Analysis
- max time kernel
78s - max time network
151s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
27/07/2026, 12:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
1785095449105.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1785095449105.apk
Resource
android-x64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
1785095449105.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target 1785095449105.apk
- Size 5.4MB
- Sample260727-psnb7asdne
- SHA256 ed6ab577c5a114df3caa16b08258c4dfe6f435b81f02accc4ee06d4432ca95cc
- MD5 5301acff30df9713408cd9c75541ada8
- SHA1 c63d79831e51b57e0877247543ea256c82143301
- SHA512 aa5c9745aae0e3b18c8ac336fa21221162ebee0bb4873decfcd85449b2cc6153249ca88f7f822916cb1b5d9232a2d2f5c4441698abed2112433b874987c0c979
- SSDEEP 98304:Op81biwPNOogLCrFXqZ7EyZ9zZH9ewU0BRtzyXY2S4Yz9WOjDbsDuxw7Hydb:Oxw5qZYyPdkIr4YkOjD5SCb
- TLSH T15346E04BFB48E96BC4F753B24279532261074C268B43D7C35955723C1CBB6C0AF9AAC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.cyez.orho/[email protected] 4796 com.cyez.orho /data/user/0/com.cyez.orho/[email protected] 4796 com.cyez.orho - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.cyez.orho - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cyez.orho - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.cyez.orho - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.cyez.orho
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.cyez.orho/.jiagu/libjiaguv1.so
- Size 250KB
- SHA256 1a85a981d025557b03bd3bc75888c48f893f8594384fff24839abd3e90060f02
- MD5 ce7b8b490c629cd898cf94af28a7a037
- SHA1 a6f9427a4b34b3ee6a6479a04a2c109a28a27372
- SHA512 f1213f9ee2d3a06d571266f8a0a38bdc3ba7df5d4fe35942b7debc53e98043eb61756628bf362c89f023d0b06b022475331485ab2851b902f93c18d748709fab
- SSDEEP 6144:KFpQl6Tqs9Wn9OTZT4toCDEhL0ti/7NOK0D8ueGXBE0d1ObWthP0RzxO4FQqbs96:swNtyRsDg
- TLSH T13644293274911CBECE665A75979EA3226779B8048311D75732D0B7303F87A98DF0EAE0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.cyez.orho/oat/x86_64/[email protected]
- Size 9KB
- SHA256 9c4f744f78506f2a4ef7d140e96e98485277977bf766230794d8a4002bd18e22
- MD5 b88581333baf6ec420e352ebd0823bbb
- SHA1 1cdff086b1602fae137129048d81492921defc18
- SHA512 a39a563339ad4045373820674357cde7cc430b808979f446a543a06bbf2b4821fde9cdd0110e73ac051619d36a9667eb891d0e2ed0db3009f898663dbf7191a0
- SSDEEP 192:2UXQ4oXQGUNrAjI/shnZkvrTkkyCE/bY+oiAkn0cpnVIXncL/:2Ug4LGCr/IZkvrwk08+ok7paXi
- TLSH T1CC22D424BE24D4197BBFC9BAB8BD3F01CD9734421304A89AAFDCD0C6D24DA741847A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.cyez.orho/[email protected]
- Size 9.2MB
- SHA256 5141e8f17791aa864a7ad0ad8fb87b1132729672362f4cd5fa02075c2fd0e2d1
- MD5 15c2e481dd8cd5393b05a78f04a80d64
- SHA1 e00f92ed7a54cf5fa5ce8cc16861824704cce6da
- SHA512 27663511abbe456fbb06a7081f2f039049fd617cd2c12dd3018df380592f3da162030fe9645b213ddc28c75e3d8148837ff1973ad258eca76b68906ac6bd0ba0
- SSDEEP 49152:FgZYMXecpb6K1DiIfo+xNoZ0ajPK627EI+/mIOzR4oJ88p2dUKGi/z3VyyS5UpAo:FeXyIfo+iK62f6UM3VtcVwlxex/Ovlx3
- TLSH T1F5A6AF27FA119D33C16E633318FA5305E730634AAB8383471645D9BCBCA36D59AEA34D
- MD5 SHA1 SHA512 SSDEEP TLSH