Analysis
- max time kernel
25s - max time network
157s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
04/08/2026, 14:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
sneket-in.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
sneket-in.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
sneket-in.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target sneket-in.apk
- Size 6.5MB
- Sample260804-rkbpjayybx
- SHA256 b1afcc92ac0a63d82f0d291e4aa192e26e8275127eb21cffabe961b06421fb94
- MD5 8a3823c58932dadaca17a66f5bfffda9
- SHA1 7981803946563ff7925c5f3040e2a6abd95f69c7
- SHA512 a63d4438cc0d4b4130944e0ea620692edb613c06219703c263d2f4bb48f09de80e7025a7cb8cf02c870368a2e453476b379bacd320088c8dbb106ec9f6a83c21
- SSDEEP 49152:5ojms4Y3Tso7rWp7aGA1sagmMqzAg088p1fp24T24QUKGQnJNCoR++UXf5p7XUnh:5ojmPY3TSp7hmMqL4tQUKPsv5prouc
- TLSH T127669E03F7471E32D5AE43311DBF0715AF31379ABB978B831554A4B87C932E486E92A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.sneket.shell - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.sneket.shell - Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.sneket.shell - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.sneket.shell - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.sneket.shell
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.sneket.shell/files/profileInstalled
- Size 24B
- SHA256 c44129a1a2df747f2ee4accceae6be280c07949d7f6cf2bd72754dd71960c1b7
- MD5 5d999518f1c391bce98adb04845ee241
- SHA1 5876460377426551d00f574a59e770a4d3283bfd
- SHA512 482682db07c698db5a380b1bf43295f6a17d25b2ee0a936f7c6acbd31aaec7781e3ad8a449043e2c738e7badc9dd54a498ae30f56e9343c24d388b130d3012c9
- MD5 SHA1 SHA512
- Path /data/data/com.sneket.shell/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 2eb1d720ad2aa0bcd331ae7ed6890310e27a602ae2138ccdc246a4ab098ed37a
- MD5 96e3d5048c1527c4e208b22355c14405
- SHA1 a9238075cd9a1cee7d7792d0f305e7a10cd7a045
- SHA512 7731739533b349491b904ea65fc6106597d7a7caa024092e4d265268eee6488899217cb394254a7296a4534f99a3f12ae4d3651a0a31f6469f1299592c7cfccb
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.sneket.shell/primary.prof
- Size 2KB
- SHA256 720748696ae9ab4212a0a7ad0f48bb70317267e831114357b97ce56c2d099772
- MD5 cee50799ed91a694976658624d6096a0
- SHA1 6f9e6b3549492445a3c2978860edb0cb44f09518
- SHA512 43ab45fa18ca30069a28b294088db0800bea8cf3b61b2bf15417142b3ce5aa07a04695a3c18868b1a0287b10a1131b086da56fa90bd145ebb64f05dd48a7827a
- TLSH T11B415BCF141047CEB98A91783F7552DE8015D81CCE31D6BDA41582AA22EB8FF49A0A6F
- MD5 SHA1 SHA512 TLSH