Analysis
- max time kernel
149s - max time network
156s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
01/08/2026, 18:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Guru303.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Guru303.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Guru303.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target Guru303.apk
- Size 2.8MB
- Sample260801-wrc86aef77
- SHA256 6d357da7a7322750e5a1925f00f625e47b2c5893c0f6b32536a065483ab178bb
- MD5 5c997f9e051d2546db95dc0da6f5b354
- SHA1 8faea55ff23406868fbf01e8bb3dd707707051b4
- SHA512 00f679214c6d8d0c94be1bde8db65e4e923a109a06ae9fc3eb760bb5b71e47cac941714ef8a43db3402fff46b5522097ea73df251846cb33c0d0d80059290a9f
- SSDEEP 49152:2fKouszPH8feYKamLuKMwlDCqe1HDVkuQHldfjC4g8Y76kGgOloZgPf+l:2fKou4H8feYURMw8ZwdOH8VF3+l
- TLSH T15DD50182EF65D82EC87705370EAA1331161A9E5EC697970385DC722C687BAD80FD9FD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.p4d_guru303.app - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.p4d_guru303.app - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.p4d_guru303.app - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.p4d_guru303.app - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.p4d_guru303.app - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.p4d_guru303.app
Processes
-
com.p4d_guru303.app1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5037
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.p4d_guru303.app/files/profileInstalled
- Size 24B
- SHA256 e46923567ed1d1dbf690bbd4f511eab060748525f8404f8b57af2696b7bb4b34
- MD5 badf22cf5a23875bdb892ad187ccec26
- SHA1 41fc869429f948efe40fd374aa795f0aa4fea175
- SHA512 9633f1ea981aecb43081d77228f92392fdf100dc72370618a066e06bdbb86b4496a5342c131f7fe0252b9225bc1ba1944e759a6b0dbf09222d9c5d54583dfab6
- MD5 SHA1 SHA512
- Path /data/data/com.p4d_guru303.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 f6a29f3220ec48f4f5f384ae9d6fd7f5ec17c485c63e3c6a1f3fa992dba21ea6
- MD5 d79053d7a8ea25a867ece99f69f31323
- SHA1 43e8bb3de8f3b690725521c0ae3808e4e7b7ca01
- SHA512 0c13a747f55d6be2c2b6b595225ccccbf3fe88c87a5ef680806dabbec3d9e81e8728d361fbc19775647dd0b36b6006475a13efacb72c6d0d16fe851a6678ea43
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.p4d_guru303.app/primary.prof
- Size 2KB
- SHA256 ae9c43659daf444d913f06936669e30b27767e0f2500844762cae00644eefbb6
- MD5 341011edce27531b3e4697f1203f34c3
- SHA1 69c977d16ddf2c5b03af624bbfba1ddf2cccaae5
- SHA512 9c907a8e3be2a10a2847ad21ff5c3fd2c36ea67caa8784d4aa9518e1d117bad9a751a9ac7e82054ce88baefc6d175895ee985c4f0c7ab676f7b8e70c48581167
- TLSH T183413B05DD051A3F02D02E0D4A5CF6391AC4794537AE1D20BDCF0ADCD2D9A242A917F6
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/com.p4d_guru303.app/primary.prof
- Size 5KB
- SHA256 9444e5b2553fb600e3f6f090b56b8c74cb97355a1b4da090a10ffa983ad03f43
- MD5 44ac5c7ba023c3cfcf9b8558bffee60e
- SHA1 5afeee3f348e3d8ef1cf7d5829698a7d0012ff2b
- SHA512 c00182e3c39ff8a5a8ec163457e37c1d5c62149f1d9787fec4d1ed77cde281c6e6d3f2b6ead60eeb59ac907b6f52888196d45a03830aab76333acddc5e8bc402
- SSDEEP 96:swkjA8QIGAzyEL8sjJLpOwVlTLUS+2ACTiIwEQ+YaDLHq1NzNFZd2IiMF:3kjtxdzJL8sjzTs+TiIwE+OG1TFj2Ii+
- TLSH T163C18FC46D06944873F05ADF1A4199D5C67A7A4BC08ACC3AED6CF3CB6627E642015F71
- MD5 SHA1 SHA512 SSDEEP TLSH