Analysis
- max time kernel
145s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
27/07/2026, 12:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
1785095449105.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1785095449105.apk
Resource
android-x64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
1785095449105.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target 1785095449105.apk
- Size 5.4MB
- Sample260727-psnb7asdne
- SHA256 ed6ab577c5a114df3caa16b08258c4dfe6f435b81f02accc4ee06d4432ca95cc
- MD5 5301acff30df9713408cd9c75541ada8
- SHA1 c63d79831e51b57e0877247543ea256c82143301
- SHA512 aa5c9745aae0e3b18c8ac336fa21221162ebee0bb4873decfcd85449b2cc6153249ca88f7f822916cb1b5d9232a2d2f5c4441698abed2112433b874987c0c979
- SSDEEP 98304:Op81biwPNOogLCrFXqZ7EyZ9zZH9ewU0BRtzyXY2S4Yz9WOjDbsDuxw7Hydb:Oxw5qZYyPdkIr4YkOjD5SCb
- TLSH T15346E04BFB48E96BC4F753B24279532261074C268B43D7C35955723C1CBB6C0AF9AAC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.cyez.orho/[email protected] 5115 com.cyez.orho /data/user/0/com.cyez.orho/[email protected] 5115 com.cyez.orho - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.cyez.orho - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cyez.orho - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.cyez.orho - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.cyez.orho - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.cyez.orho - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.cyez.orho
Processes
-
com.cyez.orho1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5115
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.cyez.orho/.jiagu/libjiaguv1.so
- Size 250KB
- SHA256 1a85a981d025557b03bd3bc75888c48f893f8594384fff24839abd3e90060f02
- MD5 ce7b8b490c629cd898cf94af28a7a037
- SHA1 a6f9427a4b34b3ee6a6479a04a2c109a28a27372
- SHA512 f1213f9ee2d3a06d571266f8a0a38bdc3ba7df5d4fe35942b7debc53e98043eb61756628bf362c89f023d0b06b022475331485ab2851b902f93c18d748709fab
- SSDEEP 6144:KFpQl6Tqs9Wn9OTZT4toCDEhL0ti/7NOK0D8ueGXBE0d1ObWthP0RzxO4FQqbs96:swNtyRsDg
- TLSH T13644293274911CBECE665A75979EA3226779B8048311D75732D0B7303F87A98DF0EAE0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.cyez.orho/oat/x86_64/[email protected]
- Size 10KB
- SHA256 5112dd9467d0ea0dcaffb2daced41d0e42e63dcffe54cc93e4dbcb06a49829bc
- MD5 45b9b9f51e1982f986524b6d88ef28db
- SHA1 0d94ce942bafddd8b2c7fb84a06442f617493584
- SHA512 d2b95301790a75b0c6be767b36376eb61b54608eceaa426cc189601a37182027424dce502b7e0b793399f5ba61cde7419b18762d703882eeb664c2f03ad728fe
- SSDEEP 192:rPBnppPQUXQAoXQGGNrAjI/shnZkvrTkkyCE/bY+oiAkn0cpnVIXnc7:rJppoUgALGkr/IZkvrwk08+ok7paXk
- TLSH T19522D464BE20E4197BBFC97AB8BD3F00CD9734421304A89AAFDCD0C6D21DA744847A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.cyez.orho/[email protected]
- Size 9.2MB
- SHA256 5141e8f17791aa864a7ad0ad8fb87b1132729672362f4cd5fa02075c2fd0e2d1
- MD5 15c2e481dd8cd5393b05a78f04a80d64
- SHA1 e00f92ed7a54cf5fa5ce8cc16861824704cce6da
- SHA512 27663511abbe456fbb06a7081f2f039049fd617cd2c12dd3018df380592f3da162030fe9645b213ddc28c75e3d8148837ff1973ad258eca76b68906ac6bd0ba0
- SSDEEP 49152:FgZYMXecpb6K1DiIfo+xNoZ0ajPK627EI+/mIOzR4oJ88p2dUKGi/z3VyyS5UpAo:FeXyIfo+iK62f6UM3VtcVwlxex/Ovlx3
- TLSH T1F5A6AF27FA119D33C16E633318FA5305E730634AAB8383471645D9BCBCA36D59AEA34D
- MD5 SHA1 SHA512 SSDEEP TLSH