8910f907e11539a2320c40186ed16f8e45c208fda60f987b1329f37e365fc01d

Resubmissions

13/08/2026, 18:31

260813-w52tnsvybz8

13/08/2026, 15:01

260813-sebb9abl418

Analysis

max time kernel
24s
max time network
150s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
13/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRABADOR .apk
Size 4.7MB
Sample260813-sebb9abl41
SHA256 8910f907e11539a2320c40186ed16f8e45c208fda60f987b1329f37e365fc01d
MD5 86f8c116489a523d7eba9acf6da7f090
SHA1 3eb98e42f3ff318bcecafa91a4c00337cdf25710
SHA512 d5663df1d7bbeab2c7c8a959af6df40b2c863f8a181bee745300c5acba7dbd26a49ff05f60444a8592eb579b4d25c236306e2794c6b47e11b680924530d0620a
SSDEEP 98304:B4LlWO1xg+M6pP5kDsgxjHaMNQhbalFc2WECfrWEMtmZ:B4ngL6pP5oxjH2RalK2SMy
TLSH
T1A436CE86F768DF2AC87380374DEA6632155A4CA79E82D7923905734C38B79F44B49BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.kimcy929.screenrecorder
/system/xbin/su	com.kimcy929.screenrecorder

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.kimcy929.screenrecorder/cache/1582435991586.jar	5024	com.kimcy929.screenrecorder

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.kimcy929.screenrecorder

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.kimcy929.screenrecorder

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.kimcy929.screenrecorder

Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.kimcy929.screenrecorder

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.kimcy929.screenrecorder

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.kimcy929.screenrecorder

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.kimcy929.screenrecorder

com.kimcy929.screenrecorder
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5024

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1582435991586.jar

Path /data/data/com.kimcy929.screenrecorder/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
TLSH
T1C412AEB4BF77093CD0DB0DB8CA67E800A05F25841AA7D514E0656066BFD47B5F1E315A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.kimcy929.screenrecorder/databases/com.google.android.datatransport.events
Size 40KB
SHA256 e802fdc1ccd833b91d80bb1d8f54cab2b585393e6a07622c4d9feaab07633370
MD5 15d5b92dcbda7ef7f9ca327a903e46e4
SHA1 ca153b66028a58d90346ff8abadbdf01b95c37b1
SHA512 2352f167ee5aa37cb3438a0a7df8f632771a1d019c5cd120fe62313fb73aed6d0e09186a9bf306a564371b846a8da020f6acd7aede0cc47ca50701611fa84aca
SSDEEP 48:Tf+3u59MENZBdUdndVd/7T9IvdldHlq8/JqYpqPS:z+3KMEX0xIyNYMa
TLSH
T1E703F05D4A202611C2BE083FD7E257531B3CE35F5B2387612E904CF6DDC68B6B831998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.kimcy929.screenrecorder/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 d6620089dfb80fca99a1fd34790074aad4f6a91ddd3d928d5ca82e72d8f7719b
MD5 6cb53a04d9605d67a1769c952acd5721
SHA1 57704212ddf55ca63e2cfae9d725d38c893d502a
SHA512 bb0235d1a78f8d3a052335327f61b0e5142d236476ee2e2195d7a0504a9cf840bbb866b8e60e702db0d110f1da33c9b8bba3016e4703c66e30f97885e3e2c753
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.kimcy929.screenrecorder/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 c1a76dbf5740ff7c70f1d5ed7ffefb577403bebfcf33a08ab438c0a9914a8b66
MD5 ff834fdda7c239364bf0fea8c982a549
SHA1 4e8d4b7278bf83ee264f1d715c0d07946f1679b6
SHA512 7b1922821ff733654e5ecc7629df464a7ad1331e04b488b04d30f59f680b3b667e16b58bb900c92a823da16f79418a7fcbe1bdbb7385c0edc0ee2475c289a87b
SSDEEP 6:7+/l96qFn1Gg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK7:7+tEqLiuWdwRmBEyPb8
TLSH
T1AD02228A67800822C8591AB790D883400D00E71AC362CB47597008D83C038CCA4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.kimcy929.screenrecorder/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 7c9bb26bfa31829ba4e28ed778d6149dc303f89992fadaf050cc8eff73b9b4c2
MD5 52228af0f183eb79fb897541926b69aa
SHA1 b8e35225e05e5c6219e01ac6716b85b8ddf4b023
SHA512 e4535de51e587c9e1256b922d07cd2e4f1f18163666e25aa77586241b2f0ea9cc9445708924d8669d4fe7ef3216f0d82f85e989bd44dc2b1345a7e7eea05c7df
SSDEEP 6:7+/l9A4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKdq//4:7+tGwqLJdTRmBEyPbIqX4
TLSH
T1B70222C973400A13C1395BB790C883502E10A714D663CB47256008F83D02ECCA890E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.kimcy929.screenrecorder/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
TLSH
T11F727DCEDF002202C1360733F4C9D3901D60921D8336DA0767940460AD02108A451F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.kimcy929.screenrecorder/databases/google_app_measurement_local.db
Size 16KB
SHA256 35ea90beb6e489a0c6cdbe2d0f0f869433868961446540610510d874c3074a3b
MD5 94719f8fb0203e6d392f358b3a1c0536
SHA1 5edaf3acb30be46ceb850e2f37777982f9bc63ef
SHA512 1d9027158b4d1bfa6dc740f0b42253bebebe0a612b04109cbabb8f7623c94c47a442c0e9dfa7a210e2db43815b7805ed817219aeb3ceba4a33f2e898478ce0db
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6BXp:TLiEy9zmzrfRmBEyPbP/P+/0Fl6xNqo7
TLSH
T1117268CD7B105703D173477AB0CB93E21C30A2198333DA073B980568AC431845082F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.kimcy929.screenrecorder/databases/google_app_measurement_local.db
Size 16KB
SHA256 1834bac5cbece7b04f2d7c21a6d23747041f6dd7bef72a43f008369e384dff65
MD5 c713d81bace2b688b5b27e862584da04
SHA1 a530a7a0232b0155a8dd5c3926341049be7fbfe6
SHA512 382e62b0eaf6331ef6d798217e9ac9e6fcbd872e25159563ca107f8f148d6688eeb2b6cf42fb95959217a6eb5446abcf3d0568da4abc3ca9eef9b87250a54604
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFl2XW+/0Fl6xNqo7:TLQpmzr0GSP/h1499FLlFoqM
TLSH
T1A072E99E7A109703E2774B79A1CBD3D22C34B2165723D51739592B2C6D433855052F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.kimcy929.screenrecorder/databases/google_app_measurement_local.db
Size 16KB
SHA256 591442768facbf3408d4591a085e9fb92d8d607d9ac8411dc69b19e743ef225a
MD5 6eaf5140649d9020950d068d94dba8de
SHA1 a4e4dcb3695bb4d447d1bab93a7c9ba8114309a6
SHA512 b45849c56d82366d9170ce045f4b2c2ca8ae1d589b2259c2895d812a8359c510a11df48ba9b68986e8e5f4bd130c01fa1286efdd4cb1c49577b4a336f8f89cc0
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/JOLabCAUEWlCuUyWleoE49blqYFl2XW+/0Fl6xNqo7:TLEvpmzr0GSP/JKabCCblE499FLlFoqM
TLSH
T160722689B664C703F6774B3961CBD7D23838B2661727D6133D4A2B2C6D423818161F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.kimcy929.screenrecorder/databases/google_app_measurement_local.db
Size 16KB
SHA256 2a230a3f8b8d8da4f9ee5d305c6bd541f20b5bea23c34a9274c36f27c4bdd793
MD5 3567ba26f17b9c78211442a9e7e44c68
SHA1 427d028a43e563e23a8f039ecf3810285b35a00d
SHA512 38ba9b5b3967d73b33a7e7355ca9174f98f715a24824660cc509c827fa881ea953114353e68f0d428ddfefbae4f9c18c508dab55f7b22c6acaa0b586adcfaae1
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/uOLabCAUEWlCuUyWleoE49blqYFl2XW+/0Fl6xNqov:TL6Xpmzr0GSP/uKabCCblE499FLlFoq0
TLSH
T13E722689B664D713F6734B3DA1CBD6C2383972670727D6173D4A2B2C6D423818061F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.kimcy929.screenrecorder/databases/google_app_measurement_local.db
Size 16KB
SHA256 03e3345c519bce77d3c2ed399d13314b9c76e53b174d5394bf276b6702c6590d
MD5 88059cf495a2a06ff0bd6292dfb8d487
SHA1 275771c69a9007dd962893b3b7630d7c1711d7d5
SHA512 83b6feb4fbf02c81b7a5a0790b0d775b8b356613f2cc8031f7597789ab6083743d0949513786756097146535a132bc29b466f4f7f9570293a1d4f19952a63e12
SSDEEP 6:l9bNFlmls1QlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WDzWe:TLUEQ9zmzrfRmBEyPbP/WDzW
TLSH
T16B722BCEDF102707C5770B77B4CE93916D54A22D83379E472BA50474BE434499091F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download