b8261cd81c4532ccaa0f048214a76d6941239dd934dc312fe342f7d15cc686ac

Analysis

max time kernel
148s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
17/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.apk
Size 3.1MB
Sample260717-pg2qfaet61
SHA256 b8261cd81c4532ccaa0f048214a76d6941239dd934dc312fe342f7d15cc686ac
MD5 52ba1db883898f68eee7fe5edf3571b5
SHA1 84ae3ce5b1ca68da26eafba8ffe6efe60be5248a
SHA512 f672ff05b3bc1e2aa07bd9088458400eb4247a97e216cef46d806ed9b2d8c34a6f0a0ff709c7525722ef2b6b84d17d1265fb715ed5c90540e8a7f0459934bbba
SSDEEP 49152:iEkq8UfFMDWfLP3cI6Z+Euy6KgH5ejV/54b5jGGOWfUqj6Oto+6CICjQEBETH:738qFKVIs+L9H5egRH//kl
TLSH
T1B7E50242F791985FC4F6C332156A02365126DD16CB13A38B794C73B83BBFAD88E466D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.edch.ykx
/system/xbin/su	com.edch.ykx
/data/local/xbin/su	com.edch.ykx
/data/local/bin/su	com.edch.ykx
/data/local/su	com.edch.ykx
/system/bin/su	com.edch.ykx
/system/sd/xbin/su	com.edch.ykx
/system/bin/failsafe/su	com.edch.ykx

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

defense_evasion

System Checks

T1633.001

ioc	Process
/dev/qemu_pipe	com.edch.ykx
/dev/socket/qemud	com.edch.ykx

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4937	com.edch.ykx
/system_ext/framework/androidx.window.sidecar.jar	4937	com.edch.ykx

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.edch.ykx

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.edch.ykx

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.edch.ykx

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.edch.ykx

Checks the presence of a debugger
defense_evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.edch.ykx

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.edch.ykx

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.edch.ykx

com.edch.ykx
1⤵
- Checks if the Android device is rooted.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4937
- sh -c getenforce
  2⤵
  PID:5021
- getenforce
  2⤵
  PID:5021

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/com.edch.ykx/databases/google_app_measurement_local.db
Size 16KB
SHA256 fecda2e650a2cbb3652d60ee1843b2e8fa9858bab765aee964b59b80a73d5c97
MD5 db36daef009d2615bbd9dfdb4f4d871b
SHA1 48f15ced1db6f00a2e1082ff632fb87d27b4b8df
SHA512 bb61280afeb208d4ef43224b9f871d09eeb24a4660c2b6691f5893f459871eff4ef4a537a3d0df268fa51e74bc55a76ade599d398f6d58fde4975adb8e8b70d6
SSDEEP 6:l9bNFleLIls13FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOwa:TLDE17LzmzsRmBEyPbBvOwVQ
TLSH
T1E272D8CD8F10A206C5270337608AD3954F78551E936796472BA408615E52198B051EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.edch.ykx/databases/google_app_measurement_local.db
Size 16KB
SHA256 4e0667bc6d0b1b755b2dcbb951c14d8bf73b6b2ab9cbfada9c598b116a4d40a6
MD5 b5eface169ca7d8a479342d625ad1bba
SHA1 28015f35246fb5c412dd9da047acde62d2c57992
SHA512 11249f01d4afa7b2c71fdc336520104ffbd6ee1e8b296f0688ab6255cf823b921f1a7ee4a899e3e08f5d126ed35ff9714b855be3ade58a489545df467cc0813e
SSDEEP 12:TL6Ee7LzmzsRmBEyPbP/DvJ+/0Fl6DpOL:TLwHmz3GSP/DvJlFWpm
TLSH
T17872E5CC5E10A602E167073A608A93D65E38611E4367965B3A650964AE532C8A152F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.edch.ykx/databases/google_app_measurement_local.db
Size 16KB
SHA256 aa05b6a681c0d1666564ac6101466ed19071cadf45ce301ab0d8a225773c427b
MD5 1cdd04f022af470d0a165cb4220f47f0
SHA1 f3bc2d5529943c59f098a5e1679c15f1e6872983
SHA512 e73448549c006b5417fb5ab0bc48b19bd73e3b5ffce785215ded64775cbf0cbb1307cffce2bfe394c5b1f83b0581eb110b12beee9c1967214ff06487bbc3e7db
SSDEEP 12:TL6UEr7LzmzsRmBEyPbP/hd149blqYFlrk5dvJ+/0Fl6DpOL:TL6fHmz3GSP/h7499Fm5dvJlFWpm
TLSH
T102724688AA24D653E2270B3920CBE3D26D3D302A0323970A3A124A6C6D833C8A021F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.edch.ykx/databases/google_app_measurement_local.db
Size 16KB
SHA256 da8125bad374315566d114205a84800548cbf110b1fd198c907decd7c3cc3cb8
MD5 252000df5b4d03d12ecc4159af741f37
SHA1 4d5e429f177eb1ed7f92c8c7d552a172a6773079
SHA512 43423fc8b7da36c7b6ce4c1bcbbba3054917fe2b6131cfadafbaa3334b089511f233a2d8c2d04e95147a0488d5845d598a2f98303b24bbbb983704a92d902e84
SSDEEP 24:TLQHmz3GSP/F/PKabCCbGjT499Fm5dvJlFWpm:T0GKSP/FKabCCb005m5J1Wpm
TLSH
T158726488B974D652F2B74B3C11C7E2C62A3D30AB0723D3073A069B2C7E833809021F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.edch.ykx/databases/google_app_measurement_local.db
Size 16KB
SHA256 7d29eea616023aae2b3fba956630817346a572c28ddc093547dec166347f318c
MD5 59f08e427e031703eef531bb95c8215c
SHA1 eb4df0abcc9c1e125cb2b2e64c96ea6ce7361624
SHA512 e8df4277e7450878472a84bccbac087dfeb8d8f1447b715cdf4261c42c3411e35685c005a291e27cf20cadd6aed6fe4de2d02b9e1c5c81d95b02b01c6e2ffbdb
SSDEEP 24:TL0tHmz3GSP/A7BKabCCbGjT499Fm5dvJlFWpU:TkGKSP/u8abCCb005m5J1WpU
TLSH
T136724188B968D652F27B4A3C6186E2D6693D30A60323D3063A029B5C6E823809121F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.edch.ykx/databases/google_app_measurement_local.db
Size 16KB
SHA256 afb0219478a622b16684e464458a1b811b01d12dcbc6771e384416faf44e5ffc
MD5 041d1cd36ec8a6274496834907dd2076
SHA1 bd509a90c7c4768e44e1cad9ca7873a5bd27bec2
SHA512 31b1106dfe8198ccdc866d3ec66019f1bf2bf3854632d8ab51dbd86791de0292ac8a27a216d83b0c84b4772be85f610f68fdb377398f11655edfb708bc22ec54
SSDEEP 6:l9bNFlgls10l/FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/WK//:TLuE0l97LzmzsRmBEyPbP/Wq
TLSH
T11A72268D8F10A207C1270236B4CA63951F28511F4377AA472BA40870AE53198B091F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download