334faaa6391f01cd12c97805a30e1b28b122a1147c40051d683e7eaa4cbce22b

Analysis

max time kernel
37s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
07/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FlowDeck-1.0.0.apk
Size 4.3MB
Sample260807-wtaaaa1cpg
SHA256 334faaa6391f01cd12c97805a30e1b28b122a1147c40051d683e7eaa4cbce22b
MD5 66591d88820c323e17c2cd0023b043e8
SHA1 a24ffde2bfe5639e3fa6a9b6bda68c6de70235f6
SHA512 589d036c2ec4b88b2cc023e79138b5eb4da18f47069d35b5e4df93eae926b0351a2f79316b0507906a05294b252eee57cb93198c82354c408a56a270e5258a9f
SSDEEP 98304:7V9PWMkajsyLDvOkRkfq7oa1vCVjwUel5r6ANXyOsf0vfsDDnbx:7fOaf3OkpKjwUc51yii
TLSH
T1A9261282F7E56E2FCC7781361F9B223162168D56C653D70BA988337D287BAD80E45BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.flowdeck.app

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.flowdeck.app

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.flowdeck.app

Checks the presence of a debugger
defense_evasion

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.flowdeck.app

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.flowdeck.app

com.flowdeck.app
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4678

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation1892175458137251013tmp

Path /data/data/com.flowdeck.app/files/PersistedInstallation1892175458137251013tmp
Size 567B
SHA256 02a65fc93cbaef4524bd0981c76172822b591da2ce5f9a2e194ea990655ce1c5
MD5 de592628e8115a608e5c95adb0e39dc5
SHA1 d80d65e4be5f23a88704e94899ef39ab6d18b442
SHA512 089e2dc98e053f9edbb717a37c60af49c74e896c163fb0ad8725d28b90d4cc57a5d28c3efb686bafd795d499b622dc49bdee2a2f6663a7c0ace0b057de188a77
TLSH
T1C7F096D672508617D08B57927C8EEC06593D1474265A19C6BF8B417291D1CF9E053892
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation7581619047221305291tmp

Path /data/data/com.flowdeck.app/files/PersistedInstallation7581619047221305291tmp
Size 90B
SHA256 77e24b8ae29cedbb12a4cbf5fe7f35f0dd8d49663b19c98516333a655093dd0d
MD5 cb72a1484a43174d559229254ec11f29
SHA1 87c3e7aab311507d5a69a62edb72836884c3c938
SHA512 9cec1b181fb1c911ad455f7e667346e81abd17d810e7e6e99ca477baf27b93085b77d96269025a7015cd291e70b8c3d42614c08b4867957b842744a8fd903445
TLSH
T133B0120046304152948FA2172C5FD5409E502550040D8A084A0894B160832D4F143DE8
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo4MTI4MDY4NTU4NDU6YW5kcm9pZDo2YzQ2ZmNiMGNkNmFmZDdkMThjMTRj.preferences_pb.tmp

Path /data/data/com.flowdeck.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo4MTI4MDY4NTU4NDU6YW5kcm9pZDo2YzQ2ZmNiMGNkNmFmZDdkMThjMTRj.preferences_pb.tmp
Size 321B
SHA256 ec012897e0661fd30a3ef5c11299930dfd219f2f5b67352362c2a0179206e8f7
MD5 cf5576873b5d3bf2b4a6a3634ad4ec72
SHA1 9ab8c0142199c52348ef8f24adef5498347dcb05
SHA512 cead6fb2c11db1f10d67aaa99fb6d5d8954fa0fe2747189c0e71d9b31aa8c4a163bb5b6dbdb8f643b4db0605b577c930c42a0f77af4e080fc2a4f949de1f18f0
TLSH
T15CE02600DAE16DE01D2F110C7BA401280E2FB3D1227A045961F80080B50A652D2C2F0A
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo4MTI4MDY4NTU4NDU6YW5kcm9pZDo2YzQ2ZmNiMGNkNmFmZDdkMThjMTRj.preferences_pb.tmp

Path /data/data/com.flowdeck.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo4MTI4MDY4NTU4NDU6YW5kcm9pZDo2YzQ2ZmNiMGNkNmFmZDdkMThjMTRj.preferences_pb.tmp
Size 345B
SHA256 e153a2da9792cef592d19ac928a0b5ae062170cec718d9123495cf0cb3a2a768
MD5 f0630b497df0dd217a1bd81937866d3a
SHA1 c63684ea7b4d03e5b5b0dd09129f3d159699b9ae
SHA512 d1f39941a35eb489e72b3b0c1e4f26616a9341315aae99e4fa901d277eda4d9b6c644c552672f1588ce51681d8aa149e5f168b7bb29c29faf686411d5b59b1b8
TLSH
T178E02610DAE16EE16D7F560D7FA4022C0F3FB3D2227E045A65F80080BA0E652D6C2F0B
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.flowdeck.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 945d09f72781fe22faa4af0a88ee14fa8216a7d1b8251159c8812f0ba00cbd5f
MD5 28f80f7126ac4670acef15d7a0451696
SHA1 df85a8f21b2b0cda9bfd029a0fd2fe9bff2151cd
SHA512 b9a8028bca8dd8794731f05eeb16800e9dfe6c7cb489ebc671309dfd55d4b99c8ea2995ff16eba471701893f69ec57ec80f76c674eac427df62541c32b0b5fbd
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.flowdeck.app/primary.prof
Size 2KB
SHA256 407001307cee771f7941720dd0daa73a8f757f4e6510ebba30042163a64cc45a
MD5 ace70958c9b2a8ce4971f083cef9eb89
SHA1 11537a1e5ba143e06f4c51a62091b02f4239d8d5
SHA512 b0065fe925c9f86597b77c10f50d7ee0ff24d731d83a2edfb5f8cf14a373e2fe8f59a79bf35ce22fc6da5811bd773d497c3b7f9d7f51512868d6407f8c5166d0
TLSH
T152411AF9842C485BF6154168F83C3B415702891023A4EAF5EC182E7B5493B5ED3FAC47
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads