Analysis
- max time kernel
69s - max time network
155s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
08/07/2026, 12:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
disdroc.apk
Resource
android-x86-arm-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
disdroc.apk
Resource
android-x64-20260325-en
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
disdroc.apk
Resource
android-x64-arm64-20260325-en
6 signatures
150 seconds
General
- Target disdroc.apk
- Size 4.1MB
- Sample260708-ph4lesfv8v
- SHA256 914b47485d9c326e7c2f14e872fbc1d3dda31818573332561fce0313739bb6f2
- MD5 7c5e34da4767aacb4be79353652f6e97
- SHA1 7daeb6c784d3ea6555386eff2a849ec28f947231
- SHA512 9f81a50c33c283e0e224178fdc1be379546742e97c8b49f78193b1b66e7349b25d82ebde42ecf4125224403f6903cdd180739fbb92503c9aabb47e6975576f15
- SSDEEP 98304:yF3lHzt8EL502BzINf1DTjddWQc7qu3tG1HL7wZSPCT+W1+9Y:gVHRbLe2+FvddU7qseLEZSPCThZ
- TLSH T19D160196F3E46E5FCC77C1364A8B173122568E06CA93D307AA08336E78776D84E857D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener online.disdroc.app - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock online.disdroc.app - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo online.disdroc.app - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone online.disdroc.app - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver online.disdroc.app - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo online.disdroc.app - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo online.disdroc.app
Processes
-
online.disdroc.app1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5033
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/online.disdroc.app/files/PersistedInstallation2465659490202953985tmp
- Size 569B
- SHA256 66a55d3d4d174fc69789a433a6a7faff11da60756f2b1693144a28a4d5899aba
- MD5 8fe70cad4b7c18fbb9261299d1aa2167
- SHA1 e766327cf0a2d5b9044d95e090901bee8fe11b42
- SHA512 ce4d34705cd0c6bfb9bd5681a43a1dcd965850005fded89d56ab225dd565e705d1cd59e0e291e48b4c30e4a5dcb5b88715d5c85f50c6a5edd74e0e6b5adead21
- TLSH T1E9F0964D91408C0CCC95BC8B288DFDC91E2C0D9F27EB00636F5D0864F7901E8758104C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/online.disdroc.app/files/PersistedInstallation8589752865288120572tmp
- Size 90B
- SHA256 7f3db11f589effd5cc2ff207c7ba89e86c33ebb2a14eaaa1a92f5cf53b63f1ec
- MD5 89a657cebd9f3c11e93b0f0ed0f15aac
- SHA1 056024a94d3c74e8adbd9316301eb18d9795d0a9
- SHA512 df3a362e294fe159ab266f1b56d4568fd0c158e01dab4251e5a0140ee7b426b9f21eb410d59dfefa763747920a892c07f9f41d5903c7e00222dffbbe6515c8b0
- TLSH T1D1B0120186B191428889A20B2C4EF1801D801481148E8E080E0DA08011821D0A163994
- MD5 SHA1 SHA512 TLSH
- Path /data/data/online.disdroc.app/files/profileInstalled
- Size 24B
- SHA256 10a6d5509acf7c1de0f32ffad1d6adaca23e41942d57ad4e171f46da143e503b
- MD5 b379f74a5776f13ca2cab4bd06e9f4b1
- SHA1 43b0e29b97d250f526d3aea4a867322499164537
- SHA512 66f57ea853bd3004da3de87fa0e8fc41f3234a96e334846f445ea25b13b32d6bf08360119b33152e61f59d471aafc260481b0ca6dc09518e864ba0699c1edf15
- MD5 SHA1 SHA512
- Path /data/data/online.disdroc.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 b2c246c546257e329db9889dd253e1c489fd8ae9624b38e1f0341a745e9ca42a
- MD5 15dfddd90e6240976f656ed0ffc07266
- SHA1 cc2c769e6614ecd9fc196009d33905be00ba4775
- SHA512 9de3e0c13a0031f06844f369ef18b9299f8d40e0efea9887499a843eefe99ecd42ea569dae39bca261fb27cb501e390521a5bea5152116742ca713039b217432
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/online.disdroc.app/primary.prof
- Size 2KB
- SHA256 f2b8ceea446be9edfa7a29e88bbf7df2412bb6c6acff0a2b239cabd7fc6dd2ea
- MD5 f59e65074cf16c2010429441515a4bcc
- SHA1 d58336ddc7fb55231b90eb6b49b071bc157fa7bc
- SHA512 8222224f645ef6faa7a3ad1cffd9ce26887c925e3faa1ce9cd2da1e2d62fd844d79e4feebd08783ac9b54f9087e4934f9770019d00fdf1fafb090e02bcdc8bcb
- TLSH T11E512ACEF9702C00A3F4C53C6F589C918292D8BAC65C3D422AF4598F0210F6EC7A8671
- MD5 SHA1 SHA512 TLSH