a62e45a5872f3e03b4737830e403ba
SHA512 3e7b513f295e192f2a27d0fd480c9680d0f15c23d13567f1934fb8393e83edc3b9926906ee355fad6ef10a2477218a76e0b8af92403508a017d599fe6de77241
SSDEEP 6:7+/l9bOn1jRg9bNFlEuWdkG4lWlOERX4PBX4ogLugMBX4suuK0Dn:7+t4qLiuWdQoRmBEyPbZ
TLSH
T17C0222C867800822C81A167790D4835C0D10A7AC82E3CB8B165008942C078CDACA4D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartApp-d6864f2502af7851-journal

Path /data/data/com.professor.pcf/databases/StartApp-d6864f2502af7851-journal
Size 8KB
SHA256 8043d211d78decbf381b5166354003a1ff56b221508c767320e28775aafbf750
MD5 bb9e682514b8bd98695309b57e892e06
SHA1 17e822ad8779e8bc4913dfb866634609997eedc9
SHA512 350a0cf15dcea959b04a05e6ed33fa4f024c4f6dc51e9e0a96b00586b5aabd5de31a30351c3c32518cec094cdc4ba56a0e3eaf1d2b7d1797af291af5cd5d6e4e
SSDEEP 6:7+/l9zOPg9bNFlLdvlWlOERX4PBX4ogLugMBX4suuK2lU/rn:7+tcqLJdvloRmBEyPbAr
TLSH
T1A502C08C6F830803C01D377790C8C35C2E10E7198373CB27069018543C076CCECA9E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.professor.pcf/databases/google_app_measurement_local.db
Size 16KB
SHA256 d1ffdca7ba8c0925bec4d10295b7c355bc1cace5e6b44d6efe9f812023f9e772
MD5 dd9a2fe8f7bc14471ac42c324c607a30
SHA1 f88c5a77e00aec2c00147b84e0d346cab31804f1
SHA512 f5edea485e7aec27b231844b38e7741e8cfc64ffca299467c5761093e8e173ffef1ab808db141519cba717fbc2d28265b5cc316e6221f6997433bb3ff0c4e0da
SSDEEP 6:l9bNFleLIls1uGo9FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0Dq3:TLDEuX9F7LzmzsRmBEyPbBvOwVQ
TLSH
T1F172D8CD8F10A206C517033760CAD3950F78551E83779647166408605E52598B451E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.professor.pcf/databases/google_app_measurement_local.db
Size 16KB
SHA256 259973889236b4dc46532ea4bfe4eb3d3ea8468fb9af077f37ae7c72638aad95
MD5 3f3a155774d792e9bd0bfe643bc56092
SHA1 df53890b98e36248a51f13877d335abf3d8262f0
SHA512 b7b74c439f666635eb3e745807973e37adf53bef04aba38f53f2fd9c51da0ea92d7f6b2575181f08f9758d49c0310b057b5020707da778bd0ebfaa0a34a0f8de
SSDEEP 12:TL6ET9F7LzmzsRmBEyPbP/DvJ+/0Fl6qh1L:TLlnHmz3GSP/DvJlFv
TLSH
T1EA722BCD6E10E607E127073A60CB93E75E38611E4367965B3A740964DD535C8B162F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.professor.pcf/databases/google_app_measurement_local.db
Size 16KB
SHA256 a538fff9fd8cb730499b9cc74eb9819bd90aa15761e9e4c48ee5a96dca86ce31
MD5 e332fa0721ee38adfd75573892e09688
SHA1 01ca714f9de954093abfbf72f1ceca756af97adf
SHA512 6f7fc2c95d0dd0d961b8ccf3bf0b6e6fa1bcbe2c9b0c593e960f500568732a669ce16a8ed8b6bd655f55597e2b8f20dc58d2f7067e37d4331ebc8bd12da166eb
SSDEEP 12:TL6UEI/9F7LzmzsRmBEyPbP/h1V49blqYFlgRvDvJ+/0Fl6qh1L:TL6Y/nHmz3GSP/h1V499FYvJlFv
TLSH
T11E728B89BA24E217E227073E21C7E3D72D38701B0733960739254F2C9C43388B021F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.professor.pcf/databases/google_app_measurement_local.db
Size 16KB
SHA256 66b34fd31be58a33e84353a0a259a3f9b79a7ced51078b07ccaff9d3ec4c5393
MD5 5e3d0c874d97bc8b26799d978ab64433
SHA1 9a936783a0f9be6695c826dc3850620d329c2c98
SHA512 6c6a4b5d0982119166df10556137f0c6fccd5030a454a412890ef969c150be032b5c6399d2b0c9ecff8acd0084e5b36f997f1a4eb0559467a75cf81b806a3a7d
SSDEEP 12:TLUE19F7LzmzsRmBEyPbP/JWQhvhOLavnOAU7jWlEaQ349blqYFlgRvDvJ+/0Fld:TLFnHmz3GSP/J9hKamgmak499FYvJlFv
TLSH
T1FE726885B938D612F2770B3D51C7E3D23938305B0723E21339655F1C5D43784A461F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.professor.pcf/databases/google_app_measurement_local.db
Size 16KB
SHA256 0cc18caf7cd379d2bf3f147cf0bb67c7a920f3206381f329f3fc5c4fa1ec5850
MD5 df53d31a58ba2c7ab4a03e7f49f4439f
SHA1 a115ae83b17f5648b083a4543383f24b8bc12830
SHA512 0075953875d43c83c7a17d9684405bc1d3ce636ff42d9303d5aeeca03bf3c81b85f08fc8a058374257e6433771477ae4ca95d589048273169e0e2a477655bfed
SSDEEP 12:TL08Eq9F7LzmzsRmBEyPbP/Jm8QhvhOLavnOAU7jWlEaQ349blqYFlgRvDvJ+/0T:TL0ynHmz3GSP/yhKamgmak499FYvJlFF
TLSH
T1967264C9BA38E612F27B0A3D62C7E2D23D3C30570323E21239665F1C9E43784A061F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.professor.pcf/databases/google_app_measurement_local.db
Size 16KB
SHA256 65f7321dab8f859b641d5bacc05ae73580b7f21a3c4b674465ef24253ea3f1c1
MD5 7edf506992acc49eaf0077a767c31fb8
SHA1 0d201552db7521c08e6c9f69d1bd1323d7c8d08e
SHA512 4f7e5d90c403041cf9ed5dacd54071049d4946989d1dc9913111949728d24ab52e53207478e6a6ae917830bfd1e7c250fe13cf53106f22e0275f6d8101fdb737
SSDEEP 6:l9bNFlils1zl9FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/Wlzr:TLIEzl9F7LzmzsRmBEyPbP/WF
TLSH
T13672268D8E10A202C123037674CA539A4E28A11E437BAA531BB408609E53198F051F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download