Analysis
- max time kernel
51s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
22/07/2026, 18:13
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
dhanvarsha.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
dhanvarsha.apk
Resource
android-x64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
dhanvarsha.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target dhanvarsha.apk
- Size 8.0MB
- Sample260722-wt5q7aen71
- SHA256 571f6503249f0d8717e99ec5ae329ef68cb9fd38eccd823092c00c02e6002dce
- MD5 fde687182e0060480c8de46e87cd96f1
- SHA1 e122900079880da384a48907690fa12ebe89eac2
- SHA512 85fe872bbed7565b3e4a1812dc923dbeac1bd94c1e557a2828134ed7ac12809cb95445df7ff8196e657d8f606ac407361f667bed2916fe7e125f6523c528c3bd
- SSDEEP 196608:qa2gB4yqDp4cKAzIncxCJ/ANw9GLH11OlpvVvFKW:8gBYl4ckPlWmGT0ptQW
- TLSH T1228602D6F7D8A92FD4375033C56A56F5914B8C128A43DF876908370C69BBAD80F4ABC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.matkaking369devisetechnologies - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.matkaking369devisetechnologies - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.matkaking369devisetechnologies - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.matkaking369devisetechnologies - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.matkaking369devisetechnologies - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.matkaking369devisetechnologies - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.matkaking369devisetechnologies
Processes
-
com.matkaking369devisetechnologies1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5048
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.matkaking369devisetechnologies/files/PersistedInstallation2214143657715165887tmp
- Size 567B
- SHA256 2627b8b4dd1faca67fe86a9621007a16eb8a6157694d9bbfb8e3aa32b90049eb
- MD5 2cf788dd0d057b138241112858de4e5e
- SHA1 28bcf18b4eb16e7d18a183356454366ef0c414df
- SHA512 e2a44f6ad40f4449b2ef3dca189a3005168bb2baf48b9bd8e4567d4a7175627a70d1ebe395b05c4c4f64946baeb5853d2c5229b5519600a707ffc97d62edc58d
- TLSH T129F0967934A48645E96E8041B0CCBF008C391498862786759FDCDC71918192A124BD8C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.matkaking369devisetechnologies/files/PersistedInstallation420516089001305780tmp
- Size 90B
- SHA256 b0fdaa97c9251cfa45bed354e28c47417b4991ffc7efc2f5861261c9991e9049
- MD5 90e00e7641b9250940f971c0d302f99e
- SHA1 ab660ef210e300d54f30a524ad9914335c96938b
- SHA512 32c05c07774e498768983d9f024148607901713be515179733171a75fd12f483857fc1e2f6e2a4745b2ce3101c8515ee0439a882c20e23479537e7392a57b73f
- TLSH T1D1B01204C6704142C485A3436DCEF1409DA124C04C098A080F18D45004812E08123BF4
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.matkaking369devisetechnologies/files/profileInstalled
- Size 24B
- SHA256 df6109c3ca56aec4a246da78c4592ed51d2ab12731ee2e31fe57bc0e2e0db6ad
- MD5 2119c43a5eb9c04d116418cde8c0873a
- SHA1 6fece641f03a26656a956b087f1a86a63373435b
- SHA512 76d3ffa0169e3f1cfb781fbbc18f0b10d36966d59b7c08081c0e6ef68b8d1ef6dc8bc57bbe2503a23c0bb43e64188c64fca81281c7a068fb3aed336980108f09
- MD5 SHA1 SHA512