promptspy | b420b96e0d76702f51ba0e3364da881aaf766e00538059e58fec6b7676a68e6c | Triage™

Login
Reports

Overview

overview

Static

static

nlll4.un7o6.q38l5.apk

android-11-x64

Resubmissions

12/08/2026, 09:36

260812-llb4ssbg7710

12/08/2026, 07:47

260812-jmtdcsbc6510

26/02/2026, 11:21

260226-nf88fscs7h7

Sharing

Copy URL Twitter E-mail

General

Target
nlll4.un7o6.q38l5.apk
Size 8.8MB
Sample260812-jmtdcsbc65
SHA256 b420b96e0d76702f51ba0e3364da881aaf766e00538059e58fec6b7676a68e6c
MD5 d35341798bd6ce066d3bea0a6acc18f3
SHA1 375d7423e63c8f5f2cc814e8cfe697ba25168afa
SHA512 2ce4ff953dc0e007641e9e9dc36fb35f749e1f19bcfeddb38adb6544b9bf323ebc02105143a7eb3f621edc42a98e04348b018e40d263b2fe8fa0abbe1ad93023
SSDEEP 98304:QY6qPtleoCLbxD0i9sBkPLV8i626KNOR6ZbZyrLRAB4zQro/KrtQfe/057bM7HhB:mAUoCLCqnPLKiZ6KNOR6Z2GBEQ4u/5
TLSH
T11796BE86E7859C56D7E24131CD2A92B1571B3C1E87F38AF77900B2E838736D07E5AAC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

promptspy android collection credential_access evasion impact infostealer rat trojan

Static task

static1

6 signatures

trojan infostealer rat promptspy

Behavioral task

behavioral1

Sample

nlll4.un7o6.q38l5.apk

Resource

android-x64-arm64-20260325-en

android-11-x64

4 signatures

150 seconds

collection credential_access evasion promptspy impact infostealer rat trojan

Malware Config

Targets

- Target
  nlll4.un7o6.q38l5.apk
- Size 8.8MB
- SHA256 b420b96e0d76702f51ba0e3364da881aaf766e00538059e58fec6b7676a68e6c
- MD5 d35341798bd6ce066d3bea0a6acc18f3
- SHA1 375d7423e63c8f5f2cc814e8cfe697ba25168afa
- SHA512 2ce4ff953dc0e007641e9e9dc36fb35f749e1f19bcfeddb38adb6544b9bf323ebc02105143a7eb3f621edc42a98e04348b018e40d263b2fe8fa0abbe1ad93023
- SSDEEP 98304:QY6qPtleoCLbxD0i9sBkPLV8i626KNOR6ZbZyrLRAB4zQro/KrtQfe/057bM7HhB:mAUoCLCqnPLKiZ6KNOR6Z2GBEQ4u/5
- TLSH
  T11796BE86E7859C56D7E24131CD2A92B1571B3C1E87F38AF77900B2E838736D07E5AAC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access evasion promptspy impact infostealer rat trojan
- Family: PromptSpy
  PromptSpy is an Android spyware that abuses generative AI, first seen in February 2026.
  trojan infostealer rat promptspy
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
behavioral1

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Discovery

System Information Discovery

Lateral Movement

Collection

Clipboard Data

Command and Control

Exfiltration

Impact

Data Manipulation

Transmitted Data Manipulation

Tasks

static1

trojaninfostealerratpromptspy

behavioral1

collectioncredential_accessevasionpromptspyimpactinfostealerrattrojan

© 2018-2026

Terms | Privacy