5a1bc4c8d8cdb7b7932f819c5dc5c6a96884f0e7d7c13fc7a5916a6e939993ed

Analysis

max time kernel
133s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
17/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.apk
Size 3.2MB
Sample260717-phgrnaev2x
SHA256 5a1bc4c8d8cdb7b7932f819c5dc5c6a96884f0e7d7c13fc7a5916a6e939993ed
MD5 e38dc4a18beddc39a50bc653c931716d
SHA1 8c8e8ea9af889cd4550a2598b8c31e739e9bf3a5
SHA512 5ea164527ba27808725171fc1a0680b9dcafd8efa4c1533f320d0665421ba0594b68d29b98660bf5bc222b637e7131e9b0f17b4db98613a53b940fa57483fc41
SSDEEP 49152:ADEqs4/HN31376eHKKb7G9nAIZNEVsfnDUb5bdBE6MObe/gEMwYd2iTw1mS:Ks4l1GoRqyIZiQgZHqP
TLSH
T1EFF50142F794945FD4F6C33256661132612ADC16CB13938B7A0C77B82BBFAD88F06AC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.btwn.ybt
/data/local/xbin/su	com.btwn.ybt
/system/xbin/su	com.btwn.ybt
/system/bin/su	com.btwn.ybt
/data/local/bin/su	com.btwn.ybt
/data/local/su	com.btwn.ybt
/system/sd/xbin/su	com.btwn.ybt
/system/bin/failsafe/su	com.btwn.ybt

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4941	com.btwn.ybt
/system_ext/framework/androidx.window.sidecar.jar	4941	com.btwn.ybt

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.btwn.ybt

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.btwn.ybt

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.btwn.ybt

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.btwn.ybt

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.btwn.ybt

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.btwn.ybt

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.btwn.ybt

com.btwn.ybt
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4941

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/com.btwn.ybt/databases/google_app_measurement_local.db
Size 16KB
SHA256 fecda2e650a2cbb3652d60ee1843b2e8fa9858bab765aee964b59b80a73d5c97
MD5 db36daef009d2615bbd9dfdb4f4d871b
SHA1 48f15ced1db6f00a2e1082ff632fb87d27b4b8df
SHA512 bb61280afeb208d4ef43224b9f871d09eeb24a4660c2b6691f5893f459871eff4ef4a537a3d0df268fa51e74bc55a76ade599d398f6d58fde4975adb8e8b70d6
SSDEEP 6:l9bNFleLIls13FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOwa:TLDE17LzmzsRmBEyPbBvOwVQ
TLSH
T1E272D8CD8F10A206C5270337608AD3954F78551E936796472BA408615E52198B051EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.btwn.ybt/databases/google_app_measurement_local.db
Size 16KB
SHA256 438ae823cc60dfbb73c10492d6c3b859b3cef34e86ccb95a469a7e9b1c8d08d3
MD5 c213674d1a0cbdc5d9fd3d677b4c9a2f
SHA1 d07d06f0acbf34f4d269f8662514e877ab9a0474
SHA512 6e4ef7cf7e5519d458461d383fbf3bda54c81b410089fa79b952c4934145b91c9d5fcd34a471a1c803ec0488ee7ba35306b4dae134ff1c3f854b13d461cebebb
SSDEEP 6:l9bNFlkls1IFP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/L/vJ+/B:TL6Ee7LzmzsRmBEyPbP/DvJ+/0Fl6OgL
TLSH
T10F72558C5E10A603E12B033A208B93D21E38612A4323A60B3A6008249D432C8B052F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.btwn.ybt/databases/google_app_measurement_local.db
Size 16KB
SHA256 58c4529ced8b4d225b30521b0b1c713fb48c037786b7187da323d3f26d3036f4
MD5 9e6cfe20a4a306dc9ba8edac72f9c175
SHA1 916266de19dfa58e0b163216d1b7c2e65b8fd264
SHA512 ea24a04215e4242767d6e92ec5d23ab41617f842083af3330c0341d9c9278553c645f004f0637c6cf6b411aeede5d42212bab804358f216fa6597918981b6518
SSDEEP 12:TL6UEr7LzmzsRmBEyPbP/hd149blqYFlkn2vJ+/0Fl6OgL:TL6fHmz3GSP/h7499F42vJlFJs
TLSH
T12C72F689BA24D653E23B073920CBE3D2293D312A4767A61B7A154A3D6D433C9A061F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.btwn.ybt/databases/google_app_measurement_local.db
Size 16KB
SHA256 890b5d1ed2a2fdb882dc056f9dec988d515e60ef5f24db7ce03a3e3cbba3ea8b
MD5 d73f86d0a1d512a1927b1848df89a7a6
SHA1 80f0c7e4f66977af23cc5e911b9cbcc80956a61e
SHA512 f91038a482abba872ab848c6335945328c0e1ff0cd23b47d5cce0468dc8b8d6a5fb649ed6c4d7ae89fb3cbedbf355a4dbcb37804714e7f07ad3aad8149f9099c
SSDEEP 24:TLQHmz3GSP/F/PKabCCbxO499F42vJlFJs:T0GKSP/FKabCCbx754K1Js
TLSH
T178726888B964D642F27B4B3D21C7E2C2293D306B0B23E2073A065B2C6D43391A161F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.btwn.ybt/databases/google_app_measurement_local.db
Size 16KB
SHA256 0035741f0e93f334a181b3bde44efccf57556073cedeea2fdfe263216a9f047d
MD5 f23b5ca247ed39d82d61656fc100236e
SHA1 dbc8d8a74c7edfbbb0741cbff23b2ed091fac26e
SHA512 e4c495bb6f6b7fc6bb1a28f56cb9defae5e21e819ef215b4fa0001763b154786b4d2f46b6dfd0781fa7ba48a2069db746965ba8882686c64004a0856918cc7ac
SSDEEP 24:TL0tHmz3GSP/A7BKabCCbxO499F42vJlFJy:TkGKSP/u8abCCbx754K1Jy
TLSH
T17A726488B968D642F23B4A3D21C7E2D2393D30670B23E2073A029B2C6D03391A161F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.btwn.ybt/databases/google_app_measurement_local.db
Size 16KB
SHA256 afb0219478a622b16684e464458a1b811b01d12dcbc6771e384416faf44e5ffc
MD5 041d1cd36ec8a6274496834907dd2076
SHA1 bd509a90c7c4768e44e1cad9ca7873a5bd27bec2
SHA512 31b1106dfe8198ccdc866d3ec66019f1bf2bf3854632d8ab51dbd86791de0292ac8a27a216d83b0c84b4772be85f610f68fdb377398f11655edfb708bc22ec54
SSDEEP 6:l9bNFlgls10l/FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/WK//:TLuE0l97LzmzsRmBEyPbP/Wq
TLSH
T11A72268D8F10A207C1270236B4CA63951F28511F4377AA472BA40870AE53198B091F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download