Overview

overview

10

Static

static

6

build.apk

android-14-x64

10

build.apk

android-15-x64

7

Resubmissions

16/07/2026, 20:04

260716-ytm79acy5j10

16/07/2026, 18:19

260716-wx8l9aax4k10

16/07/2026, 17:15

260716-vst3mady2t10

16/07/2026, 16:58

260716-vgyxfadv6s7

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    16/07/2026, 17:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    build.apk
  • Size 5.4MB
  • Sample260716-vst3mady2t
  • SHA256 a08d496cd6ce94670e5abb17bf6b0c6527f294bc348f872dec9474731918bec0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
collectioncredential_accessdefense_evasiondiscoveryevasionimpact

Malware Config

Signatures

  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
    defense_evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    defense_evasion
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.yandex.eda
    1⤵
    • Checks Android system properties for emulator presence.
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Performs UI accessibility actions on behalf of the user
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Checks memory information
    PID:3337

Network

        MITRE ATT&CK Mobile v16

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Hide Artifacts

        1
        T1628

        User Evasion

        1
        T1628.002

        Impair Defenses

        1
        T1629

        Prevent Application Removal

        1
        T1629.001

        Input Injection

        1
        T1516

        Virtualization/Sandbox Evasion

        2
        T1633

        System Checks

        2
        T1633.001

        Credential Access

        Access Notifications

        1
        T1517

        Clipboard Data

        1
        T1414

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Discovery

        System Information Discovery

        1
        T1426

        System Network Configuration Discovery

        1
        T1422

        Lateral Movement

        Collection

        Access Notifications

        1
        T1517

        Clipboard Data

        1
        T1414

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Screen Capture

        1
        T1513

        Command and Control

        Exfiltration

        Impact

        Data Manipulation

        1
        T1641

        Transmitted Data Manipulation

        1
        T1641.001

        Input Injection

        1
        T1516

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        base.3337.tmp
        • Path /data/data/com.yandex.eda/cache/oat_primary/x86_64/base.3337.tmp
        • Size 16KB
        • SHA256 f393257a7bedbc207fb57171ead7e0dd06b021f97f9d7e088c3676aa73c08660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        [email protected]
        • Path /data/data/com.yandex.eda/oat/x86_64/[email protected]
        • Size 2KB
        • SHA256 6d39d71691bdb21e139e79ccd7a3aaabb9642d0c178cc597cc4084d1fff2ad04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        primary.prof.Dhi1Xk.tmp
        • Path /data/misc/profiles/cur/0/com.yandex.eda/primary.prof.Dhi1Xk.tmp
        • Size 189B
        • SHA256 fef19d1dcd6749dfa3a2bebfa3d24fe54597c5cafd146ef37b2e1c67c1cc5238
        • MD5 SHA1 SHA512 TLSH
        Submit Download