c286b816e7569101a69b9f3ca87ad1a0432e3e637fdd04c8e6af1d97aa3a7564

Analysis

max time kernel
133s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
08/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app-release.apk
Size 8.0MB
Sample260708-pg8tragv4p
SHA256 c286b816e7569101a69b9f3ca87ad1a0432e3e637fdd04c8e6af1d97aa3a7564
MD5 05e7353cef4bd6c5547cea8f5533f832
SHA1 2f8d50a9dad87e89c641d1995708bf028122eccf
SHA512 db6eea8331224602945ccbcd207726c4b9cfd437f9adab4c4141e1dabf96c22549a50ce0e6575572bb3bb59a6d1c9c959854739a53e4652fbfbf8f4cfc7f6de4
SSDEEP 98304:nsRka4gpvBdnjNDHDrqP993C/ued2Zr1+vw:urrqPfy/DI
TLSH
T1E486CF86F7685A2FCC7641321DAA5231229B4C978E8397877944375C78B76F80F89BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.joinutcgroup.utc

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.joinutcgroup.utc/cache/1700159444520.jar	4711	com.joinutcgroup.utc

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.joinutcgroup.utc

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.joinutcgroup.utc

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.joinutcgroup.utc

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.joinutcgroup.utc

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.joinutcgroup.utc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.joinutcgroup.utc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.joinutcgroup.utc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.joinutcgroup.utc

com.joinutcgroup.utc
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4711

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1700159444520.jar

Path /data/data/com.joinutcgroup.utc/cache/1700159444520.jar
Size 10KB
SHA256 e1661b37aba29d5a8c159f7d5006f10023e6bfc9bbade99b09408360ba2185ce
MD5 6e7db93194f85158705af7a52b417cee
SHA1 c44713637cc460726faa1a2a415c31a0c94f4ffb
SHA512 155b61aa80db769ba1f0c637acd5a0e3c96fb152f060a6b73826df0a8aed11e94e4081f5808b805409f9da36aac75e1d98493ce119db7279254e686e0063a93a
SSDEEP 192:ayTrfH4Q1DeEASpsv7MZv/EJfJ7POEuKMqR3BXxJKxcRDmc+IBhY93:3vYQ1qE+v7MZvcJcWpR3BXxJYcoc+CYR
TLSH
T16222BF616D3254BBDC02F27824D727641F280797FC135321AD1A9342BA7AFA66C834F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1700159444520.jar.cur.prof

Path /data/data/com.joinutcgroup.utc/cache/oat/1700159444520.jar.cur.prof
Size 157B
SHA256 e2359a7293f4fbbc8dfe3610a27864ddb41f0113b7550992ebe62ac5b4af29f1
MD5 f60bc84f7d622beee345f3dbba1e7110
SHA1 fc16998e9cce2eaf1092a06e7640427b8f9e8ba1
SHA512 4745f28cf828f11b4ee36bfc8b1eeab4d14bdc428a1172722ff20c22962985a411b953185c67b1e650098a8af5670156b27d2f0bbc518d920c5976571b6b46aa
TLSH
T133C080340D9559655174545114B5375D83719906009483D261491535A54DD11C915953
MD5 SHA1 SHA512 TLSH

Submit Download

OneSignal.db

Path /data/data/com.joinutcgroup.utc/databases/OneSignal.db
Size 52KB
SHA256 c776d1acf90c60f95a89ee4db8222acedc8e0b097d5606297aa641a3403821ee
MD5 e50e029ec0226f794da6d3fc0535d4f6
SHA1 027173bb3c775e8ee027c1e22930d9b1607195c3
SHA512 4f12a39bd359554fccacb8ac31e2276c38fa69a2de927f43216c9012bd3aeee0e1a0f47a48d114c6e45309e069cdd5a6979d90d21f2e60f0087f42b8364672ca
SSDEEP 24:TLLSaOCrUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvFqrEqjUi7+xGTrOPjwV+x:TLOCrQcrA0oJtqracrObMoOS
TLSH
T168337ACF4B862191EFD765B3155392E48E3B610E8C9317A62BF760245E83B16D72386C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.joinutcgroup.utc/databases/OneSignal.db-journal
Size 512B
SHA256 7ed22e3406e2c84644a233e8b8e774937ac7eb1be4225d4acd5eb622d1a66ca3
MD5 3a19b1816e52a3c37195c998e67f7b3c
SHA1 766574be325917274fcc3ed5413057a16639f44f
SHA512 e735c925b57388dde36003941ebb4c361fa481027742910f36d98fd12dd4b2a00f8250b000de255ee992a3c2175b3442ddc5e00041e360805fbd633f273d1c2f
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.joinutcgroup.utc/databases/OneSignal.db-journal
Size 8KB
SHA256 4b78236e47b50931fa708ae7eb82649e43f14fc77cc53079e3ed8b837fe2ad06
MD5 a3565a48919b8eca1df12b5ee6f6ec7a
SHA1 2e69239ecd3eae502604731bee354fd869cd4cb2
SHA512 eb2ec88d78b65e89a5317a73549b8bcdda0d827f88460c931df478f9d11dec165cc4d5c5114b8ce5615769a2c57ed3f07076f7b25db15fb5e7e7005f0db426e0
SSDEEP 6:7+/l9C/gn1UXng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK6w:7+tE/PXnqLiuWdYRmBEyPbLw
TLSH
T1FC02229863820812C82D967790D783400D00EB2CC161CB2B179108986C076CCE4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.joinutcgroup.utc/databases/OneSignal.db-journal
Size 8KB
SHA256 3a495ac13ff27c352c348849fd0214a2ee6f889148a983c21198139ede644475
MD5 c89c189b099ae45801667da10c49b020
SHA1 702ec745db5a1825afa7747a85be0019e4a0b50d
SHA512 8ef9105db52be68fabbb8180170ba4e094df5a73ee3eca23e08156ec499056401db9d485e7fc60708fcbfcba59b40cec56eda54990ecb4853f31c46c3cdb34e8
SSDEEP 6:7+/l9GmGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK1/e4:7+tA7qLJdeWRmBEyPb+R
TLSH
T19902128967810953C52E57B7A4D983943E14B729D363CB571692285C6C8A7CCA890D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.joinutcgroup.utc/databases/com.google.android.datatransport.events
Size 56KB
SHA256 f38efa026493e69c4fa0faec3284e83ab6838a3b2e863af4dcae8987827ef829
MD5 46ad19bb37e8f80586206f06bb20b142
SHA1 e090f9fe02d71bdeeca1fdc9c9559cc62b703bf4
SHA512 2b38d935ffcd9ff764598f4dab280a779ab139826540ccb676634502554d4443019fce20f4290b63848682b38b0aa5da8ce84466bf33ff4a4394f85cdfbd6a6e
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSc:rAMEX0wIyNjac
TLSH
T1F543639D5A2C2221C97E283ED3E143A35B7C93DF572392623E908DFA8DC246974354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.joinutcgroup.utc/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 5a03410d9b66aa93e9cf4f77f5f234ba572c6240037b16aa5654e9384a9bdc6d
MD5 1007d33dc07b0c73c15408e157cf9b25
SHA1 6a5896d392baa2ba9d90c42b8d5e87fea907c2ce
SHA512 c7929a80129f5c7318e9273637d7b1333461c061b5c0b932c90112a273290c54960775538a7f9a1258a377f0782b673674bceceeb7b67c331bf88fe1ac7b94f0
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.joinutcgroup.utc/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 cd578c9eaea1f9586efe0591495c1eeb1bddce841782fae3abd9e0906be1791b
MD5 54b48b13d53a37e9c37c0de2863e9539
SHA1 0d229873479bafa44efcd0840a468743aaf42573
SHA512 27919d9ce73875f79b1ea9bde1c14a5bca874d4b05f13a23f826ed01a0831fe8f71d08f93cad3d9f4981c0999e55bc162ed3f87868a4a705e61e75ae4e8f8425
SSDEEP 6:7+/l9aHn1S4l+Wg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKk:7+t0+WqLiuWdYRmBEyPb3
TLSH
T19E02228C63800822CC29967BA0D483500D02E7288665CB17179008A46C074CCA8A1E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.joinutcgroup.utc/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 fb6d8564afde51963805a1594ec96e663dbdc5218f6b94cb519dc1154b794a74
MD5 ead9dfe1d151326540a46e47a927807e
SHA1 e9b09f9d4d102d90ab06400189d586246599e7de
SHA512 df5137032cf1baa59fff5be0dbacdfc0e0358a2563d0652912a034528b4941ba36504396d934fff0d739532acc6cbb44a8c94b74813f9ef48b5dea4886fa6138
SSDEEP 6:7+/l9D69gPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKNM/uf/:7+th694qLJdeWRmBEyPb4sQ/
TLSH
T1240222886B410803C4291777E4C883401F20BF38B233CF07179108582C466CCB890D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.joinutcgroup.utc/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
TLSH
T16D72C2CEDF102606C6760737F8CAE3A05DA4A22D833ADA476B950460AE42549A8A1F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.joinutcgroup.utc/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d07b58610eb7735fdbc496056bf836052451cc4ba079ab0eb3937584fe007a6
MD5 deff84787bb04d2ac3f67f9970464ece
SHA1 e05794404304df1476fe80d1f1b3363fff88b486
SHA512 7f63e6e336c66a5f83c103fcf171db76a120a445823b4393da275e0102b576d9eff23ec6818bc1e3cd046ce0d7eac7f1f63fbcfbdc214103287bf7cb9ae3fb82
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6+:TLiEq9zmzrfRmBEyPbP/P+/0Fl6wT7
TLSH
T1467268CC7B105703D173473670CF93E11C34A318433BDA173B450434AC435845052F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.joinutcgroup.utc/databases/google_app_measurement_local.db
Size 16KB
SHA256 6a874b24107195863973b392d4e69e51b9e0c505067e2308a9f1e35f69071ffd
MD5 1fa3f0bc9811344d9ae62fc95e807220
SHA1 2eae520b7310dabb5a71559a5f2ceebad7e13121
SHA512 451e83ae9c7bd9acb26e97f5c51c72b008be47aa05dc12057e79777f6fca60b7ca76d4f7748a93f5ca646bde0f5fefdb838e7f9ced9855411e21e0f4f7ee6d17
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFlQj+/0Fl6wT7:TLopmzr0GSP/h1499FIlFv
TLSH
T10C72E98D7A149707E6774B3560CBD3D12C387225573BD5177E461A2C5D437855062F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.joinutcgroup.utc/databases/google_app_measurement_local.db
Size 16KB
SHA256 d05df7a4e1a9f42aacfd1c733425c1188a87df09eb5f88e4a991d49c76fde89d
MD5 6c07c0e4c4ef1d45eeec8b48c28c6d6b
SHA1 37f4e2b2695d68a4a795111f1b048a02b62d2945
SHA512 55c8dc60d349bcea7860139dcc428f4894457fbcc384fed229586029ceb5897e10b2d28caa54ee7fb3ea8593e09c600405086faf3e908ff80922615b6365608e
SSDEEP 12:TLIEU9zmzrfRmBEyPbP/JOLabCAUEWlCuUyWlWQa49blqYFlQj+/0Fl6wT7:TLYpmzr0GSP/JKabCCbM499FIlFv
TLSH
T187722688B668C703F6778F3961CBD7D128387266072BD6133D062B2C6D437818561F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.joinutcgroup.utc/databases/google_app_measurement_local.db
Size 16KB
SHA256 6b9077e6f37303c1b2c29d8ceeb7307aee5a5c47b06ad288da2f52530819322b
MD5 6c9d554990f4dfb4024d14f86106c8fc
SHA1 d5e89b83707c5b4fc79cd7a19157fc35b7201735
SHA512 8bd25f1cc9b797b9da7e1c724e4188c4fea09c7727e4d721a9e330cd3110078d1750248b55b2b8099a52524c7e27002822b5d89fad6897e04e945eaefda34c60
SSDEEP 12:TL6uER9zmzrfRmBEyPbP/uOLabCAUEWlCuUyWlWQa49blqYFlQj+/0Fl6wTv:TL6vpmzr0GSP/uKabCCbM499FIlFL
TLSH
T18F722688BA68DB03F6778F3961CBD6C128393266072BD61739062B2C6D437818471F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.joinutcgroup.utc/databases/google_app_measurement_local.db
Size 16KB
SHA256 b4765a86f69c122307448d0c6e81cebd52ffbc59b0d19da42971e2857f773e6d
MD5 818548be1885386cc995f564f36a8e8e
SHA1 008b0c602ed55b1122dadfb3a20db517d55c10b3
SHA512 47840561a1eded73600b656576a7a9195bd1beddb79b08090b9e6bd9ab610de6cfb0a334310bfefe0b33ef157d420aaa17c6315fa2e689398da3328c4460a02f
SSDEEP 6:l9bNFlgls1WnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WK:TLuEe9zmzrfRmBEyPbP/WK
TLSH
T128722BCD9F102603C5730777B4CEA3916E14622D83379E472BD90570AE834899051F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download