Analysis
- max time kernel
22s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
12/08/2026, 16:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
app.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
app.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
app.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target app.apk
- Size 6.2MB
- Sample260812-tmcqqabm41
- SHA256 a09845937bfdbf096e63a9831451352b12fc13771da56e4d701d0c3a2e1074ac
- MD5 1efe606d1f9508865f941f0b580fcaf7
- SHA1 456f2f42877fe08888bf735e0ad88649da0e18e9
- SHA512 72a7934e83bca49b9e377e1b74bd914d9c089bd8394c7d7c81b470b13f9b3b53b2d79d3d6aed93f0e32aa3a515ceb20e5c7f66aa2c0fe04dc4faad3644d6138a
- SSDEEP 98304:aXdbUh50OjZf46GEk/ADiuC7DCfAtaIF0robT7usDt0ucheOweW6lTVpQWNl48fV:cbMw/E0Rt7DKRo/7usBbchfXRyWjLh
- TLSH T1AC66029EF7689A2FC47710B24C6A5632124B4C12978797A3792C335C787B6E80F4DBD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener co.median.android.yewendr - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone co.median.android.yewendr - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver co.median.android.yewendr - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo co.median.android.yewendr - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo co.median.android.yewendr
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/co.median.android.yewendr/files/INSTALLATION
- Size 36B
- SHA256 34b83bdaf3c78452c1e1bfd8d1ea619d5aebcb9d4b812cb7e56b29efd8a136bb
- MD5 f2473dabef24abc8435be8f54be1c254
- SHA1 c96bef79284f0101fef54ef860e72561f076069f
- SHA512 f9f7a361ad1a774961568a604bdd1db5ab2e49ff36f4775c8fedc797e41dbcc31e081ac5b15458d3c4d6aee11fe7ee1733e1618ade517cd5b02fe3be12d77d26
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.yewendr/files/gonative-config/regexintext.json
- Size 1KB
- SHA256 6d31ab6d913822dcd5833cac0a6e7912c1cd4abd3e85d97caeceebfa338edad0
- MD5 0037fe15df362b3cbfeea29d6c837d67
- SHA1 0a2b4623c2929b0832e5fcb319be850689861ecf
- SHA512 5b8074498965e3158cb8a26352cc9c51488f262bd44f60a787955aa4b8d25e0038964ca21492efe2c5c215eaff93981a3a184cb6ba8e464dead6f4f71fdf8d19
- TLSH T1F1410474C9380DB398C82864B25E421B3A72215B2F95391CFB8C062C1F4C5BE69B420C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.yewendr/files/profileInstalled
- Size 24B
- SHA256 d0bc45bed835369ff3c7194836d20aa5f329194fd73b845dba0d4fa834bc8220
- MD5 4e330d5a90f87921ce6d755595775e54
- SHA1 1fa3bebcc4737601dde81566a4f76578c281f582
- SHA512 113cbe9f38083a6541ec45279a19edf80c779502007e95a91fa779e7a545f6066aa7a098d4dd5834935b2912e80e5542b714aa39f9a2d8ba452801c7dbb42d10
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.yewendr/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 17fb498e4a611462a410bdc911ad2b3a864d5e7d28b909e31e4008c55db29577
- MD5 8a449f3220c2447bf52700509f7ceb84
- SHA1 35fbeae78a984af538e64e27b1cc70fc7c6da076
- SHA512 1135b72573aaf3fad09d5113695cb32fa9cdd6f427e5f09957bea7cb48315e2e7aba05e1d494d574b6bf202655dd3aef2b35bd837cb0c68b86f3f3ff2a71cd52
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/co.median.android.yewendr/primary.prof
- Size 2KB
- SHA256 32a204e9c40be301c51703fc779fbf8e82822e7257762dd57d52511db2f68765
- MD5 35ef0284d33475af1600ff23bc8daf3e
- SHA1 c7838022bcb5a0c43310dbe6248284b15e89dee9
- SHA512 65e9e117d97283c77cdcca06d6b1057a45265b2baac8b77a0e28ae67637b3230f423351b0c40f06741b5cae6ed13421bfd669c67afe113ad2ce10b676b416139
- TLSH T1D9415C885C3189341892250480959D48F4EEE3168D3FE2FE12BCF1BF60AB8E4784BB39
- MD5 SHA1 SHA512 TLSH