af2edd53014b39888c253d59fc8fb73612e794ac871322940a8bf4190e593e9a

Analysis

user interaction
yes
max time kernel
19s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
07/08/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Мануал по звездам.apk
Size 289KB
Sample260807-vm651asyfs
SHA256 af2edd53014b39888c253d59fc8fb73612e794ac871322940a8bf4190e593e9a
MD5 cf02b40430eef908a0486a9e137983d9
SHA1 a10a578c64275830f4edf4c80eaa839814055aed
SHA512 f1667ce2006c3edfdea106be9fddfe73a7e7e3f2333a8163e9e0f38b4c53a9317bd2f87be4c7adb6d73968a4d04762649f44d819cfd05a47f8fb3f0a01ee0a05
SSDEEP 6144:gO+M9y62dTrXGISzuXowmcpVlWWlI9IWCSZajb:gOJEhdTrizDrcDjEIWChjb
TLSH
T10854234B3B481E0DDEDAA33C95CDEBB71A455AE43923C363CD15AAF833817845315A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.works.service.v1e7117b1

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.works.service.v1e7117b1

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.works.service.v1e7117b1

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.works.service.v1e7117b1

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.works.service.v1e7117b1

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.works.service.v1e7117b1

com.works.service.v1e7117b1
1⤵
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4904