Analysis
- max time kernel
26s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
19/07/2026, 18:12
Static task
static1
Behavioral task
behavioral1
Sample
com.kimcy929.screenrecorder_1.2.6.7-349_minAPI23(nodpi)_apkmirror.com.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
com.kimcy929.screenrecorder_1.2.6.7-349_minAPI23(nodpi)_apkmirror.com.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
com.kimcy929.screenrecorder_1.2.6.7-349_minAPI23(nodpi)_apkmirror.com.apk
Resource
android-x64-arm64-20260325-en
General
- Target com.kimcy929.screenrecorder_1.2.6.7-349_minAPI23(nodpi)_apkmirror.com.apk
- Size 4.1MB
- Sample260719-wthawsaz91
- SHA256 7de9f9cca026aa2003436faf087d2b57eeaddb5b22971cb07a728a88a5d7fedd
- MD5 9352453802d01472c0dec4f1ed3c0854
- SHA1 97908110d716f0d2b368ae27adaaf2c80b667fda
- SHA512 cb92cea3a83eee754222d6897e65f18f79ec830fc2e0e95db012f34fcdc981dd6fe13ae1818f3601275a4b76ae3d4a338688b604ab1ee026969b009c97a42830
- SSDEEP 98304:LZHaj8bfrZ2acqf2FuiKt14rdz6Vrh0CD5LTx7:LZItac6/iKt6rAVrhblV7
- TLSH T11416CF87F7699E2ACC7240B24D9A6231266A4DE68E8397873D44375C38771F81F49BCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 1 IoCs
ioc Process /system/app/Superuser.apk com.kimcy929.screenrecorder - Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.kimcy929.screenrecorder/cache/1582435991586.jar 5020 com.kimcy929.screenrecorder - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.kimcy929.screenrecorder - Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.kimcy929.screenrecorder - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.kimcy929.screenrecorder - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.kimcy929.screenrecorder - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.kimcy929.screenrecorder - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.kimcy929.screenrecorder - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.kimcy929.screenrecorder
Processes
-
com.kimcy929.screenrecorder1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5020
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.kimcy929.screenrecorder/cache/1582435991586.jar
- Size 9KB
- SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
- MD5 e8e0527a01aefdb89afd2c508f131da1
- SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
- SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
- SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
- TLSH T1C412AEB4BF77093CD0DB0DB8CA67E800A05F25841AA7D514E0656066BFD47B5F1E315A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.kimcy929.screenrecorder/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- TLSH T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.kimcy929.screenrecorder/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 0f68a933be7c5f28400253b1c954c3604a2e65268d7c24ecf7ffcfd1386fa85e
- MD5 f64864b55a7fcda455379a4e2691be5d
- SHA1 e090f4c3388317684edcfc34469b8bd1fb628ecb
- SHA512 3b0c4de4e7281d16e52929aab61315f49e43ce5964e46bf7d08894139acf186a2845c252d951fcd5b963319068d122e6e31002c0f9de01236d99d33fa3034159
- MD5 SHA1 SHA512
- Path /data/data/com.kimcy929.screenrecorder/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.kimcy929.screenrecorder/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 f922001cc3490ab29b141fed7b16e91056938e58ca3757b4933bbb60fd0138a6
- MD5 2bdcab3dc0f27425f999fd3ed396683d
- SHA1 8dc051c803e352a9dbfce19b84126e06a4a5416d
- SHA512 f1ceee59de57938e57eb724de6717c3c455dbd5bf7d70f019a8db5303d78d4fb0c7d7dc47b7983ede2ecd48f7d01209c0ab0db6c8b3faeaa73a569992c224273
- SSDEEP 12:Ky5W7JWjyzdTRmBEyPbP/U5Wbi5WF9s5WYOw2:Ky504yzyGSP/SjA9sX2
- TLSH T11672C269B38285D2E38653B2D0D4CB461DD0568B4362CB8F36120A526C22BCAE470D0D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.kimcy929.screenrecorder/no_backup/androidx.work.workdb-wal
- Size 108KB
- SHA256 6420bf99ccfbce609c744eb4c28e087fb78c8ae7fab0dd1fa600cd32d9467d92
- MD5 de9b48295dee9bb60877969cd9759fab
- SHA1 dffd557fb90fea1c1d192b283cb39c69d3fbd91a
- SHA512 02d7ab31b475cd306235372c8eb018e5c3d179304631e1f06bf8598838b0e70503718ef79d82166b1b5cd9ae912afdd4a3b370e3799a11bb69f1fa5841f6b5c8
- SSDEEP 96:NkZ6+hdjnHtDRMpf8UzS5+TD8q0ExPsGAyPLd:uVdjnHt9Mpf8UzS5+TD8q0E5HV
- TLSH T1E5B31F5E0F1A2580C5D998F0D5D00FA1792E416FC393E3E976920175AED2922DE39CFB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.kimcy929.screenrecorder/cache/1582435991586.jar
- Size 20KB
- SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
- MD5 fde2ee00cbd121cfab5290b078aa3ceb
- SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
- SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
- SSDEEP 384:Za0jn+huC5sMvRuvypj6f2ZzJgm+poK+l8m4qxXpj/7wyxBLBiok+9VQ3AKm8:ZU5sMvu/f2/gm+pDAPzj/Dip+9y3AK7
- TLSH T1D592A457B3918563D57CCD3F3A3ED390EB20B210CA23970728459AAEBDEA3D525D1AC4
- MD5 SHA1 SHA512 SSDEEP TLSH