Analysis
- max time kernel
74s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
24/07/2026, 01:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
55pgapp.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
55pgapp.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
55pgapp.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target 55pgapp.apk
- Size 5.8MB
- Sample260724-bk2mysyyas
- SHA256 44a219546239443bab10a8e217af6034de9f4b7826378d805bb6fc7a74ba704c
- MD5 ce66f36697414cacd1705324ab071053
- SHA1 2e1c572a0ff238a962108be2df67ccbc4509e46a
- SHA512 ca7fe7a233afbe159c044481c4dfcd2e249d617d93f2c6e6c3ed6cd2af02316db10e27950f0acc4b12dd24d0b7d43af302e23b9e15019d7a8e79f0cb03dab8bd
- SSDEEP 98304:pTI/00TDCelMZdyYM5L5jvzfQnNkuxufJN1:lI/00TDb15dj7QnNkuxufJN1
- TLSH T1C0566947EB92AD26C5BEC335A0B68B1227311D455B03D38A100AF6FA7DB37D14AC56CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.pgwin55.one - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.pgwin55.one - Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.pgwin55.one - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.pgwin55.one - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.pgwin55.one
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.pgwin55.one/files/PersistedInstallation5686972669762297344tmp
- Size 90B
- SHA256 671daab8dc9ea74d42648b2c5361dc79014005ebe58b6e9e8b809f1814b4a3f9
- MD5 e35f57301052cc9a4afe780442513f96
- SHA1 c15f4346591172eb59c5e61985c023d7fc0c4b89
- SHA512 623bd9495d0e627de2e2a0e00cc5bd6dff2476e85516e2611bec8f1db78458b80f9232a8f9d65a189345836b116b164c6cddd96a76db8e5c1bc8c0fbe767ae57
- TLSH T1EEB012409E7041C1C6C6E2131C4DA1407E502840044A9A450E0DD1A040E11E181039E8
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.pgwin55.one/files/PersistedInstallation6000225633112545117tmp
- Size 571B
- SHA256 55acb7b24569c7ad6ee68fbec704d1e698e59007ff32c50e6fcadd5de0907fd6
- MD5 aa68791e6669dbd776eb5d271712e1af
- SHA1 ebceab5c831f21989d5dda8942f1a96db3c8aede
- SHA512 7357d7f54ca9d76ea57d1f5e2f6ed01c0553c75186bebb572d481138857107dcbbb75dd762eb5e5de0f792e83ec7ee5abdbb13a49501c86d80122d89f845e514
- TLSH T1ACF04112766043A4E586AE96340CBE568E9414A0108AFE813C8BD8B4E6A38F2B0660D8
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.pgwin55.one/files/frc_1:1013856022208:android:1c9abd3efd3c484ee48725_firebase_defaults.json
- Size 162B
- SHA256 2eddb0a4564d574d49321f476944eb4c1530749c77ee15ac0bbf37619619410a
- MD5 ea08e83ecadf9f6397d812265fe68dd7
- SHA1 06bd230b15b2302ab90f500ea239042f5f31e869
- SHA512 963aa1bf0895ec03ff830b3812b84ddc5dbe7790fb1e2ecae9d0e094c1d86b8ebb95436bb463eaf50ebb193f83871d4a8e6b6bb0f3ea1b1f7e40a992829b6362
- TLSH T143C08C1C7DF1A2B319CEBEA88652F143C7223149A824A84009C87825066B6DC370F46F
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.pgwin55.one/files/frc_1:1013856022208:android:1c9abd3efd3c484ee48725_firebase_fetch.json
- Size 140B
- SHA256 692c8de16d8d0dfe6c61feffe62364adecb576d020a50a4b37145a561f169164
- MD5 32890908af22e95d7286047b7f376951
- SHA1 b01a7ddc23fcc9253f4532c2d029054ec553e904
- SHA512 247934114995bddff62d1e841f179663c6e560e31f98fec74baa84c8a810b3f2165936ef5429299830702567299b65d005223e04c65b92403fd77fddfc0fe3c9
- TLSH T182C02B0C6DF0D2B318CF3E298751F403936001089030DC0010C43C110A279CC230B00C
- MD5 SHA1 SHA512 TLSH