26bcca4d9b6d2b88d41e1ea3eae1d094313a81a95e39d943bcf685593aa096ad

Resubmissions

10/07/2026, 14:31

260710-rvy8ksbs7k7

10/07/2026, 12:16

260710-pffftabt7p7

Analysis

max time kernel
79s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
10/07/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PHDULA.VIP01.apk
Size 3.5MB
Sample260710-pffftabt7p
SHA256 26bcca4d9b6d2b88d41e1ea3eae1d094313a81a95e39d943bcf685593aa096ad
MD5 f22709e8ad20cac8bc59aee0f82b8220
SHA1 4cc101c0a8ea86b06e83134757df78ebabb156cb
SHA512 4dd1abbbfc2031504411708dddbfac03a918daa3a699fa71631ca15ac329ee60f8b433b234600e55f23811bd4339b8eaa9b18c94e25304f1cbceee485f4435d3
SSDEEP 98304:yll/+rjUyOPudo9WR0wGy/vIBKR+cgx6bBR:yL+rjuAl0FBUgAbBR
TLSH
T1C9F50183FB48E96EC9F383368636012765568C66CB53D3875951B3383DBBAC05A85FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.pengpai.system.ph.dng1.template_13

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pengpai.system.ph.dng1.template_13

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.pengpai.system.ph.dng1.template_13

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pengpai.system.ph.dng1.template_13

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.pengpai.system.ph.dng1.template_13

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pengpai.system.ph.dng1.template_13

com.pengpai.system.ph.dng1.template_13
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4816

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.pengpai.system.ph.dng1.template_13/databases/com.google.android.datatransport.events
Size 40KB
SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
MD5 1cf3f63c021d755a21623e6d0e86dbc6
SHA1 e40e0f1faa61abcca7ba3394c54c92ff7334b49b
SHA512 38d72e14f3513ffd26989cbda3df46ed3dd6e731bdfae56440eff6b64760cc13f91014281c9add61e018fe3529e49c63a6892ca22479515816c768b546244466
SSDEEP 48:TfkL3u59MENZBdUdndVd/7T9IvdldHlq8/JqYpqPS:zkL3KMEX0xIyNYMa
TLSH
T1AF03EF5D4A202611C2BE083FD7E257931B3CE35F6B2387612E904CF6DDC68B6B821998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pengpai.system.ph.dng1.template_13/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 a38b8f86129206407944af948b6a467aa30796e00d1adea954863d66bdab1939
MD5 c18e789e2d8b862032ae783b5d554309
SHA1 a91cdbe3395413301abb881e62161cf65f3e634f
SHA512 0ddb7e4f24fc944a0d1e25b157a563570689da44bfc98da528b3807ce721b4179af3d72566bb490b28a301fca62101cdffb894e1c0331ba264de1ba78159fa00
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pengpai.system.ph.dng1.template_13/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 28a7741a6f5e1a84a4e4a14dddc126ed56967d42c1099ad11d9ca3130fb66e0a
MD5 25b25d00c39d17b084c19e7494267589
SHA1 46ef48e2095996b63ac3854310500084d9e7a735
SHA512 aa9f907ca43a8b84beb13e6037d8e3977f4314ff4a70ca3d86eaa53072501518cf1ad415f4faa7462d49f490c8c58dcc29a37d570ae2966fcf0f283dac9eb044
SSDEEP 6:7+/l99cOn1gpg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKmc:7+tEqLiuWdYRmBEyPbXc
TLSH
T13802C0CC63811C13C82F9EB790D583500F01F728E171CB5B26D208943C074ECF5A0D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pengpai.system.ph.dng1.template_13/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 05e205010bf429baabf0e7ddef57f2a2afa28a87981dd683160d2779e43c2b98
MD5 3e4e5a28330b9198d107a1ea3bf707cd
SHA1 ea386791e2ddd398695d919ffcd3184e67c34719
SHA512 ad01c17dabb0e42f98705dda548ac86f2d9bb035c5344f25a59bf5bb7ab05a504784cdfc58c3a83aae3c77738ede1a5c5b007c683acfb6c038625eacdde239b0
SSDEEP 6:7+/l9YFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKdt/D:7+tuBqLJdeWRmBEyPbID
TLSH
T14E02228863800A23C22A5777E4CAC3502E14A7389233CB272AB10C542C476CCA890E80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation1458886630290591311tmp

Path /data/data/com.pengpai.system.ph.dng1.template_13/files/PersistedInstallation1458886630290591311tmp
Size 90B
SHA256 32aa564f17973f0777baf3ef1535f170bbb550c6af18ecf1b70d083e6917d9a9
MD5 7193d74734d114c9b6c3dfaab2571de9
SHA1 c55b84876951a06c5acf176ab54ae23a203d9dc2
SHA512 27c4d6991af8a9c3e7dcac01efc5b748689fe913a1f9b9b8517496d3542ab7f510293655e2cd4a097622046512212660302a582d694ea53654577499f3340aa7
TLSH
T136B012405A7141428599A7231C4C96102F51244444098E080E19D0C041C51D0C163EB4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation5245171700244210239tmp

Path /data/data/com.pengpai.system.ph.dng1.template_13/files/PersistedInstallation5245171700244210239tmp
Size 570B
SHA256 502d4a8342eee78902d6f28e319293c07bccdf85511d6e333b864cf2aac20aff
MD5 22e6204c980258bcbde975bcf4b21c87
SHA1 bfe4491f2d7433f0966230ad7259f8c6a615fefc
SHA512 2503ad79c83ea7b5c425b052f40c648160f5008b113840eca66574df7a1b44adaa6164e3083126e940e610d6ce2b87f728a268c1b3ac77be206a1c0eca68b0de
TLSH
T143F041EF6D508D4EB55C42362D9C1D046E4054B40A1A6BCD8EAE48D866D682CA00AD24
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads