Analysis
- max time kernel
46s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
05/08/2026, 11:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
customer.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
customer.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
customer.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target customer.apk
- Size 2.0MB
- Sample260805-nctzcsem91
- SHA256 58279bb058a68726f19beaae3ad845ca82ad8b5c47f9784448753c5ec88d051f
- MD5 24c69d8e7f05377e4ceb34cda5d6436c
- SHA1 81849961d88b9a85f9bbf75639eb0704e1dacf05
- SHA512 88c997caf7ccb77a8afb99848f4f96dab0b50ceb3ece0c80922ff79090b4fc4778eee47a5d35736ba145d79c53260168dce0d3a1ce1769da65586a982eefcc4e
- SSDEEP 49152:BtDQML50xrUNM5oDavWdHDoVcn4UVV9efhk68Flkulkg:7QbFuMHvmDui98kZvkwkg
- TLSH T1E0A523876324A43DFA7255340EAF0765866A0E63CC4BC3CF49E47668247B3D40F5ABDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.cargo79.customer.seunghwa - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.cargo79.customer.seunghwa - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.cargo79.customer.seunghwa - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.cargo79.customer.seunghwa - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.cargo79.customer.seunghwa - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.cargo79.customer.seunghwa
Processes
-
com.cargo79.customer.seunghwa1⤵
- Obtains sensitive information copied to the device clipboard
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5023
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.cargo79.customer.seunghwa/files/profileInstalled
- Size 24B
- SHA256 67dd15136a0ffcd7bc04be6aa267a09fc928287721b1b33b76036066dea5bf62
- MD5 c2965870734124cb29b87df97fb2ff67
- SHA1 5c925136d299aa81dbb6390c7c5a451c532d5275
- SHA512 dea9c319dd0724e10de8a702b5d59edbdc3725e075a0b57c8cde9621afbf93bc168bb8475afac971c5ac7989616371e0c2099e52dd7b64fc0f584ab48c91d7fe
- MD5 SHA1 SHA512
- Path /data/data/com.cargo79.customer.seunghwa/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 1af38e26b4a2980ee51008f3119b93efac3ad7f80f8d1ab9d1a40f49bc288772
- MD5 971eeb9b290926e15f0c2d0c9d50f3d5
- SHA1 9f20b0bd3b185031ea281daedb4be973c5d96f54
- SHA512 4a30f615c5eb587e70bcd3db4f1c5031aea57f83e12b28341fd9b340a25104b8142d7e5178b6452e4a11279917626c69396e888395a6c92191e596df4409ad3a
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.cargo79.customer.seunghwa/primary.prof
- Size 210B
- SHA256 8392f698d949b8a6bb2e0fec2d5e4e3e6abef0c792747dadd9e1a6100ddd1a25
- MD5 2062b3f736b0201ef21d2733f6c81e70
- SHA1 3b3867dda8f6d99835e521e7dc222ad16a23352d
- SHA512 7bb9a7131b0b885d8a784e60567aa073264dad55cc79da7806d9dbe97429862c3361e0132c7c17cc748d949eda55075275a06a71d11037d4b364c6dc15e054e9
- TLSH T174D0A9CA062CE95191582F5A2323AA673FC3001043CEAB04FACA31AC1232832D98D0F6
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/com.cargo79.customer.seunghwa/primary.prof
- Size 543B
- SHA256 934755143cbaeadd508cca6690c26c0fdb6477b0fc20534bccc9ca40ce90578e
- MD5 af9cb8d67baa31e6f64f2a2e4d204535
- SHA1 19878df5b019b23de057ede1e46fcaaa009a40e8
- SHA512 86697dee507bd1dc5036d69a9299fbba89ebe94a8955db009b50fb3da2cb960169fa18374319b164b27bbaa9d9aed74aff848dcafce148d321d0097a08444ca2
- TLSH T135F041432DBA9392539813E815C58A210340C4AF9D32CB51184412BC173C4DB94981FF
- MD5 SHA1 SHA512 TLSH