Analysis
- max time kernel
100s - max time network
151s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
04/08/2026, 12:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
KoalaSPro.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
KoalaSPro.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
KoalaSPro.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target KoalaSPro.apk
- Size 5.4MB
- Sample260804-pjzzmaba66
- SHA256 fc62c4202656b2e0a336175a779ef148de82fd1c96a71aab8a7356de35f365de
- MD5 6ea19fe1002cfaf3000979aa4d58cb4a
- SHA1 b8d2cb9df0284a8e16c3da0cc6217c3fb87606a9
- SHA512 6b14779e0a0c9860a0491fda76d0ae49469115a0ff98dc703e4d750a1e2db61cdb3ad821d3c1f9eebbd7f3fd35de02e5dcb45f9860aea20efda451517d9690b5
- SSDEEP 98304:tnBmG6VWgowIcl80EIyOajHmSnjVAxunqw8k3zfejPejk6CeFeinj9dO3:t1BgowR60ElPjRVAVtj2jjwin7e
- TLSH T197462381F3D9AD2FCC7398328F7A063901469E57CA96C7479968B21C6CBBAC04F45BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener id.stouch.koalaspro - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone id.stouch.koalaspro - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver id.stouch.koalaspro - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo id.stouch.koalaspro - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo id.stouch.koalaspro
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/id.stouch.koalaspro/files/profileInstalled
- Size 24B
- SHA256 c9daeacee5dfa538ee4e69689bec9ef717b161912c5280a637597006cd4bab22
- MD5 30e6e575b6e5ac27c7a6f509c1eee81b
- SHA1 4cd2abf86f503ba13aa3d97cf6faf45024bdbf7c
- SHA512 5011b4c342de7933007398aaec28ccf789aecda472f8f9d53cd5854a096ee6ec0b27e257a2f584b13a3710f1e04db1b142b92515aa3a34f268ce815bd33f77bc
- MD5 SHA1 SHA512