Analysis
- max time kernel
112s - max time network
154s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
01/08/2026, 05:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
dhanvarsa.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
dhanvarsa.apk
Resource
android-x64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
dhanvarsa.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target dhanvarsa.apk
- Size 7.8MB
- Sample260801-frhkwael21
- SHA256 7b58d820d286ae5c58d498f862b31ef1ddae5936094f179bddd4bad1bea30cd5
- MD5 a80e8bf2906b63956f4ebd4eafbcab5c
- SHA1 07d12a89d5af712f33b0a1575790c0e0692e8f33
- SHA512 42ca6de8ae19cbdd433c6d2da93ea05f2bda47af5870481c3470cb2cceb36b1fb4995da1a81eb51a5c859b87c85dd0175a9fe56c3279013d02c26013a3f9e7d6
- SSDEEP 196608:q8VgZgrTicKAzIWcxCJ/ANw9GLH11OlpvVvFKI:7gZgreckClWmGT0ptQI
- TLSH T15E8602D6F7D8A92FD4379033C56A57F1514B4C168A829F876908730C6DB7AD80F8ABC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.matkaking369devisetechnologies - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.matkaking369devisetechnologies - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.matkaking369devisetechnologies - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.matkaking369devisetechnologies - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.matkaking369devisetechnologies - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.matkaking369devisetechnologies - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.matkaking369devisetechnologies
Processes
-
com.matkaking369devisetechnologies1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5054
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.matkaking369devisetechnologies/files/PersistedInstallation1591230484841453070tmp
- Size 567B
- SHA256 b08333f3fc23f94f536e51cc7bb71770d02497ae1ae4ec82e27249ef306a1350
- MD5 2885759d20f52c4db0346942255302be
- SHA1 9326842783f13685511e1ea67f316c915bfaf9fc
- SHA512 fee4feecf4a18223af1675f2c9c862a80550ca4668544b3c5a4145d8dab19cdd326044476518bb53006c895f324b6c14675ff3a014caad9948e6b5d64f0b2792
- TLSH T1A1F0267005F04FA2DD14C186205CBE025C6E0C705129ADAA5FCE64F4A075639C207870
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.matkaking369devisetechnologies/files/PersistedInstallation4854219566322017695tmp
- Size 90B
- SHA256 3327951041380b599df726da414e848d2d496d63cac93e55aaad45e623dce8eb
- MD5 f820376e2a59ea42343d34e47464a5c4
- SHA1 559eb0ba6db6fd3640441f65ef5cfce6a6b4430b
- SHA512 1146cdbb4854193fbe14e27a481ef42726e83cd9928729319ca7112d250b6f514a272719c8db45d19e6698d2fee2f47865678e4d19c631ccbde2d1ad4701f480
- TLSH T1E8B01210867141C388C5E3121E8CA1002D411890180DCA064F0E94C040911EDD107DB8
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.matkaking369devisetechnologies/files/profileInstalled
- Size 24B
- SHA256 9986fe280dc63f4d0f62994386c34620e6e5376da71825ac90df8d2b07e6fef6
- MD5 7747210930a6aedb627519557478c59d
- SHA1 a3e763bf1d51822d04007eae417cf6350b84d76a
- SHA512 1a95417ee9902af32cf1e30fec731050b6ee3e892fa46e3c09cddc000226f19d7205c3099c9bac9b837e7b2f2efd93dc5f4faaa651de073a67c3e9af913e886a
- MD5 SHA1 SHA512