Analysis
- max time kernel
122s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
24/07/2026, 12:19
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
indiaflagl_udq6zt6s.apk
Resource
android-x86-arm-20260325-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
indiaflagl_udq6zt6s.apk
Resource
android-x64-20260325-en
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
indiaflagl_udq6zt6s.apk
Resource
android-x64-arm64-20260325-en
7 signatures
150 seconds
General
- Target indiaflagl_udq6zt6s.apk
- Size 758KB
- Sample260724-pg9faazdkf
- SHA256 2c7270e898c5c0e61bf50d9335a547c1e2b408f6ed1c07bff9d669ed245841f6
- MD5 fbeb2af5614d01955a78d107c9c8b6f2
- SHA1 9f9400e41618d044eb41a7bc24b722dfbe357bd1
- SHA512 d68bf3bc9449bea61668a5984e4ac85c3f01f1423fc843d4038814f7dd58f90c79e83f31311b4cf0c6c07e8c10ccd4ee953ce3366a9fc2fb4b9fa9ea9b18601f
- SSDEEP 12288:KqSPjoNn/NKN5s2vCOjmp8T+qSnqSm1RDGFuqA9jsLZ4y4nNyh3R0V9ld0/x7i:K7P6nYg+07n7CDGAqRSy0aP/xu
- TLSH T13DF42304F7593857F13D5B74CEA157436A8D2432465AEA0B60F0D0592AEFBA6CF00FAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 8 IoCs
ioc Process /system/bin/su com.wickedfreeapps.indiaflagg /data/local/xbin/su com.wickedfreeapps.indiaflagg /data/local/su com.wickedfreeapps.indiaflagg /sbin/su com.wickedfreeapps.indiaflagg /system/xbin/su com.wickedfreeapps.indiaflagg /data/local/bin/su com.wickedfreeapps.indiaflagg /system/sd/xbin/su com.wickedfreeapps.indiaflagg /system/bin/failsafe/su com.wickedfreeapps.indiaflagg - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.wickedfreeapps.indiaflagg - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.wickedfreeapps.indiaflagg - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.wickedfreeapps.indiaflagg - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.wickedfreeapps.indiaflagg - Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.wickedfreeapps.indiaflagg - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.wickedfreeapps.indiaflagg - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.wickedfreeapps.indiaflagg
Processes
-
com.wickedfreeapps.indiaflagg1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5020
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.wickedfreeapps.indiaflagg/databases/tapcontext
- Size 28KB
- SHA256 a2392c518dcb8e1fcf487050bdf26b3011311dbd751bbb5aae25f980a75e4b92
- MD5 caf8df69768c07f3f50f95dad4e9d0d5
- SHA1 2106296a9e84fdca64fc029f843b16328ef8299f
- SHA512 e902c31f14eb39421fa2f41d44c0a45a7733e5e81aaa720db0154f057f6c150c6d044c81b335fd6890e886a5bb29aa750d2d1448130bb63249952266696a4e78
- SSDEEP 12:TLT189qWFNKQU99wzbhRJTSFbyjLH9wzbhRZfRmBEyPbGtOwGQ:TLT1WqWFU5+JNR+Z0GSiGQ
- TLSH T1E7D2995FA7513615C08C15B76CE25293AEF4626EF65386D33AF01C28CD82554A832DB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wickedfreeapps.indiaflagg/databases/tapcontext
- Size 28KB
- SHA256 c27f9e959c0f1e1aa1525ad7e6cd4e46c362f53b22ce6786359be93447d2bd09
- MD5 c93003b5640b23cbf0ac2d0b8f9d60f5
- SHA1 c8828dd1e403fd8fdf793e596f18774cebbb5ca5
- SHA512 b4f40b02ec6ac04a729fe960e1f3c55208c0ce305a54ba90765ef0cf0c7c785fb36c7c7b457d1278b3b9f1b657cddee9b43486682286c8394b8ed0bcd692265d
- SSDEEP 24:TLEP0DWqWFU5+JNR+Z0GSP//CBP/YhkoRbpW1Fvq9YhRjkKWH9kGWYXBIB:ToP0Db5gzuSP//wckC9YhRXWH9kGbBIB
- TLSH T19ED2741FE750793BE28C19FB7CD30A83AFF42239B103599638A329145D41297703547B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wickedfreeapps.indiaflagg/databases/tapcontext-journal
- Size 512B
- SHA256 fb008d7c3116705080db0aeb34c12dd96378399a04097b52d5c3deb6a395e91d
- MD5 73e551f8f1eefdabf8732ff74ce851cb
- SHA1 8c8a25fa985dd60fa5e5669d8fc6779e1d6127a3
- SHA512 c38065e7742fc3f35c8cfe78a4cddf3bafe375fcb966d35e8c26a1014dfa9691d3e99c0b26ab8ac2f4d35e04375687f7dbdeca04fec2994d5f46835734fac001
- MD5 SHA1 SHA512
- Path /data/data/com.wickedfreeapps.indiaflagg/databases/tapcontext-journal
- Size 8KB
- SHA256 83c5097ce41da3b71c77572eb5ff6b1080095eab2cb88bc798d8e2dcc3038ce8
- MD5 f5d96ba8fda830376b3c372b63fc1222
- SHA1 3a59adc3314a924aebc40c60318ed16f344bc6bd
- SHA512 c0bf61cb16270c067eff8e1d46468c77cd368b18017e305bad28b6f5576ebf6160048b8a5df55d57b0c613aaef8fcb8fafcd95ef9a8c19e262c483ca0fbd254b
- SSDEEP 6:7+/l9XEn1Dg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKIv:7+t1uqLiuWdwRmBEyPbrv
- TLSH T1EC0222C963800822CC2D17B794D4C3C10D20EF2D82B1CB8B55A008983C074CCF4A1E84
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wickedfreeapps.indiaflagg/databases/tapcontext-journal
- Size 8KB
- SHA256 442fc76efeb7ee477a01099defe08dfdcce17d1a9e0e898f68117ea7a8c1446e
- MD5 97c0359e063031431f12bf1735ef0716
- SHA1 804ae7f0baeb5f76331f567f89ef02718d802cb4
- SHA512 823713c3c3b36b3b649f78a795f2f1c999fd4ebc1859315c8f5985a1da64bbd15feb17950ea43f0b4ffc83a4083e0e5bac2a7b47e2808cb4b0bf74d3d3ef2aaf
- SSDEEP 6:7+/l9sgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKPM/M:7+tpqLJdTRmBEyPb/M
- TLSH T1100222CA63801813C02917B790C883502E14E716C233CB0725A008AC7C426CCA8A0DD0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wickedfreeapps.indiaflagg/databases/tapcontext-journal
- Size 16KB
- SHA256 938ed1eeca839c9b8e62b55d0e404e6454aa9c039751702f95c5a2f5f8c6e97e
- MD5 c394e260f23c67431d187595f774a0a1
- SHA1 ba48dfc366bbe81fd12aeae505552430f484f99a
- SHA512 bf31be2d61ab0a49daca54495cf6ca303c6580c4bec546957ff5e41fc3a60ed785c0ca4e076cd8504f04eb5b45d31413a311961022aa0e2027c60823573bcf66
- SSDEEP 12:7+t7S3qLT189qWFNKQU99wzbhRJTSFbyjLH9wzbhRZfRmBEyPbM:7+tW3qLT1WqWFU5+JNR+Z0GSM
- TLSH T167729E4FEB513621C08D14F76CF31283ADF4225AFA5346D53AF02C28CE8256060B2DB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wickedfreeapps.indiaflagg/files/eula.zip
- Size 14KB
- SHA256 73915b2f06df099d29b83dcf60d6e815235b2dc2704c5f9ff365325be341fa2e
- MD5 a96f59c1635e65e5378798a8ba2c0d73
- SHA1 26f8170a326f348593591864f9c3efce259981b8
- SHA512 eb0c2b7f4fa6d7af113b893c4115aae285e99a7a5cad2c66cc8f4a426888a1d6faae88177d3fa5755253c92e774f56e4c01e69003ee9381941634d4b6a6f6422
- SSDEEP 384:jCqQx5KalE4PJYaluigQ6KsYfMoSeCNOvGztoeP5heu/G2Csa/ou:jCVHC4x+d9YfzmOvDeP5kuQsagu
- TLSH T13B62D19431652BB7EE649C282E4714F4F843F7D21E0E289947F845BD278F2AF916026C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wickedfreeapps.indiaflagg/files/offline_startapp_eula_body.html
- Size 22KB
- SHA256 08bb708178046d352f85434f39421674603b6f3069d006487c2f0261fff04540
- MD5 28684f6069fb4ec76a3e54c8e2307ac7
- SHA1 6ecbd36ffe5cf6e77ed57ebf3579412f1581081d
- SHA512 3786c62f2892994e8ccaeca084f97b73bb3279fec62846d7bcbe176a18abc52e120b13aa2f34e7a6292b2ae7fd3ebe62e68a5054fbccd4e21d073237418e6876
- SSDEEP 384:SpJSAy4u/DgrhOIIpyq+eP3Zid5//Db1sE/D9yvtMJ45/TUiA:SpnMpyqpP3Zib1sayvhx1A
- TLSH T1BEA20A25E2463949B036C4F49522AA09FF38414FC7832ACDF96D7BEB6F725D0842B6D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.wickedfreeapps.indiaflagg/files/offline_startapp_eula_footer.html
- Size 13KB
- SHA256 1f075332b57fdfbb9417718f3c0d9f27ffbb2c135b3291aca4b9f2911d7e9e3b
- MD5 9818dabc2eb86d5f4f071e9d67334570
- SHA1 117e7978c9293d86ea5492b90a4999cc24225dbb
- SHA512 79937390d4b02688abb0e24cef356024c3dbd3cd59d85ea3300556af59f0648293ed24fb5db740a4329fdddccf43af3b7679135555397a3adedd3eeccf5423a0
- SSDEEP 192:SIC1VPawVyCxZ7/YDLFn+D2yi0+DZQuDSeDOIDEFpS4V4GDjFu0QE69HqKS1cBIZ:SIiVxSAykfVBDjFaW18IZ
- TLSH T13F527564E2053856B137D1B4A726A508FF38404FC6832ACDF9ADBFE56F31594847BAE0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /storage/emulated/0/.bugsense
- Size 33B
- SHA256 bd7e08facb0b976f9df9657b2d576f7276657fbe60593dcd2063a16ad86cd074
- MD5 e2850f64a6a61ee02ed47781c406d9f4
- SHA1 0597c6496b12274c755e8fc95b37061f48a43b06
- SHA512 d56818e7a4550e718587ac9ee29fdcb87b6f3bf407b1b48bec346cb318e7b339ee653902c76b04ab52ec9bb9c62a92218d926eb374b9ee08f007566832b0b463
- MD5 SHA1 SHA512
- Path /storage/emulated/0/.tapcontext
- Size 20B
- SHA256 cd842a10ce6f9f092368b978704512b5ab81a576f2bd129c7123da9f676216b6
- MD5 43b8178d07625ecd992fe743620d4499
- SHA1 ab319433e59a4df80f630c22b1286d2cef660277
- SHA512 da8e5caf9ff74dd0742066245af09f1b8af4834bbc458873e0c8f32c24bcc3dd3705b7ffa4f53fd9116b0861c2dfef491f2c44b35e52354025370fd94e0eb386
- MD5 SHA1 SHA512