Analysis
- max time kernel
17s - max time network
153s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
13/07/2026, 06:14
Static task
static1
5 signatures
Behavioral task
behavioral1
Sample
channel.broker.decoder.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
channel.broker.decoder.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
channel.broker.decoder.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target channel.broker.decoder.apk
- Size 12.0MB
- Sample260713-gzsaqaev61
- SHA256 d56920ef82f3932e3b716c07335d7866d4fe52309600edf5abfa2f6d2bd00e0b
- MD5 3d375cf6c7f8b91fe7af1028d5662f83
- SHA1 3f71da9c481850e3800524d43f832c92d1234e3b
- SHA512 39c5dde12ecf09a907fb9f7c7597ba1424a5b4b49c0d3ee2f62933318b1dac1f265190171733ccec816dffa9b0c350255aa9f1c623dc94d724377adff61172bd
- SSDEEP 196608:I03CVyVwKRE9uw3m/qUH1IVnY88Ph3Yow5G/xy/XMPyZ71rfYjaBMmD+scaspDdh:I03vwKREMM2NH6nb8Pho95Y49Z71AQhS
- TLSH T1FAC63383F788543DFCF787321B75423620568D63C363A68BA940B17C29B76D48A95FE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener transcoder.expeditor.shuffler - Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
description ioc Process Framework service call android.content.pm.IPackageManager.canRequestPackageInstalls transcoder.expeditor.shuffler - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone transcoder.expeditor.shuffler - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver transcoder.expeditor.shuffler - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo transcoder.expeditor.shuffler - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo transcoder.expeditor.shuffler
Processes
-
transcoder.expeditor.shuffler1⤵
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5047
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/transcoder.expeditor.shuffler/files/profileInstalled
- Size 24B
- SHA256 d4325f6d431c3d9d15f2cc34982ab4fb87d8bf1e4164a59af37635a6a6529997
- MD5 f0384390dcfe328c6867c096bc4869f7
- SHA1 905cbe5ffd6f0a9ef3e4c1f6f3952f3d1b038d17
- SHA512 d2c29a8979c2b34198b6dba781d71e3f1b22248f3f29c8a2b1446dcd2f47b0e717b10dd219537d92988a4d433ede686238b7e13a527336cd55f63e52ba0a6257
- MD5 SHA1 SHA512
- Path /data/data/transcoder.expeditor.shuffler/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 bcd2a6afe8e6fe2e1458705e9404f7b8d18fe37037a67113595daf7f87a30389
- MD5 eaa5c0378309d2bba4a99771f4f8b4fe
- SHA1 7dbab7016977351f035113035959104bac7c4186
- SHA512 5835b11d3801bbb21529d47eed48d77ef6645d12bc0ac0728dcf2a4755f10ded0752a5e19a86aa3f194fde40f8242cbc0952bfaf701e7a51b56d2272ef2cbc8f
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/transcoder.expeditor.shuffler/primary.prof
- Size 90B
- SHA256 4b97489bec60a30894afcf6839f7dc8621f457b595d0b4c1db1c60f172cae013
- MD5 76cf0e71a01bdfab0c559b8247ea1724
- SHA1 92d20b5db7662d8bf8067e49cf6fcb540a648aa4
- SHA512 c804d3fd58c89a81361bcb6a2215b533335c2f28787d1b4f00a32be09824793918483ec01dee7f2b942526512651851d43ade36e483068d48728d33c0f3972f2
- TLSH T149B012D0A8183D84E51C041511570B324B908181554352C159E5421B580A127415C001
- MD5 SHA1 SHA512 TLSH