45c5500eb5f173c166664244ed30e3177d47cfb48435a37ad20c94b2a016b109

Analysis

max time kernel
149s
max time network
156s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
21/07/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Maha_2_1_6.apk
Size 4.3MB
Sample260721-pltwdsware
SHA256 45c5500eb5f173c166664244ed30e3177d47cfb48435a37ad20c94b2a016b109
MD5 d2d7bc528eb391f056f3867548627a5f
SHA1 c42a5021c2aa093cb3ef50470a07e49ce4c5da91
SHA512 0e0acc74744b8adbc68002f6e1c56a67ea32411d69b77aa1fd81bcf8ae52ec61547e7d0ea46350d482f80afdf4dbdc5841c08dbbd953b4a9ae3ec339a8a33775
SSDEEP 98304:5R53MACpV5zr4+HwdM2clsv1UInoolrZn/pwz0KadZXTS/bPcXB/m9DTjv:tYPzlsv1UIXn/Gz0KmM/Lc4Df
TLSH
T1A2261292F368AE2FC873C0360ADA433112568E6AC753EB07645877693C7BBD80E597D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.sogo.Maha
/system/bin/su	com.sogo.Maha
/system/xbin/su	com.sogo.Maha
/data/local/xbin/su	com.sogo.Maha
/data/local/bin/su	com.sogo.Maha
/system/sd/xbin/su	com.sogo.Maha
/system/bin/failsafe/su	com.sogo.Maha
/data/local/su	com.sogo.Maha

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.sogo.Maha

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.sogo.Maha

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sogo.Maha

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.sogo.Maha

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.sogo.Maha

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.sogo.Maha

com.sogo.Maha
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4819

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db

Path /data/data/com.sogo.Maha/databases/OneSignal.db
Size 52KB
SHA256 491c9687657ca71661a5cf42a763249f88fa222edaef20eaf552c4599458f99e
MD5 f1427539ecc4cedfa892efc1776ba3ed
SHA1 814607670e99768ae6212224860b0a1fb93733db
SHA512 c3ebbf63c4e876e471848f810e7ad7c0cb56a946230073b5196f7b3ce5d1f144c800ec5787992ff2ee057f712d7c7f1b92b47761294aede13183c796e5ab043d
SSDEEP 24:TLLS57ZBUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvJqrEqjUix5+xGTrOPjwVw:TE7AcrA0oJxqrKcrObMoOS
TLSH
T194338BCF4B862191EFC765B3155252E44E3B610E889317A63BF760245E83B16D72387C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.sogo.Maha/databases/OneSignal.db-journal
Size 8KB
SHA256 2288e01cdb3fd616812f11f333b3fa4788f79c397640c62050f95a600b7ff109
MD5 d5df2496fd42cf57a005381793006429
SHA1 58a9a81e355f38563791c0ac8191667d63e177e2
SHA512 e1820d1a66bb8dce1d2eab12026b6e603dfe07aee5b8f5d1ec713d57187e9ff7acb63211646c05ea8c28aaea91ad0695d8ed33d797a38a1b794cabed2234596e
SSDEEP 6:7+/l9OfYFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKml//Ib:7+t0fYBqLJdeWRmBEyPbpXm
TLSH
T10302228C63430C03C4291B77A0C883402FA0A728D273CB0736D108A4AC0B7CCB8B8E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.sogo.Maha/databases/OneSignal.db-journal
Size 512B
SHA256 2c767d81c74aa6ec7939f84028cc93958019b7cf01b37f78ba3f8cd0618c660c
MD5 2255f34250d60203217d693e18df1200
SHA1 f74c72a803c02b25cc716bc1d50a4e96d19bbbe1
SHA512 8a2202b8ab838973ac05b8e3c4bc8d2050497186ecbefad54d929512d04da6cfe010f8a08e8ae0386313e2986bb77f27805e9eaabc826377bc4bfe7fc6aa76ce
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.sogo.Maha/databases/OneSignal.db-journal
Size 8KB
SHA256 bd38fe2c5635ba5ee98367f04f26065d0fd896f2b610cbea33e45a0104c58647
MD5 0e16e1a9f123d5e1b1721ae833e4e1df
SHA1 1659a6f0b1ece9c3b7eb3a5ce356725c3ef8296b
SHA512 75a3245c18096e2e4327a7c1f460a1b8df61e9d37baf9b1c95b087d1aad933bfaff0790181dc1f8db27ff2edb8b705fea16d3b360af2e0582843532e57fb28a5
SSDEEP 6:7+/l9wGn1Qg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKCQ:7+tuvqLiuWdYRmBEyPbm
TLSH
T171022288A3801A22D92A167790D483800D20AB2881A1CB3717920899AC8B4DCE4E0D0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.sogo.Maha/databases/com.google.android.datatransport.events
Size 56KB
SHA256 2e609e7da29449f52b58e566ab3a43f872b03dad126eec49724ffdeda75f3a94
MD5 9a7f4ab135fa41bfe8f01e6f0da3b268
SHA1 2744eebb6810fc7cbfabb26140577d98eb1bf769
SHA512 4a6886cd49912cf66328c18a40f2527ef37851a58f1b73e98bf54b5abc14301bf23088b7431f182a3d25798204f808df5ef34c95b3d190e7aad43a1847f933fe
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSbYZ:rAMEX0wIyNjaMZ
TLSH
T1C843839D1A2C2220C57E283ED7E243635B3C93DF172392223D908CF98DC246974358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.sogo.Maha/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 6ae9ffec1dfaab1f79415bb4e345b75de447a70935cb0bab8640a64b1a8624ba
MD5 2aa268e3f329cc92741a29c8f2ddbc84
SHA1 15646df195e91ed1dba22de5bb8e501b456e1238
SHA512 ac3fa8552f7faa2b8dfdbd0a1d067365e4fdae154033cd5b85b06306300ed29034c74df971a8c4267c6a4e0721f94de2eab9b67c1868b3591e8a547ef54ddd04
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.sogo.Maha/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 c59545ffdfa881af72c6e0a8fab8ee8e354a85c43b4d7d80014409f6fef6f218
MD5 b600c1e24dc9f92cf827e3a4186718f9
SHA1 9c6f2f644a1900afc708b1f3c2fc645d8b7276e9
SHA512 9dcfc9bc35547854cf1529f3b51dfcb2196385658c655e2a28d2daaaa61b1f595518fbfc1995a4fabf07dd0d038b0debe225ff7f6fef6856c12078b3c2271d44
SSDEEP 6:7+/l9IXGn1gZg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK+q:7+tUvZqLiuWdYRmBEyPbM
TLSH
T1B002228863810812CC291A7790E883400E09A72881A1CB1716D00894BC876CCE4A4D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.sogo.Maha/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 276399ac127cef601ab419848d40ae91be218f30e78614ea0b040486386bd5f1
MD5 dd0b2c6054506d0eb7726c24b4b4d35e
SHA1 1b988967307efe97df3302f31841fce577fce48d
SHA512 849fbb5fb7f56bdd508edf61aa5f288194d774842f5366ebe6ef29f7d78720911db1b65f8ac55716dc6570e960d20f81dba12887d37c20481b16fd2c6dd74a2b
SSDEEP 6:7+/l96uPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKpl9M/i:7+tgCqLJdeWRmBEyPbU0i
TLSH
T14602228963800803C02A6F7BA0CCC3401E11BB2A92B3CB07169108642C066CCA8D0D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation4481931254854692032tmp

Path /data/data/com.sogo.Maha/files/PersistedInstallation4481931254854692032tmp
Size 569B
SHA256 3c98da01b993b12fb7aa5b545598312672379b5d9e253e56877dcbcd175c1dbd
MD5 f7e5a0b9fa549b76636541c9812ce873
SHA1 160f8b5e1d2e9da9515f504a52fbee9c2cf39462
SHA512 35858991f551e7641d820c0004c30facb3665d6cd2e08ee49fb4efdce688ce6277a353857249b60f5df405433b9f59d75b66ef9d08972aa6b1dfa0a09d1e630f
TLSH
T14AF0267717179029CCF9210A204D6CC05F356964170F29E1DFC89D6C7ED85BEB747511
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation8928322081871465830tmp

Path /data/data/com.sogo.Maha/files/PersistedInstallation8928322081871465830tmp
Size 90B
SHA256 14c7c394bbed950c0dc0a78f87ba02040e6c76fa7cf140046a21243e0ae9476c
MD5 6ce41a90ff9b727ad3c1f0f1c73ba6ea
SHA1 6fccc855277b2dad38d137f1fb20220933263e3f
SHA512 cf392bca482ac0faea2ea9a653dfc702289430655c779905d7c1fe5116cfcae253e4d053f55ffa54d93ae9da42cca9b3ef96a6fd7e819be04e647bafc561dab9
TLSH
T1A1B0121056724151CC86B3131C4C95C06E925840080B8A354B0DB86002E11D0C2439D5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.sogo.Maha/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.sogo.Maha/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 b7821414b7b8047ea0a366b1abe5be202f3323f497905dda429a5fccf0b43aac
MD5 92d2f87069043aaa62be35b2deb00c7e
SHA1 06e35a8069418fcfbf5842797d78f84d0b727de7
SHA512 267f80c5148783c02bcae8516089f97168ce6d1ece080ef67f64424828551fc123d346bc01e6603f3f6e324815df81b07cb8ee43d702a39f3a8cd7ce1b417552
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.sogo.Maha/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.sogo.Maha/no_backup/androidx.work.workdb-wal
Size 193KB
SHA256 e94dfa507480046239e170f8e77f0735b7e2d0ccdc4dd7d399be61eafabc04e3
MD5 c53fddaa320fed467e31f4f3357da74d
SHA1 b528228560f2ffd2c13c7d42f12292825f99950d
SHA512 b60ba76b7c373387f33fbb6a4245c6d447791d3a0c72245cad941cf3b9d3ac16e049922ae8d878036fac070e1ceee0c83979753857df6e960752c52630028e58
SSDEEP 96:lE21DtYirCUEzEoUUuZuvE21DtYCO2VE21DtYd6E21DtY:l1DtYoCxU21DtYC71DtYs1DtY
TLSH
T16414AADB715E94A0EF5B007FED5210E608B719F82FEB1510E3AF839500D9212D7AF286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.sogo.Maha/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 bd58cb2b7de2ac7d43f649546a5fd8db71d02b9e693c26e5211d23a69b2e6946
MD5 2c16fd70ca4b27be39ca453c4442beec
SHA1 75df7233e51ec60473921a0e5719a4cb0c7d7a5b
SHA512 18bf3a9502707c6c6d6220438c920bffa7fad42f9dacb591de1645cc2ab0ad21c8596a7269f42b92e9736315bbeed834011a13b4a4b8b3834816691ac706f08f
SSDEEP 6:KAE+S/jJg9FZde/kPlOERX4PBX4ogLugMBX4suuK+/Ua3olsllkqiOw2:KAE+S/1qzdeWRmBEyPbP/Ua3jkTOw2
TLSH
T139722BAC634996D3D43B17B26CE8D3800E716B3C532EC76B37A304626C0A7C9B490F88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.sogo.Maha/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 b4279803861bfd5cc9d5f7a57df0c43966d4189c204f890eac103a2e74c597a2
MD5 43fa90b022a2705137ad9c7f113ffff4
SHA1 b786e2198cae4dfa48914bb6d9189062c1369473
SHA512 1b7ac746c2611655c4c471c1005ce2bb7f43be2a01cbe524542274f78cfc151ab8f3fb07dd34ee49297b8bf65d4b929d7f2552f949d585bf4de9a10c509b0e08
SSDEEP 96:cEdSWZguWWDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:pEcjndjnHt9S/f8JzSV+6D86T0ED
TLSH
T12AB3218E0F5D2540C0BAA4F0A9D01FA1793E453D9797E3E276920076ADC6921FD29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads