Analysis
- max time kernel
46s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
08/08/2026, 01:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
saunweilai.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
saunweilai.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
saunweilai.apk
Resource
android-x64-arm64-20260325-en
3 signatures
150 seconds
General
- Target saunweilai.apk
- Size 3.2MB
- Sample260808-bkpndsba37
- SHA256 d22af9eff7635a678901a4953a94fd933a79b2ae0cacaa63ba31d89c51e368ab
- MD5 277de15099b6e6c0f6d9785b88dd8d00
- SHA1 3235e30d94b6bf2368236ca6955df0a4b1db560f
- SHA512 290cab81724231a5187bb1b877b8fba7f58a51dc8336c23e18994e8b7b5f26560afe780ae6e5c8e5cc4fcb70acc7fb8c6f19c5bdd9af7d5f4a2fbe17cfa27821
- SSDEEP 49152:JfRZchUnlxa/8E/aIxzKvgeI3g92Yo/KrTBHw:bZu2m/85Idco/KrTBHw
- TLSH T126E5CFCAFBD85D2FC8771132C96A56F2564B4D168E839F476944360C28BB6D80F8DBC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.app.mywebapp - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.app.mywebapp - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.app.mywebapp - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.app.mywebapp - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.app.mywebapp
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.app.mywebapp/files/profileInstalled
- Size 24B
- SHA256 78d34285eba7858882591bfb6f547566d10868a357c80b32faadd64834ff0097
- MD5 b52a7cbbd1a481c728e4d7b558d44d11
- SHA1 8dcf4dfab77e16ce4d903dbca49e2b5c7050c57a
- SHA512 8e8ab46d73344540eb7cac672cb7a368f1d044ca88c44e973cb845713f42a723cb127c01f5c9059cc9348e61524a7dea1225d3c7fbc9ec2d11bc963183f08bff
- MD5 SHA1 SHA512
- Path /data/data/com.app.mywebapp/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 84b65e3b5c9f688dc0a1f2b24476ced9a20e5e44cfb39b2ab6110e8e5aa36443
- MD5 9014b5fb317d0ff4ce1aea0f0c1568ac
- SHA1 51cc39050dca6072dc1ea555f195a54ef2bc0131
- SHA512 fcead16ad9c5391912de90397052f1611ff4b72533866d0470c857372a2d01bd0694dcb4a270152a25fd8898468aca123c803ec477937da60332e50520c7537b
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.app.mywebapp/primary.prof
- Size 1KB
- SHA256 fc27aec5d0ebd03205c81c819f75c56026c56b3fa9c1614cd956f443f3550278
- MD5 e31b488efc5911d4a5b1bf7624af286f
- SHA1 564d977223586c416e564a866e372887db438958
- SHA512 7098eec4556f07f7240f83ec24102b436cdc2a5f614abe8224c7d2061c196f8b473f32e4cecf5175383569c5a03d2367425fe6b21a981d270e807ad6529f12ac
- TLSH T184414C1360B0BBD91B4D736658D830F374C1F5A688E8E324A4FD879013D32949B489C7
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/com.app.mywebapp/primary.prof
- Size 4KB
- SHA256 903f39e7f1cabb5abdd01cc06ee3b0e0ff61b045b19f20b26d9008999dfdcd94
- MD5 9e713f5943b24c29baad9191fec87b65
- SHA1 f470c806fa0312c916eec9e0f12a84511e13562d
- SHA512 cd0b04025b1820260a1883378f09d77770fcb79d6406645a8118c25851b1a026d6357f0404fff090e7cfbe89fd44598732923879b2f2c771eba3da14c683909a
- SSDEEP 96:HHEfkV/uObaeiWJ+QQbyM+pMfxdpVSWE5pwPXBDnS5ABBxEx:HHIuaBW8b8mpIpkR2Ou
- TLSH T1CB815C572C9253B4C5256A0123CCF679D3B0E6833181C66A6E2DE7CF03E0E52FE89A31
- MD5 SHA1 SHA512 SSDEEP TLSH