Analysis
- max time kernel
90s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
05/08/2026, 18:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
meras-user-app-v2.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
meras-user-app-v2.apk
Resource
android-x64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
meras-user-app-v2.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target meras-user-app-v2.apk
- Size 5.7MB
- Sample260805-wwantsdb93
- SHA256 f7dad6b87d99cc09ec4bfff322921c844af62f1a428db5ef1697efc99e2b7998
- MD5 de822e146dfcaa5ffc32e29ac98d23d4
- SHA1 d7c6d6aab5b32a527385e10762bea21149097651
- SHA512 8b2743cf8dea803383dc5b3351964b078278554de22651fb7e18ee351eb15376a19c283b2612eb60853dd699a49ab465b94ebaf126da04fae7ebc80a468e585d
- SSDEEP 98304:WHDbzOw/r2IDs4M+n151KDSEUeALLp4GWfj:iaC2sbV1eSFbFs
- TLSH T131561242F3E9AD2FCC73C1321FAA063602468D56CB52E7475859735CADBBAC84E85BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.meras.userapp - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.meras.userapp - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.meras.userapp - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.meras.userapp - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.meras.userapp - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.meras.userapp - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.meras.userapp
Processes
-
com.meras.userapp1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5072
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.meras.userapp/files/profileInstalled
- Size 24B
- SHA256 907be4abba11d088e1e8fb3f08fc2406b6cc2fc80d99ca3e6b9496085920e034
- MD5 081c7705432f10b02b4305ab28439b6d
- SHA1 1f63c750b93377b5f22ae4412c1953f2c55eb71a
- SHA512 88c26704144e384dd532cd14d1cf1fc007f69222be515f3e772ff418b3a4effad365bff6e62053d4bd9e61b578624bccff2478a1713935e35c83e817cf164e35
- MD5 SHA1 SHA512