Analysis
- max time kernel
149s - max time network
156s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
01/08/2026, 18:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Guru303.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Guru303.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Guru303.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target Guru303.apk
- Size 2.8MB
- Sample260801-wvf48atalc
- SHA256 6d357da7a7322750e5a1925f00f625e47b2c5893c0f6b32536a065483ab178bb
- MD5 5c997f9e051d2546db95dc0da6f5b354
- SHA1 8faea55ff23406868fbf01e8bb3dd707707051b4
- SHA512 00f679214c6d8d0c94be1bde8db65e4e923a109a06ae9fc3eb760bb5b71e47cac941714ef8a43db3402fff46b5522097ea73df251846cb33c0d0d80059290a9f
- SSDEEP 49152:2fKouszPH8feYKamLuKMwlDCqe1HDVkuQHldfjC4g8Y76kGgOloZgPf+l:2fKou4H8feYURMw8ZwdOH8VF3+l
- TLSH T15DD50182EF65D82EC87705370EAA1331161A9E5EC697970385DC722C687BAD80FD9FD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.p4d_guru303.app - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.p4d_guru303.app - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.p4d_guru303.app - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.p4d_guru303.app - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.p4d_guru303.app - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.p4d_guru303.app
Processes
-
com.p4d_guru303.app1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5141
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.p4d_guru303.app/files/profileInstalled
- Size 24B
- SHA256 24e278d72b7f27784694d7091c69d8f65c9f879af8ee3184ee2d8c32f536b285
- MD5 6c95c14f08fadf8352debc1d0b916c3e
- SHA1 d68a5bc4636f3a5103ab44455572952a9a10127e
- SHA512 a4f57c54a758ed4b715703e7b353fe7ed365e9d7e22bc2f149e8a070e2f5b8a141101e3a31441d360d2ebc171f7bb504a66b64b3efa80ead4e9d1d02c68c5cce
- MD5 SHA1 SHA512
- Path /data/data/com.p4d_guru303.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 37ce351f5da6e186f69badd01bb1b3dc36af4f2245ba0c42d34e436105367875
- MD5 53b729f1821405205f34c0c5047f05e8
- SHA1 eafada714731856e3a1086dc9ada9b7cc869248b
- SHA512 775f647c8ee69c9199f3009c281a98fb3f9fdaed0b0002996403308208a6264befcb07b57d131e61a250a30ddc863978c7f6ffb741a2480ac4b0370443a29545
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.p4d_guru303.app/primary.prof
- Size 2KB
- SHA256 ae9c43659daf444d913f06936669e30b27767e0f2500844762cae00644eefbb6
- MD5 341011edce27531b3e4697f1203f34c3
- SHA1 69c977d16ddf2c5b03af624bbfba1ddf2cccaae5
- SHA512 9c907a8e3be2a10a2847ad21ff5c3fd2c36ea67caa8784d4aa9518e1d117bad9a751a9ac7e82054ce88baefc6d175895ee985c4f0c7ab676f7b8e70c48581167
- TLSH T183413B05DD051A3F02D02E0D4A5CF6391AC4794537AE1D20BDCF0ADCD2D9A242A917F6
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/com.p4d_guru303.app/primary.prof
- Size 5KB
- SHA256 a5ee7c327325a84e837c11fc347839306f80f108e53891a3dea8cbd5417769cc
- MD5 65baa26fccae9065e36c09916f4e7378
- SHA1 f4d9f452a1020691849785c307fc805b24f3d280
- SHA512 099ef6753a5735e529a9cc2797c8436a489b0dbe3b550112a5f310a9ee037dc5539f28a6914a9b54b4c618126716ff2ded1fb22078e69852c3ded938cc88fad0
- SSDEEP 96:H1nfJzjEtp6LnyUXnevyijr4+DubkIHerFRNBu3tBs1Xx9oG/MgRL/QdPMxCL8Os:Nhz8KVOKINukI+rFDBudBOXUG/R+kxSI
- TLSH T1A1C1AD29FC4498295B50C3BDDF92B8512C8783E16B23DFDC1A07FF9020A380D95553B8
- MD5 SHA1 SHA512 SSDEEP TLSH