fabb76c9d0df6d712745755c162e5b533b0a898afed44a2cf10d39822d5d4106

Resubmissions

25/07/2026, 17:31

260725-v37fps1yew10

01/07/2026, 22:44

260701-2n1syafv8l10

Analysis

max time kernel
3s
max time network
35s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
25/07/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
chiken.apk.signed.tmp.apk
Size 16.4MB
Sample260725-v37fps1yew
SHA256 fabb76c9d0df6d712745755c162e5b533b0a898afed44a2cf10d39822d5d4106
MD5 fd7232b35a77b9710cb19395547bdf0f
SHA1 e3f2f755335617cd9786110f44f202cee4d641a9
SHA512 5494ee88b2e911029bb23ebd5f122a1e2fc153676895a36d9c0168d21c916543855a8d234ec957a8e1426aed24715e9fe8c2f8f482de80200c3d583619bc2427
SSDEEP 98304:vxd0yY0X5tR2p/wNrVoodQukgZBW6Di/5vfERSzEYmmmYu9RTqF/UgOdhfaEWyuU:pdZY0JtR2Yo3upvW6G/uRcBUgQ4yu3mJ
TLSH
T15D078C06E3069867C5DC973819B647C2F335AE4A6B8783171349F16CEEB3AE6DF54280
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	lwp.qgcmjaetab.aivdvlzjvyzh

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	lwp.qgcmjaetab.aivdvlzjvyzh

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	lwp.qgcmjaetab.aivdvlzjvyzh

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	lwp.qgcmjaetab.aivdvlzjvyzh

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	lwp.qgcmjaetab.aivdvlzjvyzh

lwp.qgcmjaetab.aivdvlzjvyzh
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4711

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation2982332882047073993tmp

Path /data/data/lwp.qgcmjaetab.aivdvlzjvyzh/files/PersistedInstallation2982332882047073993tmp
Size 569B
SHA256 93d40753ac22460d3e5cd91298b68a11af6ef538290f5578a00a4eabd57a3710
MD5 076b856c3b69b7f03cdc1e427973ab97
SHA1 4ed6d34b7a6106d8cc94699549aaf6c966b6e8de
SHA512 c251df777d0fed26758b928ec78534cd29568ea8514f21265435268efec7d5ac1c19f3b747452b72f53e8fbb143853cadf6c28abfde81de2bcfa4034aefe98ad
TLSH
T1E0F041177F4089CDC8E5B7520BA87E0D4C4400A14E8F1465389D8864A0556E8B397204
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation7505410260555855805tmp

Path /data/data/lwp.qgcmjaetab.aivdvlzjvyzh/files/PersistedInstallation7505410260555855805tmp
Size 90B
SHA256 3544afe6f2d059da6ae589338ad320b2443e63f3054818a26f83f40ff3662612
MD5 a6f116ce2b40253747200a8436f34a50
SHA1 f15cf479153b04aa974d12d8d98f59011e1e4b77
SHA512 0ee012fa991e4d93dc984444f3347877d0c843c7ea7ce50f2202ee0beb074bdef4c71f38fb8f5cb854f1e1501a98f23ab654fa43c92fbee41c4fc23d6dd3094b
TLSH
T1BEB012015A31426189D6A2031D5DB1001D4014455D4D8A170B08A45041962E4D123AF4
MD5 SHA1 SHA512 TLSH

Submit Download

credentials.db

Path /data/data/lwp.qgcmjaetab.aivdvlzjvyzh/files/credentials.db
Size 19B
SHA256 4c5a398d1c5c8ea08188578423e823708ba606f4cb4424ce91bcb89a0aabd7c0
MD5 74985e10ce823b75637013ec832919c7
SHA1 e9d892ba665a24e873c03b1dba1379f76e84cef8
SHA512 18211164965ed80740196aff4a389e6362539c41a6acd555af51b2cecf79c642acdeb6e033ead4f35efdab287f995002e01794955437aa215e2e62ee3704023b
MD5 SHA1 SHA512

Submit Download

crypto_keys.dat

Path /data/data/lwp.qgcmjaetab.aivdvlzjvyzh/files/crypto_keys.dat
Size 10B
SHA256 53dffb56aae91901973ebe6e67359580eb4035a268adf66a8e5b167966e385c0
MD5 9c7ce96614f6ed2564e9d54e20287140
SHA1 a8caebfe17160b89bdd9b237ec0a7327ed7f0917
SHA512 7ac9a766063be32aae096fe7662af428f95e84ff4060fc3ee5c7d60883928fed5e3956b5a964b26c82fa8f96fe4e3d259496bd74c145f37a4d0e2b48aaa0ab93
MD5 SHA1 SHA512

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo1MTQyMjIyNTc3MTA6YW5kcm9pZDo5MDhlYTMxNWE2NmIxNjdlYjU1MWJm.preferences_pb.tmp

Path /data/data/lwp.qgcmjaetab.aivdvlzjvyzh/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo1MTQyMjIyNTc3MTA6YW5kcm9pZDo5MDhlYTMxNWE2NmIxNjdlYjU1MWJm.preferences_pb.tmp
Size 362B
SHA256 a1223b9986ccfea511c72b6fd53cd08f7b1cf6e374059bb5b560b7e7b224e003
MD5 70fa90086af6350e852d902d35d42a58
SHA1 17b8059133f7b944a169099c0303599dc849d441
SHA512 a5a07544e545176249e790323a5f9286eb9a226b9b0280bb8338fe0e290ac0b4a9b4f0b41663244481dc57096e306f0bffca555c8c651ca42ab24485ba0df72c
TLSH
T1A5E0DF20DAE26AE21E2F680D7F98061C4FAFF3A571B5009935F40084F61AA45D6C6F5B
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo1MTQyMjIyNTc3MTA6YW5kcm9pZDo5MDhlYTMxNWE2NmIxNjdlYjU1MWJm.preferences_pb.tmp

Path /data/data/lwp.qgcmjaetab.aivdvlzjvyzh/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo1MTQyMjIyNTc3MTA6YW5kcm9pZDo5MDhlYTMxNWE2NmIxNjdlYjU1MWJm.preferences_pb.tmp
Size 386B
SHA256 ae938a4a0a42609ebdbec2866a98edb5a0309edf3975c104572a9de97b9533ce
MD5 09ecea3c802f659c638708535eccfebe
SHA1 d564390d03040b65560ba4a90ce31a9d68080edf
SHA512 e181d0059b89cae0026102312a08aba86d991da42e4cfdd6128a0b9428e00fd183441e604ba76831ff9df8c38b8285d26c8a575a7cf414a8084a1254fa244c6e
TLSH
T1D2E02210DAE22AE21E6A640EBF98021C0F6FF39171B9009929F40084F60A605E6C6A1B
MD5 SHA1 SHA512 TLSH

Submit Download

user_tokens.json

Path /data/data/lwp.qgcmjaetab.aivdvlzjvyzh/files/user_tokens.json
Size 53B
SHA256 1314ba498177c639e69126f54a10fd00f6c4f284572dcf419aa05b041a7e2b48
MD5 559bd9472ab270203753b6ca10b48945
SHA1 d92b07310c14e7e30975861e879bb24bb9ee29bd
SHA512 d28cdc1576623c12bd0608216b728e9bebe336a7c81d4c76b8b275a7be9988954724bbc1528ee62798e88e731200b03fbe298e41711bb623ca6f7a7b8b453598
TLSH
T17190021C688514330A52468515A2644231E0816422144D1C9654006405C9BA54912601
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/lwp.qgcmjaetab.aivdvlzjvyzh/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/lwp.qgcmjaetab.aivdvlzjvyzh/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 9f575a1cef64069c3c0ae5601c3d6d506cb13ca33aec5a3d0c4cdd1613645b69
MD5 8c78b8ccdf607437c118cafc11737474
SHA1 74a8322a97225d0a7f037163b9da5734b775b2ec
SHA512 9e59b736aa1855d86e26c074bc1034b1734942a595bf562fb567d7819e285c2e3b8441a68d1f364ff03791c8d26ac9fe8496069e1216c65f128660cd60d295b1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/lwp.qgcmjaetab.aivdvlzjvyzh/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/lwp.qgcmjaetab.aivdvlzjvyzh/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 6a08a7324cce416d365473453cd73ec21014156fd70b42204a47b39634380bee
MD5 c98a396c41056f2d5bfb1a7f6834f2ca
SHA1 b8eafb600fb306b6dcb557997d6b78bc4baf0fae
SHA512 d657746fc93946a11238e84ae935519b32b6e0ac61ed7407916a32c9868164213d0a313c43026fec6eb72c28d03c028256126784ff69f0a5b4abc48ba3022f32
SSDEEP 6:KaQiwy9FZde/kPlOERX4PBX4ogLugMBX4suuK+/rZeQLtaQRl+Ow2:Ktiw8zdeWRmBEyPbP/rZeQkQiOw2
TLSH
T19972865EBB811552C11A033678E6C341492693197BB3CB07D79136E12C427CC9490D05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/lwp.qgcmjaetab.aivdvlzjvyzh/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 f28fea80ab0dd6e08cc76e7da90bc34e43c8ffda3fa5f89395a3fd29625bb3d0
MD5 0caa9645a6865759aa23dc70b1e235e3
SHA1 111abe00b6247074bc60a041406777d17b3c91c5
SHA512 b2df97ea24c0a957d8c958825734d8ed9d3e5347d9079553f91f12a75e57d43051769951804a67efe5eae1e5c63323431209dd422df4090b7b19329a7a5da8c3
SSDEEP 96:rPRTQLVyt6+etidjnZRWzzb8/KeKcK+zShxddKz+ZD86u0ExV:TCAutidjnfWzzb83zShxde+ZD86u0ED
TLSH
T1ACC3158F1F192600C09A54B0E9E00FA1B93F822EABA3E3D1A5D111F5ADD2925DD65CF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/lwp.qgcmjaetab.aivdvlzjvyzh/no_backup/androidx.work.workdb-wal
Size 132KB
SHA256 8c3cf0a3aaeae029c66228f37499cae58231d6e6da4f8f23eebc9a0802e62af8
MD5 fc1daa8a35eaf226e1966d0cacab8867
SHA1 fd53e16f2e14bfe2da9b7b3b026fb5b5bcd15389
SHA512 0c7b3461cf2ab4c377f37f816f368e56aa612f9a64dea0182a5ec9c973a11dccebba24068b33b0d50376f3abbd4f7382a354833416f246474b220d3bd5045612
SSDEEP 6:OQD2BHn7GzV470inicQ1/uHnF/zWraEZngn:OQiBHyzV47xicQ1mHNzWrJhg
TLSH
T129D312D5AF20C653C88B4B3CEAD6E7C189A59904AE3F8974409B2AA42B441C614EF419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads