Analysis
- max time kernel
138s - max time network
154s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
03/08/2026, 08:17
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
0013_20260731-183706_bd41a1f3_download.php.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0013_20260731-183706_bd41a1f3_download.php.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
0013_20260731-183706_bd41a1f3_download.php.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target 0013_20260731-183706_bd41a1f3_download.php.apk
- Size 13.9MB
- Sample260803-j67ebsee37
- SHA256 622aea199cbf735fe25709a486822268c5c36213529218a9b3f1016848506e7e
- MD5 e70a9641f9bfa22261983ef7d8c25dd1
- SHA1 bd41a1f343e87de2382ad3086c52bf99f060b0b0
- SHA512 b9461dbe44f6b52a2a8ffca615b61a5b3e96ba9eec23dca91b7d7a8e6c3a6dcd43c9bb8a878610c0381fdd6b2927b785ed54e3717f7cfa194d3f176c3e85aad6
- SSDEEP 393216:YMKSsOmoeZIS5f5p9drIm+fekZzvWK4qOUJt8mX:YDrwq55B5+f3Zzvpkad
- TLSH T1B9E62342E7918D5EECFB9B369AB743652335AC458B83CB5F1504B17C2C737C16A82AC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.spiralburst.mycity - Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
description ioc Process Framework service call android.content.pm.IPackageManager.canRequestPackageInstalls com.spiralburst.mycity - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.spiralburst.mycity - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.spiralburst.mycity - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.spiralburst.mycity - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.spiralburst.mycity
Processes
-
com.spiralburst.mycity1⤵
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5043
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.spiralburst.mycity/files/profileInstalled
- Size 24B
- SHA256 f6b2f48c30b0a0605dcb485f1ccf87ad399c4c7f414bb5a214ca50ff1d733b12
- MD5 009519bca2c2109bf3f4f6159317ef73
- SHA1 3ae48a44878dbd750217c8928508f633eb55cf21
- SHA512 4f7426c3a2d531d66704f86179e651f10466c6bebaae0527349dca053d2cbdf1195362bd648e47b5776ec2ee062f2b87078dab50037a4d46216b8af09e9fb23c
- MD5 SHA1 SHA512