Analysis
- user interaction
yes - max time kernel
22s - max time network
31s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
12/08/2026, 10:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Liputhsl_HSL_Fakelippu.apk
Resource
android-x64-20260325-en
5 signatures
30 seconds
General
- Target Liputhsl_HSL_Fakelippu.apk
- Size 5.9MB
- Sample260812-mrpshseq6v
- SHA256 3406861c6aa59a0fcdf997bde36f38adbacb622e743726571d2aa4c64c75b5e7
- MD5 3ea34bc79ae7d79c9379ab5a6e9d0673
- SHA1 81e15246c38178b290aba6b277c1e0b10bfc2654
- SHA512 046336e573e6f56f20ea4fd55bdcaabc2c1e820ccc5d4d0abb3e3ab250d54e2cea52b6f31d6ef724a36017c55aa4281825603e8b8d8792726b3871f7a9cbb299
- SSDEEP 98304:jQg+/DxNpTxjw6/WrM7DCfAtaIF0robT7usDt0ucheiwB5rrRa48ftRrRpR5:s3/DxbTS6/WQ7DKRo/7usBbchLsrRCR5
- TLSH T1D556029EF7689A2FC87710B24CAA5231124B4C1297479763696C335C78BB6E80F4DBDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener co.median.android.krrpbay - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone co.median.android.krrpbay - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver co.median.android.krrpbay - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo co.median.android.krrpbay - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo co.median.android.krrpbay
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/co.median.android.krrpbay/files/INSTALLATION
- Size 36B
- SHA256 b921e352bbb393a02e20a4821af8152a3521c2905f22b067d5fec0f4ff2bfd31
- MD5 3a2fa017d29a70fedef8cad3d00f9b5b
- SHA1 191751bc353954c27b8d144ef6f3e78267053ad1
- SHA512 773296f919dcfb620af45315183050cdcc97278de59502c87b813f2d1a75b72ac4c6d45fd30a27ccd43dc800a3c3b726a5f847ee45bf6c503743aa962790a32b
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.krrpbay/files/gonative-config/regexintext.json
- Size 1KB
- SHA256 145626e788b7cba066f4c346f0df6fbf1ed66d142eff3aae8c70eb1cbd2d2cd4
- MD5 b1bc1eebdd20930805f76e1e8cef479f
- SHA1 d7cd6adb361758290c5abe45cc9ff626949e45d7
- SHA512 c8105a21654276717f195308e2e417150838ffec12d62bea768b2a35af5db18668ea9f86bd1e46b16f6e3bedcddb21b3fbec7a156456c8928f8f3f46b220702c
- TLSH T12641F474C9780DB399C82864B26E421B7A72615F2FD6391DFB8C162C1F4C5BF69B820C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.krrpbay/files/gonative-config/splashpage.json
- Size 3KB
- SHA256 8bf9c67638c5ecac8a5f69d8961dffbb65f87d7bf1506ddf9136957e86cd4403
- MD5 a1ac51780bf0e57e5dd0fc0538f8b996
- SHA1 3a88fc822936af24d83a758b1886d174372a2ebb
- SHA512 cb2d9227194e9fb16768b1edb73979ceee633be576f4db4b44f31606359f5197e9db8950af0d00e0e9caff3fa31194a2287c40679dfe445ed27cc650dba39eaf
- TLSH T18881C7BD0040680766C967A7FB3CF67A4037B647BAE10EC4193B6187E5A7170EA92C37
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.krrpbay/files/profileInstalled
- Size 24B
- SHA256 a1ef3fb2ca6b1d1f61e448d7674bf6e86d374bf0b01b086f069fb9e80c9a486f
- MD5 79c0406701ba3c8bda58cbfea37822dd
- SHA1 683ef8406a5a2b62b5d79945bf033262b9422942
- SHA512 ce194c1382ad5eeb57552ec587b5300e6539066b391904cddb6f607dcfc7040b0b3d0a4c95a9e02a04f0254e0cdf245a00ca81a6e7ee47ef44af0376d4b61be5
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.krrpbay/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 ad64df5290e0619f0f1336e8d60a0fed67b23a6333f5b1fd4da0661371752cec
- MD5 692912d08ed6ce69ec924d8ffde6be82
- SHA1 6658c5927aa4b78932abd847bb0998560ed8725d
- SHA512 c9849389083960d6217abcafd4e5a61055b1bbf8b795be3d61b54ed2dbcb2a5987270d11bf691b0d74ab135cd85f896fda2bd6a8745b21f676ac7fe3e15f36ce
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/co.median.android.krrpbay/primary.prof
- Size 2KB
- SHA256 3370839d6cb91647e1a141eae856156b9b2663e9fbae1029738a146b72960102
- MD5 4fb3d2c67087f71498ff43f3e38332e6
- SHA1 66a9af6b5e08a547d651d7e247f05e3c90be1b42
- SHA512 989df5c8879ce58e0daf793f184a82651f42e263ddee8700a78352bc82d686656871fcafb14439dd392228c25a9340a21433a7d33f4773aae8ebbe5d541a9c6f
- TLSH T1AD41EBD326500D7456106C9D961DFCAEFED9CECB4F9EE071142C2A7D39E897312425AC
- MD5 SHA1 SHA512 TLSH