44f9d5c684fb6f34465cd7593709a37cadb57aaf41430b0d043fa593e4faacab

Resubmissions

13/08/2026, 20:23

260813-y6mggsxvax7

13/08/2026, 19:41

260813-yeemkawwhw7

11/08/2026, 19:39

260811-yda8ragc937

Analysis

max time kernel
46s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
11/08/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TikTok18.apk
Size 8.4MB
Sample260811-yda8ragc93
SHA256 44f9d5c684fb6f34465cd7593709a37cadb57aaf41430b0d043fa593e4faacab
MD5 1da48686908f9535d7123713deddbd7f
SHA1 7f6982bb0b21b1d4ef0b8a21e5a7ddc7dfc4b09b
SHA512 a5971a9179f32d5085b09e1ca7e3c3501f90b9cf9523603e570feaf2cc2d4616b50c90bbbfed57cdafa01ab4fb5d5a1224b3fe0b09655e4cbe1b9a83e56eaf97
SSDEEP 196608:9KVxAgmf7PFRljf+yW+QxiXqKIeN4UbhwCBZa3q:EC7xfbW/XOThwQZZ
TLSH
T1C896225AFB05D09EC0FA42364A350266150B1D6A8E83E7875959733C1DBBAC08F6BFCD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	video.lotus19.ridenovel31

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	video.lotus19.ridenovel31

Requests dangerous framework permissions 19 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	video.lotus19.ridenovel31

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	video.lotus19.ridenovel31

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	video.lotus19.ridenovel31

video.lotus19.ridenovel31
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5048

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

.payload-id

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/.payload-id
Size 64B
SHA256 af7f6d9b7f729b11c0b87bc8595724bf295df2c55c3b02aebe8b20521081f9fe
MD5 7ad426d7fe34f35bbade83aec35e6b8e
SHA1 f77cb82b6d7ca471c182ab319f28c638c53cda40
SHA512 de80a611191815700d17e16ddbaf58565a121cfdaab2d9ccba257427ce17c472bb1c7a6d86cae03a7a9edbb35b79479079fbb9ef9e577a316e2f476166c8f57f
TLSH
T19BA02220C22C08820203A020C28800CE2A2A2302888A0C8A00B032220088228202ACA0
MD5 SHA1 SHA512 TLSH

Submit Download

child.apk

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/payload/child.apk
Size 7.8MB
SHA256 3c669c3143af7ad4a6c099ddc0c8ebd4cd8cb4c9c582d202fd01b4bdd3b4e1e6
MD5 6401fa4e7622fd6facf931e479cc6eac
SHA1 8291f6c99f9bc623646ba3a40b3b5eec8e81de1e
SHA512 c4add856f177e240e17a260861cf2a4a32de40a449321daa906c70cbaed7fa94b58fce175eba035bbb25a0a9d3265fa92241390998abe2fb809d0a54e9cc54f8
SSDEEP 196608:7BTzGidntWEIZ+HJLuPdZG/fZp/cXus9b:7BTJWDZ+pKcfoem
TLSH
T1E186BF07B3418EB2C8BE637295B35B3163335D46AB0397472508B6BC6CB75D42B89BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n-catalog.js

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/shared/i18n-catalog.js
Size 39KB
SHA256 4cd4ceb977ba55e4f2ba30072642dd8d8a3b75a1d77f6b9a284776bf0b0160e7
MD5 138848003779943552e8994f2e91d297
SHA1 b34ab15250d7f8196c7e1c274564f2d743e8e13c
SHA512 afb5b806ee71c9bfcfdee53e5c6142c92fa2ac195307a351c886c6590a3d24032bd9689bb71677e1da1b0470b265fca9a585b78d44ccf2b9d59eea2361a5745c
SSDEEP 768:XesNs0gkN917lZ+oT35V32sxu63w45uP7Ha5H3MHeXt0EYsJvI9fg14olFkL7V+2:Xees0gE7lZ+c35V32r6A45OmekfkPV+2
TLSH
T1D6032C6EC25562206D84A385091B35312E2048B37B2679E43BDE59D14F8E58FE3B37BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n-runtime.js

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/shared/i18n-runtime.js
Size 4KB
SHA256 633fd94bd7547ecd11bd23d0eb16c11122b37c667458eb1223bcd5a9da205301
MD5 d9a7dfc6a4d70fbee09033516dd6f360
SHA1 b2bc6969a5d274a871369475ee5b940e665a67cf
SHA512 1046809eef6ad06c5abd45a0e5f9ed5cc61e286eb914ae7be635e2a5115d6c47f38102fb28d390489d1428771107638d30fe2ce8f931f326fc467e04a75ba915
SSDEEP 96:yiO51aE6oFyp+oryLvCXMA+RoWQ52do0Dos7owo4oLogo9oplFCtK6iQ2Wf7tG7V:ifGpQjCXyjQuyyiQ2Wf7tG7eNjc8liQO
TLSH
T10581B9ADBCE311025502742C09BF0680783480070AADEE42BFAD99565F985FF66FBBDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google-play.svg

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/shared/icons/google-play.svg
Size 1KB
SHA256 8b25682204477dec055a59f72cb72574e2958196c715391b2364e4b086d314f9
MD5 579b8189936bab6778bfdd8c19fc493b
SHA1 f81cfd87d033bb64c537dec8031ea542d8f22b03
SHA512 7532233d9561bdb8072beb7f97144a278f61a9c8f478c69f95434d00d34217f4aa9e3dfff7e8c540c320ee4f350714a96f5a188a1f5b7d108e338ef5e806a00d
TLSH
T10631310DA5965C3F5A72C7A462F49D8B673224C783A8C8DC85A92C3EE65C5C021BC6FD
MD5 SHA1 SHA512 TLSH

Submit Download

star-outline.svg

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/shared/icons/star-outline.svg
Size 278B
SHA256 c08437af20cb85cbd5f0a4c901f63476c2f717b37ba07ad546315ef514d317d2
MD5 a5feff4b1477efe7a3d525856fbcea71
SHA1 298d27aefbff453371ed0e432117fd3c0f0f1eec
SHA512 d76e3af49a883214cdba317f9e215a476e84c79c04357e3c5efc2951a49792c43fd3396289de584b64182e568487f14d1c3839ff5b358a4bb10db0e1aa14a2a5
TLSH
T15BD02B3BE0296D88477F429109B9CC8DB27D921B45DD003DC9BA514485A1AFA7B2A4BC
MD5 SHA1 SHA512 TLSH

Submit Download

star.svg

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/shared/icons/star.svg
Size 381B
SHA256 513a0f450ac62c6bdc6c6cb8701896ea4ac7a82121b9e19cc52596fd7ce3b5fc
MD5 fc5fd2338d246078b4a4fa29413f23e6
SHA1 52d73cabeb5e64bb9e1e024623a90a0e0cb888b6
SHA512 8abce8608cc9351440e7ec2cb624841b9357f1e6a8a9f926f4801f11b691c8cc1a2961c5c22373b677255e8ed51856932c33bfd4245ab1836c43c03a7ddb8afe
TLSH
T142E0680BCA1C6626838C0655A978B884D13F436A426E52DDEAF751106408BBFBC4EB88
MD5 SHA1 SHA512 TLSH

Submit Download

install-state.js

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/shared/install-state.js
Size 9KB
SHA256 e40a4d7a2782580309da5ee86bc24150fcbf7df17f65899c22bc2e97591a78cd
MD5 79fb64672fc268e918c2e31dc3f37fa5
SHA1 223c7ea25b4a72ed1d9a144e99a4da2d12601da5
SHA512 78733179ec45dd0f2bdb954653f845287cc0dc38d6a0e3ae7997061c75be9d477731c562729397c332e141ea5f7c7596bc06cb6352ddf5e6af0c786cfb5a0688
SSDEEP 192:pbCjNkD5WkoQi0TGyo10CEfoPnEBEaOAAeDHl7pPcsOPEHr6JSFP0HPie:pb9FWepr6IFM
TLSH
T18812838F949314B59C17B974C64F41503D21499B240DFE10BDADEBD0DF830A9A2BABFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/upgrade-template/app.js
Size 4KB
SHA256 c7f7411489da72c3624f0f0a6654eb8f5b19dc2eccfcebfb9dccc91aec94c128
MD5 972d7bb25d74a85b01fceb92e3d37e81
SHA1 f9d9a07271104073395c705c77b10c2f5b2c1d66
SHA512 b85ec05d9643bb687b98a973da2a0820b28b234a1bfb3d9dc6cff4972e5cdb731d0f10c9aed2739fef640f3de8bfdc68481710310b8a8fda1cda743ea5cb3115
SSDEEP 96:3n7TLwKdwA4Mv8+xs+95g06aQa+ZqhqG8+27hXP39dV+O+/Cx8zWp/Q:3DwKdwA4Mv1xs0uqhepP3vV+1w8/
TLSH
T16C913F28A8E3147D8527702D136F36847C2680131402EC19746DC8DABFAAD63A7FEEDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n.js

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/upgrade-template/i18n.js
Size 5KB
SHA256 c771ad6ac7446a58072033fb6245146259c996ff2abaf31d9d497a552a66a810
MD5 c00aa9ef7ab440e001c443a6a3fa2a5f
SHA1 2df57a4884211b6541d84ffbb5e4a795d6fbccb7
SHA512 5892871315abe40bd76f1ce7d0b6cdd515ef4f7fb66b5e43f061a9307a9081e59c439bac44289a0b3a89807d1a9a33ca606df5fc54d261a29d0e6204ae0dea0b
SSDEEP 96:8Dg1tFcIJTX6pOfqIMoDKo/DrRWiY8+I+kWwaw2JE/9xz4h24s4BWrcGOoqKKhMY:hK6pY3E0OnXT4icGOFKW
TLSH
T146C1853906972485899CB3AB228E37327878A09E561CF8F07C6D95D54F8C9569334BB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/upgrade-template/index.html
Size 47KB
SHA256 07d22ac76f402b6d09f03996a27d4129b0e9a3845ee5d599fa2c3ebcbbba9665
MD5 a098be9a8270ad9546110f2a9179d8ae
SHA1 d4b01ac5b32e690c353341491d4a7404b49ccf90
SHA512 0785793454dd5acd8ba5dcfca6cdd5271c4af739395b9ae1c03165444c5024fe1815750022622612649f36bf51ea1fc2cc2a99deb831e326894151852d093dca
SSDEEP 768:8C34s1S0HUpRtvrbXyHzwi3dzsE1WP7GCl1zNpmVCvWqc5oqCwqLQjw34Mvsem:8C3r1l0TbazwyZsE1g7rl1JYCvWqhdwP
TLSH
T1142301515C72F9B60351D9E9BAA12E18FDF08DA3C38A449C717C1D930FEAD68DC6291C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.css

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/upgrade-template/style.css
Size 10KB
SHA256 fe17237d9cd947f794dd6e3a197d2ea06575e7cbf0fe635fe9172238ad51dc54
MD5 eff83f68b893847e5e3a6c2acd567102
SHA1 60605d2c6a4bc95f8cebe3f34c59e73e4c3c73c7
SHA512 754cee095fc66252bb6d381ff06736e2d2483a852f7a09b3c50431ed5fcae9ef881a39694ce9ddc928743fdf12fb981bcae8580772ad5c6c1389f4192728ee3b
SSDEEP 192:VArgWLXaui42Lkz7ZB4Vw61xPmN3CtYeK7cxFwAF2VL2C6Y/2LfBKFCw3YI/NxE/:4lJW1KwvQl6gboFkhgHl
TLSH
T141324312A630D57D7C3FD6BD670B5B1AB7688906090ACDED6DE8200C5FC53FB6422B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vault-config.json

Path /data/data/video.lotus19.ridenovel31/cache/shell-runtime/staging/vault-config.json
Size 114B
SHA256 22a607b9254796ee95f3f4038af91cd91a08eccc12e6905f28289670501b02dd
MD5 6eacc8d1ca5dac9403cde422a89c2e17
SHA1 45da27f40d5d094115d3d6886b54b18c2af285f7
SHA512 3d603edd3cd681bdd007ae886eb153da34ded843b74ca9552bd3edf81d447a63b683e9963ad07a08e8de7f03c42c1e968740587043c98c23f9e7fd78bced1c75
TLSH
T13DB09216B382425637E635AE102DD1061CC4188667024CF2BFFB1F4CB81B20B219F84A
MD5 SHA1 SHA512 TLSH

Submit Download

profileInstalled

Path /data/data/video.lotus19.ridenovel31/files/profileInstalled
Size 24B
SHA256 22ed45aa68da83c46cdf230e4fe12fb3a86cab26ae0761c5fe79644fd9120615
MD5 84a0ca653c5a4bfc73211ff7bae282c3
SHA1 f92068e5e83f45dffbb01ad68caa5d877d2b1ae6
SHA512 965526b3382661dae76cdad2456cf29a2f6c1b60f935004f88b3ca456d9d48081693a4135fbc7c0314611b23ff0919cf764664d10ebc592b4d8243d172f1cd78
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/video.lotus19.ridenovel31/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 41e5551f28c23b13a5b4311c42d6e933a94cf8a790fb6d3250d8a8cfef1156c1
MD5 06c758d5a151478628f31250b0213888
SHA1 8926d37374307ab0ebf30ceafdc38d569338c2b2
SHA512 f8793182d310000178324c2b3ff6464bc2e2e115c7d0705692fc10f7a05d69ba34c0e1ead71888da86c5cbf06c854f9d77b10aea98c9a27ad36b1f42e5d3c80f
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/video.lotus19.ridenovel31/primary.prof
Size 1KB
SHA256 c61c6215449b3f00165cc632b025b2090ce7d4e50e27c0807ae556d4ffb3fa34
MD5 c33cedb12258bc3098760145d27f93e0
SHA1 4023ccd244e7a59fc7d0cf865987093316637e11
SHA512 fb950a8e7603c3bc2e17ccb486b2ee039d6184608f40a089f7052013b26f3e69426dc8acb570851866583b6d5bdc0932052f7b27d66619e0f699acc1b845f04c
TLSH
T1C921C6C0562C96928B36FF58C521841C2ADF1F494C3234AE47223A988C99318DEE2DA7
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/video.lotus19.ridenovel31/primary.prof
Size 2KB
SHA256 d4ee364eea0cd8cc3631f20b7eed24d370a6377dad52ff839d8610004639eeca
MD5 b505b1a04db0afeead7f3c4dc1d08725
SHA1 fb70c61b71bcadacdf094e15c23cf08eb128111a
SHA512 2433f493a06d5d0806a9e1af282e93f08f2bf2dc2643291c07fd0fb18d92d8bcc6d60336615ea5045f4f5671ed3138d1dae445fec8b79bf222ed2160f8f001d9
TLSH
T16C413A9CB0F90D95601BAC2AAF282785B5F32761A038DB11003D3CC616E434FEA4117B
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads