Analysis
- user interaction
yes - max time kernel
26s - max time network
316s - platform
android-10_x64 - resource
android-x64-20260325-fr - resource tags
arch:x64arch:x86image:android-x64-20260325-frlocale:fr-fros:android-10-x64system - submitted
17/07/2026, 02:32
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Chrome.apk
Resource
android-x64-20260325-fr
7 signatures
150 seconds
General
- Target Chrome.apk
- Size 237KB
- Sample260717-c1hepadt5t
- SHA256 ae5f8e17729b60b7e35177929cf62411fd456c98318134ba1fec6ab23b9f35ea
- MD5 5b3b08f2d36b16b0526683be1299e464
- SHA1 d17fb3bb7e83f6c2612d1439e5ed4f47e5a3c3b2
- SHA512 91cefd89df7d376720e49afb8461f870fd1f8aeefc2c5dd52fc4302278bbc0c1fad54bd3f19ca309fb0f01040e4dbb21ad63f8830ea19c5f082e28f4b6f037e2
- SSDEEP 6144:QULoo9q3RnmLmJblS860YnPdj9oQzZjImXppfp:QULoFnmgS8BA/oU0mXpJp
- TLSH T14B3423C95F30FD66EE4B33F4E8C1D223F58455E5A111C307496D22642CAB8E9A3DB2DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.telegram.service.v0287050c - Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
description ioc Process Framework service call android.content.pm.IPackageManager.canRequestPackageInstalls com.telegram.service.v0287050c - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.telegram.service.v0287050c - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.telegram.service.v0287050c - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.telegram.service.v0287050c - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.telegram.service.v0287050c - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.telegram.service.v0287050c
Processes
-
com.telegram.service.v0287050c1⤵
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5068