Analysis
- max time kernel
47s - max time network
151s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
07/08/2026, 18:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HembritaOVaron.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
HembritaOVaron.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
HembritaOVaron.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target HembritaOVaron.apk
- Size 5.1MB
- Sample260807-wwf6ls1dnf
- SHA256 178ae0475915804fff3b7410c4a554b50fd37aca004925e4412bef6a88bff965
- MD5 8f4f938d076217d6d168f9af73698ced
- SHA1 2269522ee1f51d5cc277cd4d668c58fd4c916b8c
- SHA512 d6177d611842ff9f35b02dcdfd4f19ceb2cf0423c37dc4e133c1832515b69f0708b599570dd89c51b7f12781b8acc8a4e6397fe9040822f17f737230bbec6256
- SSDEEP 98304:eZjJkdluWT1Tdba/COnsXk6zibxVBjqIfCbz5OeY9GdIeuZ+kJ4fg58h8nLfmJz:eZjJk75T15b6tUk6z8RdCbzErYtud4M6
- TLSH T1F2362242E3D56D2FCC7382365FFB97291A818E02C692C3138A68B21D1DBBAC45F55BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.embritaovaron.app - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.embritaovaron.app - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.embritaovaron.app - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.embritaovaron.app - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.embritaovaron.app
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.embritaovaron.app/files/profileInstalled
- Size 24B
- SHA256 9a968259f0927bbc603b3bf8c152d7593d0475a1274431bbaed9d30583510807
- MD5 6ca1abf8079abaf877c64ce9c91ad085
- SHA1 e72c59f1bd2ed64af258c28ff9d4c9f6207f08f2
- SHA512 714756928656e0d7b181a6153a6bd514c738a12eeece704885347ab51a2f27ca77378956424916597d3f3a4e7c2d578a3b038b39786614d8c1d8ab1ca46bdfad
- MD5 SHA1 SHA512