Analysis
- max time kernel
46s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
10/08/2026, 18:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
alva.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
alva.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
alva.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target alva.apk
- Size 5.4MB
- Sample260810-wv39ravcmc
- SHA256 5eb21bc7936e7d5dc0dd2ce2aad19713f1745b992b0badd46b637ac19809c569
- MD5 a92a6b5c3f9cece11d0936fe9bd16c12
- SHA1 5b5da28681abd7f374f9722a9bc4268759052712
- SHA512 f31eba7461c3bff150d77e0eda2a194ef2fa1deede136edcc9db33f6f01de48b82a0a2a10586edb6239c8f4bbf716cde6395f552c4c67dca903f471572af0782
- SSDEEP 98304:nzEScqe1VNZ016qVw07DCfAtaIF0robT7usDt0uchz9EHHe17klmTwrkXFtx/f:nzhdQVNZezV7DKRo/7usBbchPZFXn
- TLSH T1E546F1DAF799592FC87710B28D7A56B116564C13CA838F53AA18330C787B7D80F89BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener co.median.android.nwyjrw - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo co.median.android.nwyjrw - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone co.median.android.nwyjrw - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver co.median.android.nwyjrw - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo co.median.android.nwyjrw - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo co.median.android.nwyjrw
Processes
-
co.median.android.nwyjrw1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5060
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/co.median.android.nwyjrw/files/INSTALLATION
- Size 36B
- SHA256 6cfddfb460fdc2433e9e915ea37d2eaa70dc2aedc22ad0d12d5950a02628dfa8
- MD5 2c124ae135e2aa3619d1c064eee9054c
- SHA1 e68ec02a59989b0e7869aab5a8d45724f408b6e7
- SHA512 864f4017647e58abf618e54206f689a85da30ab8a5c396f7b6365ccd9f97a6f77b492ce556c7cf0dda908db1d3a51ad7322419e407c7a2079908bd65443c684f
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.nwyjrw/files/gonative-config/regexintext.json
- Size 1KB
- SHA256 3d0d4ad4c04126599e511d9ebf91996578967051fc9bc89479e5aa52092b4256
- MD5 e810d8a5ea84ab9e87b82ef731f3cbb5
- SHA1 3f5262c8ded1862adf30ed118c7cdb8a2cec973b
- SHA512 88115112323feb7d6dc169306340c5dcec6c38d8e31bbc0897e4e1d7c49fc850a737f7c3710151a80a647271ce8bc9b3d7cbee7d6516051c4f8f9ba868bd25ec
- TLSH T12641F474CC790DB399C82864B29E521F3A76221B1F96392DBB8C551C1F4C9BF69B920C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.nwyjrw/files/gonative-config/splashpage.json
- Size 3KB
- SHA256 373f12295981a5d29f5f9aee1a8030c86a8826bb95f6e9a92cccff86a79236a2
- MD5 bf0175497f7ae2823b90efde0a74045e
- SHA1 44c1b23830bd7fadccfb2572b3253642c2bc1266
- SHA512 0f4aa9bdca71d654d80a582333f10389a8c1b5614c13a91ecbff71dbec0b8a63b3aab17d44b39d2fa1d853027bcb307fc32654ce0b401dea203599c379d2d29e
- TLSH T19881A56C1C90196259CB63627C3C7ADE4163F293FEE00D846C27309FF1879A5B996C6A
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.nwyjrw/files/profileInstalled
- Size 24B
- SHA256 e5946cc624391e8d5666e2223a23d63eaa0ffe9fdb6d2ee7fa0e18f8d8a9c256
- MD5 bf4ecf37268306a229ff99989f22194c
- SHA1 63ffbd0efdacd8e44dc7964066115ebec7fd5b2c
- SHA512 bbb35a02c719f8e3a9c6391165087ba55237c5326758e73e704803f3db7151299c2110ee04e9f6bccce276dfc3573c5cb2b9c3f1c5060629ca7fa56f0febb16e
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.nwyjrw/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 6efc2f3a486fef30a6c912c5c9457989abd3eb74ca7015d018ae90b3ff5c62a6
- MD5 a4cfecfc7e1f20efb88b63547174738b
- SHA1 b3fa9196e784e3c1eda065b7152c5fce6dd5fb1f
- SHA512 6fb673f231d9db24fda572de60cc6b5303a58ab63b1b492065e5fe8bba25e433bd52bd1ba6abfefe4ee767f506df7798a56f5de20d529e25a7be2cbcf85152b2
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/co.median.android.nwyjrw/primary.prof
- Size 3KB
- SHA256 7fc78730ea5c3022b22a389ae9ecca28f3d176c32793ca4d8eb8047f60ead4d4
- MD5 326c0b5d32aeadb2b01c0e5f24a72bb7
- SHA1 43fb27c8b47bb9f148123238241f57671a108840
- SHA512 42c635395b8d774ff12c0dbd2ac6d9116d3cc50cd5763053bfa945fbde534370f00a1c0b8f52f50a9eab062dbc45a95e4af722a445924f2ea10c2c5a4056cd1c
- TLSH T1B9816D8640FDD63CBBA0057DF6FC1943E305FBBE61638D3E1A564E1C42438AA01B1A1B
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/co.median.android.nwyjrw/primary.prof
- Size 7KB
- SHA256 8def9cd1865ec7f372ce45b5102837bf9ec7364695305217c93754393fbb6e3d
- MD5 7f1ebf7704e2324e6f1b6fcba64962e7
- SHA1 53239aef15623afd0a84b74ea02ca7c57cbf5298
- SHA512 7eac356d8dd03ec1c79083b43cc7c5427ed90b18009ede74949ad19940d12fe8c01f1dfdf9b207c26e3663293fd87d64099f91cb4541582b1561bf4db2b49d77
- SSDEEP 192:Xle0mxsK637I4DW4oQMJlHmbHySAINvfgDS2azJj0EUtPdP1h46:vsROIv4YhSLFfdNj0EUtPdNq6
- TLSH T1E3E1BE6B56AF74A291B304017908FFA36185E1AD04CCCDBB57A440C6178CBA37526FEE
- MD5 SHA1 SHA512 SSDEEP TLSH