161fab065b9dbf19269abff36798a0e660d2bd59cfa64ec7324f7cf4d901eb3e

Analysis

max time kernel
86s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
28/07/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
affiliateBangla365.apk
Size 6.2MB
Sample260728-pp92sahn6s
SHA256 161fab065b9dbf19269abff36798a0e660d2bd59cfa64ec7324f7cf4d901eb3e
MD5 0af4a6e84e21e81edb4db88e367f3007
SHA1 4794b3f09b971fe1eeb5a21836cb0ed85215e446
SHA512 e409a0ed765fd1a6beb1b1c3e6ad74d922763ac567bd6827ab75f61f3c37b30c080da0b87815791168eb210dc797e13e80b40a37b2adcee1c7787d2e293c20de
SSDEEP 98304:j9r5KS7DCfAtaIF0robT7usDt0uchh98W8q1I5S1uqj41Tt0ryvCy:j9VKS7DKRo/7usBbchX/dI5wuq+Cy
TLSH
T10266F19EF719992FC87710B28C76523352574C12A68357B36968331C38BB6E88F49BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4703	co.median.android.mbdzlze
/system_ext/framework/androidx.window.sidecar.jar	4703	co.median.android.mbdzlze

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	co.median.android.mbdzlze

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	co.median.android.mbdzlze

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	co.median.android.mbdzlze

co.median.android.mbdzlze
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4703

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

INSTALLATION

Path /data/data/co.median.android.mbdzlze/files/INSTALLATION
Size 36B
SHA256 de7327cc310d9ee27e524a427169ff87d027519fc88c7ee385aaa4b395c6aaff
MD5 0c66328e595c4a7a2997c30246fa0626
SHA1 1455fe6fa79d6cd017e807695e0e46e11fac3f5c
SHA512 c3635414204920f72cceccf44a8b1fbdecddf8c9f64ff7134c4874850ce8e6683682f0226cc234b9a63dad15725a0059f22f3f466767ca79ce475f28859b7236
MD5 SHA1 SHA512

Submit Download

regexintext.json

Path /data/data/co.median.android.mbdzlze/files/gonative-config/regexintext.json
Size 1KB
SHA256 f0c43b05116a7c9a8c1c9a3dd4a2bcbec9634429489e0434c345779cfb442349
MD5 fd83f53619527eebfb94392877cf6a9c
SHA1 5f114700e75fac40ed949c77c25133f51483a8d2
SHA512 a94666ba8365453aa65bf470faed54ceaa226fdbbd97b0de234ea545429f9a05df585ba557ea809911bf6a1871d56ea5f9af4fc94d1fead8a7aa920f3352f7d1
TLSH
T12741F674C9780DB399C82864B25E521B7A72615F2FD6391DFB8C162C1F4C5BF69B420C
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/co.median.android.mbdzlze/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 a437ba9a007e894c61cd5d93106266947dec27020321a2c4fbc5a470ea97f0c5
MD5 dbbb71a793d1adf5667669c40375d4e3
SHA1 b60f8ddf6024cb12aa92e241c90a5846140a214b
SHA512 5c88af058d812104352406b579874bdb915c44b9b86c4d59f51dd1343085dea3e0ea3e44d77229bf166acc29f836779b2d5d22b51aa9fca53bfa4878253dfba7
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/co.median.android.mbdzlze/primary.prof
Size 1KB
SHA256 a3fcabba4ad632e6501e9372f4f17ebe2f31abb236683a42c8cb65f465673ff1
MD5 e59bdc56719ae03d7b270730f599767a
SHA1 023ad1796207756d124f2766735a58e445a4fcba
SHA512 e6cd464e8338e59ff4bc5aba60c457638069ad31b7725fa217c26f249dab5be5c49f2692ec18f735d4a1eeb87003aa3fb1bd8a9c716a9947d0dd5119234ae33a
TLSH
T15E31FB19986EBDC6D13210F7BDE15A1A7701D7943D819FDC2D26A6C121C86E5580B8F1
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/co.median.android.mbdzlze/primary.prof
Size 4KB
SHA256 1c591a43581aed0e28fd9b844f4d22a09945f023aa08de5b1c442e2d5903ee96
MD5 ccbc37e18397573397132c80716f8e6f
SHA1 5114cfab2d3def492dafb78d87810a2e7d328f5e
SHA512 666151e7e0089f6c86c5c85e786ab98d3c92e4b906eba016898858354c0770ef349068fb66682768337a3b385870920da84a9dc957e96e39976d488d78a633af
SSDEEP 48:9s4x2XEqY+eERUqbFMXJA+pBb26hqVjOZ/H0G8VV1pBftCDOFQNAYWwOCNSoIQj4:XxutYzUqJAZ6hqVjOBH0hMUQwBBQH6Ys
TLSH
T172918E1CCF1EB85D97B95054F20B8244204B45D9687ECA2CECFE288FF621DCB216609C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads