914b47485d9c326e7c2f14e872fbc1d3dda31818573332561fce0313739bb6f2

Analysis

max time kernel
46s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
08/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
disdroc.apk
Size 4.1MB
Sample260708-ph4lesfv8v
SHA256 914b47485d9c326e7c2f14e872fbc1d3dda31818573332561fce0313739bb6f2
MD5 7c5e34da4767aacb4be79353652f6e97
SHA1 7daeb6c784d3ea6555386eff2a849ec28f947231
SHA512 9f81a50c33c283e0e224178fdc1be379546742e97c8b49f78193b1b66e7349b25d82ebde42ecf4125224403f6903cdd180739fbb92503c9aabb47e6975576f15
SSDEEP 98304:yF3lHzt8EL502BzINf1DTjddWQc7qu3tG1HL7wZSPCT+W1+9Y:gVHRbLe2+FvddU7qseLEZSPCThZ
TLSH
T19D160196F3E46E5FCC77C1364A8B173122568E06CA93D307AA08336E78776D84E857D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	online.disdroc.app

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	online.disdroc.app

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	online.disdroc.app

Checks the presence of a debugger
defense_evasion

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	online.disdroc.app

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	online.disdroc.app

online.disdroc.app
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4989

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation4288371386846827750tmp

Path /data/data/online.disdroc.app/files/PersistedInstallation4288371386846827750tmp
Size 568B
SHA256 ab3bacb18dd96924c8868aa54f033e6b75d5ac770407498aaa3a0bd7efd70be7
MD5 52e659177686f56dd15be114358efdcd
SHA1 b0dae950e567a72e5561d45fc49323bb77948dc2
SHA512 d0816d70bdded7a563be0abd9bf7d0041900eedb9c58cb5172fc24500b01dfa4613f1d785ecfb9f9ae5b757e30f5914dfaa090268d1c977bcd16e1ae4a98514c
TLSH
T17FF0264851758B18CCD5718B785C6E443D1809562F1F14B35F7D82B0C77371EE11719E
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation8150192136376614193tmp

Path /data/data/online.disdroc.app/files/PersistedInstallation8150192136376614193tmp
Size 90B
SHA256 5a16906d304f4a5c21f719e90216cfefe409f7a44eba6600c15563ac4c85c4fb
MD5 de31d8934b7f6dccdedf10ad9e02d984
SHA1 ecf0711814ef887f039c07fd88bff52f48b27541
SHA512 99606f565dabf1fe84032e21ad52c55f8e3b7614b838054a0a58dfca90615823cf0549632047b4114da9fde76f75a30c077c575bddbea1d34e8dc5379cd6a0a9
TLSH
T1F2B012004631435184D9B30E5C8C91002D901840481A8F890A0CA29006D23D18123AAC
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/online.disdroc.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 1174974ce08b4df9af08c61a9b1875c37e7be3e69cb0e5dbfd487728e15dadc3
MD5 6a63d4b5efc3525fc34f4f3649d280a9
SHA1 3c0437d4a6226736e34aa0b36c108e5d0f39399c
SHA512 3b380f1e06abe0c3dedcd946df1168c3939c13ef45ae393edf69bee6690e1424cbbe4eda8a50dadda367404282f3fd93522dc0e2e61996445fd3ba0f2bbe623f
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/online.disdroc.app/primary.prof
Size 2KB
SHA256 f2b8ceea446be9edfa7a29e88bbf7df2412bb6c6acff0a2b239cabd7fc6dd2ea
MD5 f59e65074cf16c2010429441515a4bcc
SHA1 d58336ddc7fb55231b90eb6b49b071bc157fa7bc
SHA512 8222224f645ef6faa7a3ad1cffd9ce26887c925e3faa1ce9cd2da1e2d62fd844d79e4feebd08783ac9b54f9087e4934f9770019d00fdf1fafb090e02bcdc8bcb
TLSH
T11E512ACEF9702C00A3F4C53C6F589C918292D8BAC65C3D422AF4598F0210F6EC7A8671
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/online.disdroc.app/primary.prof
Size 6KB
SHA256 9afd6eba3b3761426a9a25acb6687281b8908973ec86b4ce460d3260efe2e659
MD5 1d5a0bc98a93bcfa908756e7885d364f
SHA1 1a3345dcd635add2e738c90c522f79ec3b1d5910
SHA512 17d3e0c76a2acf40494b0eea0bfb4c3d85b6be571d980f76360ef94ae9550379f9ed6510b6a8cc1bd3d2d45f25e9695558ed56568debae512433aa751162a6fd
SSDEEP 96:YLvmLzAVkvvaCR6cY6+r/0fyBWEsGSqry9te6aPr7O53iZk7uCUpzHKzi+Fh:YQcVkvvarnsfyB0GxrQehq1ck1U9KhFh
TLSH
T106E19FA39A4AF63838AB644E0E4849A4BBC217C27DD15FE204153B77A481CD6DD1CBE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads