Analysis

  • max time kernel
    106s
  • max time network
    154s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    31/07/2026, 12:34

General

  • Target
    Netflix Pro v9.77.0 (Premium).apk
  • Size 14.3MB
  • Sample260731-prqe6atbme
  • SHA256 abd6317e41398dc5ea8c0b7c8f167a6416017fb63d4e858a9837fdde4e66af0b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Probable phishing domain 1 TTPs 2 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.oe.photocollage
    1⤵
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Queries information about active data network
    • Checks CPU information
    • Checks memory information
    PID:4725

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        06c46c89809c967ec7d3e8082f21b4c0ee4e5c44cf34faed67a43821938e2326.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/06c46c89809c967ec7d3e8082f21b4c0ee4e5c44cf34faed67a43821938e2326.0.tmp
        • Size 4KB
        • SHA256 41c61703ea381aa7b97112ceabe76fafc8da4810395f3e16fb44e1967daf1b26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0d592ba1fe132a6aa40b3d79235ce2aafe38e11db123a303f011a8e5cacd6e6d.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/0d592ba1fe132a6aa40b3d79235ce2aafe38e11db123a303f011a8e5cacd6e6d.0.tmp
        • Size 4KB
        • SHA256 742be6b74e30a371a9925c10b5b4c5e0aefbcfa2bf222681a5bdfe7db1044193
        • MD5 SHA1 SHA512 SSDEEP TLSH

        11d01baac6c9119abc022bba9e0ba8d9b38cfc69bd964189e9749d52a129f8af.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/11d01baac6c9119abc022bba9e0ba8d9b38cfc69bd964189e9749d52a129f8af.0.tmp
        • Size 53KB
        • SHA256 b91bcddb9c8429248e4c2b96ca719e845e9ed17719d5d8e886d7bfe04917e7d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1411bfb6bcaecdc9a6a159448ba316a0c1070af2f17d193acec88f01f1cbf212.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/1411bfb6bcaecdc9a6a159448ba316a0c1070af2f17d193acec88f01f1cbf212.0.tmp
        • Size 4KB
        • SHA256 768e5ed3bbbc7b626a92cc20f85b9b2f88a8750ec8a56ae5fb05164ba7412b21
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1957ad3a6b4ed38f0fd8618420745c54b0313fb017a78b9da20ef2050fff52fd.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/1957ad3a6b4ed38f0fd8618420745c54b0313fb017a78b9da20ef2050fff52fd.0.tmp
        • Size 4KB
        • SHA256 1918407dd41bb50804f667f713ca6f510e29ba71276893e608e9e8dd82acfa32
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1f2f8e693986b5bed8526a199f8afdddbdd54d62929d38788459aaa92ec0fae6.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/1f2f8e693986b5bed8526a199f8afdddbdd54d62929d38788459aaa92ec0fae6.0.tmp
        • Size 52KB
        • SHA256 a567dd1238f7febddbe6e3dc8de087be48f407b39baa73d71c113c9da0c67ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        239d072d906a15a041640f1f045b859112863625ce701dbbe37d168fea5c700c.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/239d072d906a15a041640f1f045b859112863625ce701dbbe37d168fea5c700c.0.tmp
        • Size 5KB
        • SHA256 5491cffc2cac6267f83128bd3fd9da9486ae532dc735394b4ad4d41349919eca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        259551fff8609ccc5bbd33538f5de39fd5e87b29a09492af78f84fc62dc89b29.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/259551fff8609ccc5bbd33538f5de39fd5e87b29a09492af78f84fc62dc89b29.0.tmp
        • Size 57KB
        • SHA256 e3a359df3567062a79a4d01091a203ea6125163adc75e5c4ec88920df4477620
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2dae62d6e5877738a383713ee087986058817ef1a054c011fd16fe8af1e2a3ac.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/2dae62d6e5877738a383713ee087986058817ef1a054c011fd16fe8af1e2a3ac.0.tmp
        • Size 5KB
        • SHA256 6253e567625b44bdb5769d331b5ce32a717c274168b6229e0ceed876fd1ac9bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        3a3d04fd56f8695489375f1d4b9dd49bbb8b47e8014ebe7c8124e74e3634eb97.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/3a3d04fd56f8695489375f1d4b9dd49bbb8b47e8014ebe7c8124e74e3634eb97.0.tmp
        • Size 59KB
        • SHA256 ad5165f74e56205f037685b37a5e8c49ebfb14328cea6186928d0bb688cc091b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        3f3d74dfd1c151a7923c50d05f72098cebd07ac7a25df73c44957f00a21d9c6f.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/3f3d74dfd1c151a7923c50d05f72098cebd07ac7a25df73c44957f00a21d9c6f.0.tmp
        • Size 42KB
        • SHA256 4b085ea59477ed2b5c660c76c67d4a1507e8c90b3639b270e4404e95f2304331
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5533f08d1f4c13199161bff7683ced86b72278677b9e64f5afab1c7df387b65e.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/5533f08d1f4c13199161bff7683ced86b72278677b9e64f5afab1c7df387b65e.0.tmp
        • Size 4KB
        • SHA256 802fbd35f22c8b55c4470983e918a99edf91853f3478dbb8243b47aeffbc7a8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5a80586408080aae582298f5e3683e45e77562ba9161d6c01fa789588cee7698.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/5a80586408080aae582298f5e3683e45e77562ba9161d6c01fa789588cee7698.0.tmp
        • Size 3KB
        • SHA256 6dda4c42305762709837e93b8f1a7b947f5bb601487c7de28a48aad7db90d378
        • MD5 SHA1 SHA512 TLSH

        63886ce3c47cf02ad6c2f6203db4870f2bcd0017fdce113a1ea59ab673d19b4b.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/63886ce3c47cf02ad6c2f6203db4870f2bcd0017fdce113a1ea59ab673d19b4b.0.tmp
        • Size 4KB
        • SHA256 62cf848b909752c8e898ebb9abbfe594204185b35de8e45d5d9e3c83bbf464eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7dcb7047b221276cbdcb7aa022bb74986dd9a4e3d3a74cc43f9d52a045286dbb.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/7dcb7047b221276cbdcb7aa022bb74986dd9a4e3d3a74cc43f9d52a045286dbb.0.tmp
        • Size 61KB
        • SHA256 0ee4e93633e101332ee62909dd0d43ad9f6aa1d813856469798db66aec463e37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7f3e5237a08d00629d83ea5aaaaa22aaa2893bca63d01b81107d4914165f3cf8.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/7f3e5237a08d00629d83ea5aaaaa22aaa2893bca63d01b81107d4914165f3cf8.0.tmp
        • Size 45KB
        • SHA256 27b3664681add8452cec0df2715b695354988a13df87b5c80cd222b5b7b5c4b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        8b436f8fd17a334080e17d1b5a820fc9f0c5b12e79179e57c399067a1ffff7d6.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/8b436f8fd17a334080e17d1b5a820fc9f0c5b12e79179e57c399067a1ffff7d6.0.tmp
        • Size 33KB
        • SHA256 9e1d49abc1906c9897fb60d71cdc6b2cb8541a4622410f05ae3ab72b3dc7ea49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        93ef05afce660a76a1aa5649fd94ff24249133f8c527ab66080cbee8182af542.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/93ef05afce660a76a1aa5649fd94ff24249133f8c527ab66080cbee8182af542.0.tmp
        • Size 38KB
        • SHA256 da3fb3d51b473aa4bfe82d566aa007313d05a703420405f825cfb03fac0675a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bb5f96348f33f47d582033570f420fa96657bf30799b3743d747bbf4212fb85d.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/bb5f96348f33f47d582033570f420fa96657bf30799b3743d747bbf4212fb85d.0.tmp
        • Size 3KB
        • SHA256 b180669a54e500a8217a0409842038e3e4ba69728b48328c31bd8b794a1a76a1
        • MD5 SHA1 SHA512 TLSH

        c7fbaa3531d9a1e89737b4e72a9da2f0507930a3204ff5249eab98eec90498c3.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/c7fbaa3531d9a1e89737b4e72a9da2f0507930a3204ff5249eab98eec90498c3.0.tmp
        • Size 6KB
        • SHA256 ffd06bdac8c5f597edb80c98657ce003c71eb20c55c0824e92b7382b110d1c51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d10fb309a9f4bad79bb684e7d1c34c2c3018028c497fa6a8ec0c95e335a924d2.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/d10fb309a9f4bad79bb684e7d1c34c2c3018028c497fa6a8ec0c95e335a924d2.0.tmp
        • Size 21KB
        • SHA256 ec93c43fbcc72947abe3990116009b515648ec643e81618e1f5b74b96ced5cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d1981b90141b227604c0c1d0da4a92db1f9d0805be33af647def4c5d96d7ee55.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/d1981b90141b227604c0c1d0da4a92db1f9d0805be33af647def4c5d96d7ee55.0.tmp
        • Size 4KB
        • SHA256 389c9b5ee3b38d2ccccb6682de582280810a39a9c36049ca05d289b2010121d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de653c111a8f43c9af7956979d33cf450e5aa40fdd4319263cb953af936f2fd2.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/de653c111a8f43c9af7956979d33cf450e5aa40fdd4319263cb953af936f2fd2.0.tmp
        • Size 29KB
        • SHA256 7dcae25e820b1778c752f03ab0c2c7bd81109ed488c1877d89ac1c68ff11e895
        • MD5 SHA1 SHA512 SSDEEP TLSH

        e09606e91f95305e8f974208a213edd985b2935522b04c404fb7f067597a9ad8.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/e09606e91f95305e8f974208a213edd985b2935522b04c404fb7f067597a9ad8.0.tmp
        • Size 2KB
        • SHA256 fded3db8ed3e380adf6e3b9bc4546b07d1ca54e21fe1be8b058eba6282a3fe91
        • MD5 SHA1 SHA512 TLSH

        e47c38034c7727fa26771d39522070ea350f232c0920697293b1788bac8bd1cd.0.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/e47c38034c7727fa26771d39522070ea350f232c0920697293b1788bac8bd1cd.0.tmp
        • Size 51KB
        • SHA256 dba298e1e4b27a7e143859db9c9065716fad6dec66737c088b5289b14d518e16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        journal

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/journal
        • Size 4KB
        • SHA256 70934f2c69ddc7595369438713aa14738e5ed21083c7c1cef4e95f67f170b825
        • MD5 SHA1 SHA512 SSDEEP TLSH

        journal.tmp

        • Path /data/user/0/com.oe.photocollage/cache/image_manager_disk_cache/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events

        • Path /data/user/0/com.oe.photocollage/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 1d91fd8dcea3d80d4d79b8e936a7a04191cea369bc8b4892d04f0c4bdad8034d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/user/0/com.oe.photocollage/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 14150716665bd425423b5d64d6d72dee283f3ee7c11e8cd1f0e5855f54bbc85e
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/user/0/com.oe.photocollage/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 b827172730f0f924e02f2e51614a2ff8d33e531947e13ff0400d031764c89d86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/user/0/com.oe.photocollage/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 a129e397969d1495fa556a3b3e04b8819556c863d8fd807a1b5c081308159b9b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        play_transfer_data_teatv

        • Path /data/user/0/com.oe.photocollage/databases/play_transfer_data_teatv
        • Size 20KB
        • SHA256 12014b85db358a9324ddfc21fd1e6a3e5a29505d9aeedbb581eb41c4ecac4d53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        play_transfer_data_teatv-journal

        • Path /data/user/0/com.oe.photocollage/databases/play_transfer_data_teatv-journal
        • Size 512B
        • SHA256 f7e5d5106801329422d9b49803c049dd7b96e5af32a89eb86e9a155870b8291b
        • MD5 SHA1 SHA512

        play_transfer_data_teatv-journal

        • Path /data/user/0/com.oe.photocollage/databases/play_transfer_data_teatv-journal
        • Size 8KB
        • SHA256 d582f1a23eddfb48c898b78ac9d82e80f476deb676fdaff0a3f01f479a6a06bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        play_transfer_data_teatv-journal

        • Path /data/user/0/com.oe.photocollage/databases/play_transfer_data_teatv-journal
        • Size 8KB
        • SHA256 135de91ad4a9b228fe3701d9751223c9ad3b8aef15b4bfb7c44748442f7a6fe1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        temp9200067465880174046json

        • Path /data/user/0/com.oe.photocollage/files/temp9200067465880174046json
        • Size 464B
        • SHA256 92887fc968d23c420b39c4d26d1961f712131af803befe167e3a3fdf9035fcf3
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/user/0/com.oe.photocollage/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/user/0/com.oe.photocollage/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 857262404b89ed2ac5ed45807d5bf90d4f32f1f773611dec2963d147298d1de3
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/user/0/com.oe.photocollage/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/user/0/com.oe.photocollage/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 19ae842230c6d5bba2308cafcfbe959458226a6394e9d618903c012ececb426e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/user/0/com.oe.photocollage/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 225a6f16afc676b72ab6b0eb045a6851e7e00ed04f59a6bdbc2aef55c8dbcd4d
        • MD5 SHA1 SHA512 SSDEEP TLSH