Analysis
- max time kernel
93s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
23/07/2026, 14:08
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
syahriyah_skanuga.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
syahriyah_skanuga.apk
Resource
android-x64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
syahriyah_skanuga.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target syahriyah_skanuga.apk
- Size 1.8MB
- Sample260723-rf3bpazhlc
- SHA256 04d0de979c490dbad761e76bdc055f4af2374004f0c811a9eaa7572ca0c96c7f
- MD5 3e7fa2c0b0358000957160e8152edca2
- SHA1 a2a3fb8d9b9c9a17ee6cd0efb00b0ced60b74057
- SHA512 fe53a2e4357bf17851a3c21d947a32557fbf4ec69e6c30a861d76b1f282b2f4c0f8d3425e619ffadfc1cce8fe8c36cd71f4cadd1ac2a06147c4d17cd72595593
- SSDEEP 49152:mnzjb3ZRHLonITBboG7Fwz59zy6gCF36KJ:kjb3rHLonITxfFkhF36KJ
- TLSH T1DF95AE8EBB1D752FC87A00324AA6D77122978D168E829B476544372CEC776D80F5EFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener spp.skanuga.syahriyah - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock spp.skanuga.syahriyah - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo spp.skanuga.syahriyah - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone spp.skanuga.syahriyah - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver spp.skanuga.syahriyah - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo spp.skanuga.syahriyah - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo spp.skanuga.syahriyah
Processes
-
spp.skanuga.syahriyah1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5090
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/spp.skanuga.syahriyah/files/profileInstalled
- Size 24B
- SHA256 e4dcae2f09c430e40ea0c242abc8c37799bf6628f1b8a59e75bc4a6f33ba5422
- MD5 3b8ae1d98d83a38069535887c80517e2
- SHA1 5bba1a317f5f51d0e50ce4d3d7c4785a4c07aaf9
- SHA512 79ce6e11c49532ee6b16416e2036a2131e5edf8a1cb675c64b92c62de2520c07ea5b461413725627ce513be44d3390595cb6144e6292ab8702863302c1dcb619
- MD5 SHA1 SHA512
- Path /data/data/spp.skanuga.syahriyah/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 575924d742944bc6abfa0f18fa2ffcb0175a328e0e0ac4b69b05dc93cabd12b1
- MD5 5e59f7fe0b6d9be5e9c55c29d5814e8f
- SHA1 60bd11f28a416e77cbb66c793b03e4d36d0ef50b
- SHA512 cb872e2630f6b0dbd6617cece6da0d73d56175a78b8039a5d6e3cc11706a2a74438401c646bdd5f2e04b7274ed55dc30d98b99b0b0cac8b31512a5eb64a8908f
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/spp.skanuga.syahriyah/primary.prof
- Size 1KB
- SHA256 02a19a2395302503a262283ecebc283f85656df563bc28b1544dce0ed0794320
- MD5 c877dec16b7d2222da5cc61c436f38df
- SHA1 dde788871e1dbfccd44507bec840a2d155a4f431
- SHA512 856c463421773ab1576afb29032b2279ca8f8e4edbf99a099d87e14a06dd6932f2cfada0331968844a2ffa29bbd56ceab28e7cae5cbc078bb5df2c4c13f91d32
- TLSH T17031F8516F494F8FC9D384CA38D9554B4DED4A9330E183E498B2B193A5296880E51D13
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/spp.skanuga.syahriyah/primary.prof
- Size 3KB
- SHA256 e882615ce399f8fe9567ec8da5af521a140e6d25d20ff378bbec5fb1d39b6e96
- MD5 79a51e885a89292f18c8596d6a88ecad
- SHA1 92864289e1150491d047d91547d5dca78766748e
- SHA512 6a53348693eae22ec14b8147ce9cb52f564d429c3a8b4042d8c8b32e127cd4f3ff43f0ffb323f6d1a7c8e8200e806ed307330bf3abba5e3af0f0ecc7a177afed
- TLSH T10A717D4B2527C1BFA6E0AE3442AFEC6666DD7EF2463AB5B03428C08C4CFC24419E54C5
- MD5 SHA1 SHA512 TLSH