b8261cd81c4532ccaa0f048214a76d6941239dd934dc312fe342f7d15cc686ac

Analysis

max time kernel
134s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
17/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.apk
Size 3.1MB
Sample260717-phfvcset9z
SHA256 b8261cd81c4532ccaa0f048214a76d6941239dd934dc312fe342f7d15cc686ac
MD5 52ba1db883898f68eee7fe5edf3571b5
SHA1 84ae3ce5b1ca68da26eafba8ffe6efe60be5248a
SHA512 f672ff05b3bc1e2aa07bd9088458400eb4247a97e216cef46d806ed9b2d8c34a6f0a0ff709c7525722ef2b6b84d17d1265fb715ed5c90540e8a7f0459934bbba
SSDEEP 49152:iEkq8UfFMDWfLP3cI6Z+Euy6KgH5ejV/54b5jGGOWfUqj6Oto+6CICjQEBETH:738qFKVIs+L9H5egRH//kl
TLSH
T1B7E50242F791985FC4F6C332156A02365126DD16CB13A38B794C73B83BBFAD88E466D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/data/local/bin/su	com.edch.ykx
/system/bin/su	com.edch.ykx
/system/sd/xbin/su	com.edch.ykx
/data/local/su	com.edch.ykx
/system/xbin/su	com.edch.ykx
/system/bin/failsafe/su	com.edch.ykx
/sbin/su	com.edch.ykx
/data/local/xbin/su	com.edch.ykx

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4836	com.edch.ykx
/system_ext/framework/androidx.window.sidecar.jar	4836	com.edch.ykx

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.edch.ykx

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.edch.ykx

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.edch.ykx

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.edch.ykx

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.edch.ykx

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.edch.ykx

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.edch.ykx

com.edch.ykx
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4836

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/com.edch.ykx/databases/google_app_measurement_local.db
Size 16KB
SHA256 fecda2e650a2cbb3652d60ee1843b2e8fa9858bab765aee964b59b80a73d5c97
MD5 db36daef009d2615bbd9dfdb4f4d871b
SHA1 48f15ced1db6f00a2e1082ff632fb87d27b4b8df
SHA512 bb61280afeb208d4ef43224b9f871d09eeb24a4660c2b6691f5893f459871eff4ef4a537a3d0df268fa51e74bc55a76ade599d398f6d58fde4975adb8e8b70d6
SSDEEP 6:l9bNFleLIls13FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOwa:TLDE17LzmzsRmBEyPbBvOwVQ
TLSH
T1E272D8CD8F10A206C5270337608AD3954F78551E936796472BA408615E52198B051EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.edch.ykx/databases/google_app_measurement_local.db
Size 16KB
SHA256 39ab0db9f6a2a41cde56a805cb157039f2f56b465309ea949f2a76f6d397335a
MD5 cbae3569d5d4a755c5450e8a063e7c66
SHA1 f38246d29c3f2f90d952cb62ec198d1f5135d42c
SHA512 134885cfd2556690a5d9ac4f7379b1a9e37b09a0b71499dde35b5258c31ca957aed3369d3ac8ea36579adfe59c9931261add51788fad9189726db3d7213dfe7a
SSDEEP 6:l9bNFlkls1IFP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/L/vJ+/1:TL6Ee7LzmzsRmBEyPbP/DvJ+/0Fl6KgL
TLSH
T1C872558C5E10A203E12B033A208A93D21E38612A4323A60B3A6008249D431C8B052F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.edch.ykx/databases/google_app_measurement_local.db
Size 16KB
SHA256 0971db658f1b2097d057ae1d17b483048ef9dd6c008ac4c6ff5062790e992465
MD5 be522ea75e89e4ef81302b926123f399
SHA1 74f13d9b2880e9308dd658a30bd3fdcfde7b28f5
SHA512 a8a23b8c16a95ea6493e493f7b94fab1e05c697589a6f0f6b897e9c0b582174cd46e3fc43d92eeec52651480b49656c95f0097a935ed987ba01e726cde724e2c
SSDEEP 12:TL6UEr7LzmzsRmBEyPbP/hd149blqYFlkz2vJ+/0Fl6KgL:TL6fHmz3GSP/h7499F82vJlFts
TLSH
T1C2722B89BA24D753E23B073D20CBE3D2293D312B4767A61A7B254B3D6D433C9A061F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.edch.ykx/databases/google_app_measurement_local.db
Size 16KB
SHA256 f3bb6ebba0dd0cd6504d68afd36c1661b50fc238bbbf9a21b11eca019e075460
MD5 ddf959af66fed470ebfc00807acf24c6
SHA1 05cbf353a5837c074b33bf49210c0bdc0f4d51df
SHA512 2efb7a7ce770c055f4b8e81631e6394362d00c75ebb74db216ecfd5f06985a79891af7030250d1ef15926607e06b49378be62d60221045634596f8cece61885f
SSDEEP 24:TLQHmz3GSP/F/PKabCCb63499F82vJlFts:T0GKSP/FKabCCbH58K1ts
TLSH
T17C726488B964D643F27B0B3D21CBE2C22A3D316B4723E2473E669B2C6D433819121F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.edch.ykx/databases/google_app_measurement_local.db
Size 16KB
SHA256 dad8f45cb9e1515bb3cb9f5b4fe927b10f2f53874db8fe891df5c31c690454c3
MD5 ad22298db261cabd5a54e337bbbb58dc
SHA1 abddf65dda435de8a768a45478ca68e131e7c10b
SHA512 1a681026cad48f2ca06415253c7d99c900599f1bc554c3e9871bf42d575d7da88c823b00f928c42ce25e1fcf34604c3bd933ac807ca185eb057a4eb7ca05b7b1
SSDEEP 24:TL0tHmz3GSP/A7BKabCCb63499F82vJlFty:TkGKSP/u8abCCbH58K1ty
TLSH
T1FB726488B968D643F23B0B3D21C6E2D2393D31674723E2063A229B2CAD033819121F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.edch.ykx/databases/google_app_measurement_local.db
Size 16KB
SHA256 afb0219478a622b16684e464458a1b811b01d12dcbc6771e384416faf44e5ffc
MD5 041d1cd36ec8a6274496834907dd2076
SHA1 bd509a90c7c4768e44e1cad9ca7873a5bd27bec2
SHA512 31b1106dfe8198ccdc866d3ec66019f1bf2bf3854632d8ab51dbd86791de0292ac8a27a216d83b0c84b4772be85f610f68fdb377398f11655edfb708bc22ec54
SSDEEP 6:l9bNFlgls10l/FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/WK//:TLuE0l97LzmzsRmBEyPbP/Wq
TLSH
T11A72268D8F10A207C1270236B4CA63951F28511F4377AA472BA40870AE53198B091F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download