c286b816e7569101a69b9f3ca87ad1a0432e3e637fdd04c8e6af1d97aa3a7564

Analysis

max time kernel
145s
max time network
153s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
08/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app-release.apk
Size 8.0MB
Sample260708-pg8tragv4p
SHA256 c286b816e7569101a69b9f3ca87ad1a0432e3e637fdd04c8e6af1d97aa3a7564
MD5 05e7353cef4bd6c5547cea8f5533f832
SHA1 2f8d50a9dad87e89c641d1995708bf028122eccf
SHA512 db6eea8331224602945ccbcd207726c4b9cfd437f9adab4c4141e1dabf96c22549a50ce0e6575572bb3bb59a6d1c9c959854739a53e4652fbfbf8f4cfc7f6de4
SSDEEP 98304:nsRka4gpvBdnjNDHDrqP993C/ued2Zr1+vw:urrqPfy/DI
TLSH
T1E486CF86F7685A2FCC7641321DAA5231229B4C978E8397877944375C78B76F80F89BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.joinutcgroup.utc

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.joinutcgroup.utc/cache/1700159444520.jar	5090	com.joinutcgroup.utc

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.joinutcgroup.utc

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.joinutcgroup.utc

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.joinutcgroup.utc

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.joinutcgroup.utc

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.joinutcgroup.utc

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.joinutcgroup.utc

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.joinutcgroup.utc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.joinutcgroup.utc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.joinutcgroup.utc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.joinutcgroup.utc

com.joinutcgroup.utc
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5090

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1700159444520.jar

Path /data/data/com.joinutcgroup.utc/cache/1700159444520.jar
Size 10KB
SHA256 e1661b37aba29d5a8c159f7d5006f10023e6bfc9bbade99b09408360ba2185ce
MD5 6e7db93194f85158705af7a52b417cee
SHA1 c44713637cc460726faa1a2a415c31a0c94f4ffb
SHA512 155b61aa80db769ba1f0c637acd5a0e3c96fb152f060a6b73826df0a8aed11e94e4081f5808b805409f9da36aac75e1d98493ce119db7279254e686e0063a93a
SSDEEP 192:ayTrfH4Q1DeEASpsv7MZv/EJfJ7POEuKMqR3BXxJKxcRDmc+IBhY93:3vYQ1qE+v7MZvcJcWpR3BXxJYcoc+CYR
TLSH
T16222BF616D3254BBDC02F27824D727641F280797FC135321AD1A9342BA7AFA66C834F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1700159444520.jar.cur.prof

Path /data/data/com.joinutcgroup.utc/cache/oat/1700159444520.jar.cur.prof
Size 154B
SHA256 2e40cde1260fa6a30216776268eedc84257ec620f4b6ae5c08c210f06cbd389d
MD5 8c46ec2433fcd1839cb929b02a3e7c6b
SHA1 347d83d1abd007f4d10747bfffd1d34109602e4c
SHA512 3090f267ac01f53402099731e7523c375740fc64252c8d5e12de9851bce30db53d2ea734056bbd69d07a15f593838d012cb9ac54fcef0e1872f1a76713dcfa90
TLSH
T13EC08C66A2C14C32BCA5A2CDC8750B6B06BC80684288E6322B4745302246BA0EA1B562
MD5 SHA1 SHA512 TLSH

Submit Download

OneSignal.db

Path /data/data/com.joinutcgroup.utc/databases/OneSignal.db
Size 52KB
SHA256 f8ebc23104952761ccaf8dcf7ea9e5341bb0f3da744550a518f8dbc8b3404904
MD5 5715efdd2d828d4d57c1376120ba2806
SHA1 06f279c976087695aaaf885df323d996a2560cc1
SHA512 dbc9dcea4f947dc61663054585dcc175b79ce7d69aaa8335754d1fe6d02881dadd75d3846190178e677e80efd63a1e364a31d51620d51e8e6254b8864651bb30
SSDEEP 24:TLLSrCrUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvFqrEqjUi7+xGTrOPjwV+HR:T6CrQcrA0oJtqracrObMoOS
TLSH
T1D8337ACF4B862191EFC765B3155392E48E37610E8C9317A62BF760245E83B16D72386C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.joinutcgroup.utc/databases/OneSignal.db-journal
Size 512B
SHA256 dce271e52bd3ecf41a38fd577df699ac2fc3928031fcfab7eee9e92f95459059
MD5 4dbda2ff6f8f04d561ab5384c967f66d
SHA1 056232c8280c0f6ce3dec47bda01c4af4d8cebbf
SHA512 fad118ecca675bc75ce3237581099eb2be223f2e054bffb9cbd9103796094b363683b76eacc66c225282c9f08194ab6b5ae89a4d8aa26cd7214dccc5c753bf6e
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.joinutcgroup.utc/databases/OneSignal.db-journal
Size 8KB
SHA256 0cb72a857fb9789038a5df4731411ec42e4ec4b19982fee4bc3d0a8e994c0731
MD5 f6673bc58437078503afedace6328805
SHA1 10cd7b305382fc01f3a9a84d8ff8c3f8430e4ff5
SHA512 05d35221c74682a1103550132c9de8bf11364c57c7e459555075f1ea85bb724748c35bf455d29c4e75f6122e737619f5601f32f259d31c35ed4dfaa4f7528446
SSDEEP 6:7+/l9kHn1eWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKuVn:7+txWqLiuWdwRmBEyPbfN
TLSH
T1BC02228E63800823C81917B790D483681E20EF2A8361CB0B166008A83C034CCA4A0E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.joinutcgroup.utc/databases/OneSignal.db-journal
Size 8KB
SHA256 c332f2176d18327b6e4ec9f008ce5267ae493b92c73a4c9e39caf421b7dea6f2
MD5 4312cfa5c2d91c31b46c475393039dfc
SHA1 5163cba36f44adfd2433f70fc68eb7dcd7e29d9f
SHA512 3ea5a37e102596d20afce7cd5ec37f46feecef732d02e71c5600b01aa950ae31d0e9dad05aa10e0fb0b2e6b9d3ddf010240b2dafc62d4bf1b70b2b4b2b9d32e3
SSDEEP 6:7+/l9wC4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKJOC/42:7+tBwqLJdTRmBEyPbIf42
TLSH
T19102228963480D23C01957F790C883402E10A7159223CB07256018983C0A6CCA8D0E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.joinutcgroup.utc/databases/com.google.android.datatransport.events
Size 56KB
SHA256 c7d435f11a71458bea931a2b99bfe0b6eb37dd1102d1a764b4a42b194bb69f7a
MD5 b41685f597983b05aee0f9ce4a48a5ea
SHA1 4c3de15acd103636556bb4ac01c7d4da51517cea
SHA512 f4beede412c54c777477f12b00ef7a35915c8043e45718ba7e07a55f3cd116228a75b50a00406bc1bc8225b45219b768cba69674d5efefe7fb37464ff7d35fc8
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSE:8MEX0wIyNjaE
TLSH
T12443639D5E2C2221C97E283ED3E143635B7C93DF5723926239908DF98DC206974358AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.joinutcgroup.utc/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 7f28f29004c962814026d97d9d68e570b066de35c9ffea48b40917358f1a6a5c
MD5 7758741197d21349e0d0bf4969075664
SHA1 155e855e6a450071b7f04c3ed07bb8a9f57956f0
SHA512 bcf24212022612b2a0b73bd3902aaf2e327b4eb9b2e17f59291fb0ddc0390a6fc1f748ba5b2f9fb9300cc5307b604ffdff81d1e8c474740c18895fd3b28c6e01
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.joinutcgroup.utc/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 b23a541729685b624e798a6b6eae5b3d3f37cfbea7e9f2f6d2c6e1822d23eb51
MD5 2127f404f5a986ad140afa7b44a64d8e
SHA1 8c0210438855948c7eab3211d58af0456ff935e0
SHA512 7f8e7002e2052f4fd444ea9f95394927b072a77bc6be343ebe9cb0fb2769a6529cdd1e2cd192a36890d4a08a9970d3d32f9947b7f99d3bde983966282dd7d8cb
SSDEEP 6:7+/l9JMuHn1TWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKM8:7+tzYqLiuWdwRmBEyPbD8
TLSH
T1BE02C08DE3812B23C93D56B7A4DF83800D00E719C172CB67196208E83C434DCE4B2F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.joinutcgroup.utc/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 fa6411c559523377ee3d65cee1426c3b4bc191d4bac3c4db7e2daf7ed7674383
MD5 265672ba81da51126d75bdc75612ccc3
SHA1 39153bd536b9400c039c7f46ad343f5ca81480fb
SHA512 99ce1795a916a8793bf67d102ed15714aa8c37dbb4cb1b2bd5581b984d7db393f06d2bc0913dc406a4b4cbddccb2857e52034e33d4464061fa94587cbdae598e
SSDEEP 6:7+/l9/Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKit//E:7+tdqLJdTRmBEyPbF9E
TLSH
T15002228963400923C21927BBA0CD83422E10EF148323CB7B17A008A83C026CCB890D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.joinutcgroup.utc/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
TLSH
T11F727DCEDF002202C1360733F4C9D3901D60921D8336DA0767940460AD02108A451F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.joinutcgroup.utc/databases/google_app_measurement_local.db
Size 16KB
SHA256 d0bf5ac7b17d52e248dc377682f10c99c1d4a7087c5f27f5c9f19e045d6c9caf
MD5 b8cd3f095b9cd5ad816bb65e06572a21
SHA1 52b4ece002c47d5b66661a78f00af498e2210b2e
SHA512 b8870f26d5e72464c73bea948806b19ea2170d3858f335c98eb72a85554b3171827199f93a43fde1505f432ddbc3d603c24ac54ff100b10433d8feaa4ed8a897
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6rOw:TLiEy9zmzrfRmBEyPbP/P+/0Fl6r77
TLSH
T1DC7268CD7A105703D173477770CB93E11C30A3188337DA173B540478AC435845052F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.joinutcgroup.utc/databases/google_app_measurement_local.db
Size 16KB
SHA256 0c0fb0b929c50663842d27bd4ce715b067296000221e56f06dafafd61298a5b1
MD5 b0a2b73513133f8f48bc7fac82bacdaf
SHA1 4bc8c8900a3e57cf2e7ca70414221c3629910937
SHA512 0c7e750e45e0217749a7ae44848db4e6ba59556351b58eef121c536fd8ece59240338d426f018b775ccfbf074f1b2f02654b1b22d204ad96a9f022e5b7eb7efb
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFlQ8+/0Fl6r77:TLQpmzr0GSP/h1499F7lFW
TLSH
T17472598D7A149703E2334B3660CBD3D12C3472154727D51739061A2C6D43BC54022F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.joinutcgroup.utc/databases/google_app_measurement_local.db
Size 16KB
SHA256 f8fd670bde40fd49a7ae58ff5acbaa1bdf066258aadc5c6d5150ece6cb5dc6de
MD5 e7b641bcc2ae9aaf9675b612a2c6d9ce
SHA1 7aaf2c7037fe033da3f0a1857de3e58953981890
SHA512 14c65e131c96546c04770ff8f8c123d52b5bd361cb7c56c3606ba94bf81ae731a306410b4a3511ec110a4c0c01f37086e4ab8fcffc4c2f616ef2b8583ed7e306
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/JOLabCAUEWlCuUyWl1Qae49blqYFlQ8+/0Fl6r77:TLEvpmzr0GSP/JKabCCbfe499F7lFW
TLSH
T16272268DB568D603F6778F3A61CBE7D238347266072BD6133D062B2C6D437818561F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.joinutcgroup.utc/databases/google_app_measurement_local.db
Size 16KB
SHA256 1fbccfb68cf313f634563769059e0f6274050fa22f7cc501adb47e877b3c2efa
MD5 cdf2a1f2f1b5264a130428f6cf0b7682
SHA1 3cf8d8fdad4d875c0598013184b3bce6366d2eca
SHA512 e48d851a1bf9ea4f9665ebe3f2f91b42443fda085243e7a0a6d3c14e0d370be7efc47e78b440e1037d346178b71433ad2d909a8e30098a6d8401b7d323a47d61
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/uOLabCAUEWlCuUyWl1Qae49blqYFlQ8+/0Fl6r7v:TL6Xpmzr0GSP/uKabCCbfe499F7lFC
TLSH
T1AC72268DB968D603F6738F3A61CBE7C238357266072BD6173D062B2C6D437818461F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.joinutcgroup.utc/databases/google_app_measurement_local.db
Size 16KB
SHA256 458aa953a9e0adbf5b8765ebcf6b51bc5b5a48b7664e85d25c7a8ce9781a2d5c
MD5 2f1eeee3602c828b8e9f81f6fbd20d41
SHA1 d240b568bb6929702815b9a5edd05ad635671caa
SHA512 a8642cc12cb9af0cd9d3fdc4bb1fe3b246d02af6b36714d80cdd2809def699b0b93eb585187c17f0a8e19801879e2e9edef7963ee416ae9e8cc35fd9cede2859
SSDEEP 6:l9bNFlgls1qlvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WK:TLuEev9zmzrfRmBEyPbP/WK
TLSH
T1A8722BCD9F102603C5730777B4CEA3916E14A21D83379E472BA90574AE834499061F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download