8910f907e11539a2320c40186ed16f8e45c208fda60f987b1329f37e365fc01d

Resubmissions

13/08/2026, 18:31

260813-w52tnsvybz8

13/08/2026, 15:01

260813-sebb9abl418

Analysis

max time kernel
24s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
13/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRABADOR .apk
Size 4.7MB
Sample260813-sebb9abl41
SHA256 8910f907e11539a2320c40186ed16f8e45c208fda60f987b1329f37e365fc01d
MD5 86f8c116489a523d7eba9acf6da7f090
SHA1 3eb98e42f3ff318bcecafa91a4c00337cdf25710
SHA512 d5663df1d7bbeab2c7c8a959af6df40b2c863f8a181bee745300c5acba7dbd26a49ff05f60444a8592eb579b4d25c236306e2794c6b47e11b680924530d0620a
SSDEEP 98304:B4LlWO1xg+M6pP5kDsgxjHaMNQhbalFc2WECfrWEMtmZ:B4ngL6pP5oxjH2RalK2SMy
TLSH
T1A436CE86F768DF2AC87380374DEA6632155A4CA79E82D7923905734C38B79F44B49BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.kimcy929.screenrecorder
/system/app/Superuser.apk	com.kimcy929.screenrecorder

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.kimcy929.screenrecorder/cache/1582435991586.jar	4808	com.kimcy929.screenrecorder

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.kimcy929.screenrecorder

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.kimcy929.screenrecorder

Checks the presence of a debugger
defense_evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.kimcy929.screenrecorder

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.kimcy929.screenrecorder

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.kimcy929.screenrecorder

com.kimcy929.screenrecorder
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4808

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1582435991586.jar

Path /data/data/com.kimcy929.screenrecorder/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
TLSH
T1C412AEB4BF77093CD0DB0DB8CA67E800A05F25841AA7D514E0656066BFD47B5F1E315A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.kimcy929.screenrecorder/databases/com.google.android.datatransport.events
Size 40KB
SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
MD5 1cf3f63c021d755a21623e6d0e86dbc6
SHA1 e40e0f1faa61abcca7ba3394c54c92ff7334b49b
SHA512 38d72e14f3513ffd26989cbda3df46ed3dd6e731bdfae56440eff6b64760cc13f91014281c9add61e018fe3529e49c63a6892ca22479515816c768b546244466
SSDEEP 48:TfkL3u59MENZBdUdndVd/7T9IvdldHlq8/JqYpqPS:zkL3KMEX0xIyNYMa
TLSH
T1AF03EF5D4A202611C2BE083FD7E257931B3CE35F6B2387612E904CF6DDC68B6B821998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.kimcy929.screenrecorder/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 4eb84af5c98b24062d1e606549f9128f313d7c53a78f64a8b30366da896a9cdb
MD5 bcdaf2ac56b54fe09141adc01298eb64
SHA1 355870ea5675b2707579698483c6a77e6c53cf9f
SHA512 2afb7eb076e42843db59f20abe7ae1c2b8ca804f1b1cbc2eaeee8ee0bced54eb6c7ea90d2e3301422abe409a2ada1f544ab5d7fa6896cdd769de3f41d8199525
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.kimcy929.screenrecorder/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 3fd556c6594e6c675ef910a05dde78b7576d003d389dd5c8e6ec6139e948deb6
MD5 e3c8dd592d0c038a552362df2ad809e3
SHA1 6a3c9188b2aa86cc0341e609a703614260bc02b0
SHA512 6a432e3682256e2b2b057d9cd9610bcfe7237875bbf4ff5a1ffc07c8913a0338de19def98fdd94a70f1b2e1b2645fc9343573e3ffd3aa0b429b09887770a5ff7
SSDEEP 6:7+/l9Lbn1kRg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKms:7+tp+qLiuWdYRmBEyPbq
TLSH
T1E80222C8B3800C13C8292A7790D883404D04A76882B6CB17169008B42CC76CCB4A0D18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.kimcy929.screenrecorder/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 39e33b7c2c19451c7afbfda3d137198cca2dbbb3bbdd3bcefb4410a5bcadc14b
MD5 80bfa4469cede3ac5113d269e5f8de16
SHA1 610d001dc3e10dbee0f77fc44be895ae78662340
SHA512 2baf7006940a4dd95c7aff111867d5e3b3d61bd694f0cb914a234f766f51e53e755ed63f7b65997377a50664eea99507f17e600341214ad35256ba17669c8b30
SSDEEP 6:7+/l9eGi4Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKQ//WB:7+tATwqLJdeWRmBEyPbDg
TLSH
T1D902129977410913C52E6B77A0DA83541E24E739A363CB6716D118546C477CCEC90D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.kimcy929.screenrecorder/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
TLSH
T16D72C2CEDF102606C6760737F8CAE3A05DA4A22D833ADA476B950460AE42549A8A1F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.kimcy929.screenrecorder/databases/google_app_measurement_local.db
Size 16KB
SHA256 43d0e6b98a7929dd7d9ef55f3e919fe1692a93fe6c03bd06aedb6460bba6de10
MD5 9c4a38f4e3c19a344087d50edb78d4b2
SHA1 8fdad66995a883f20e677b23aa6a6bff99e81f1c
SHA512 ec1c43507cb4b3117f95f8811d89bb6c014a08f22281ae02f7ad07dbd750d7f43080e994381b736d1ab47f2ba065428331e84fe6cee0ee8af6b6d4112a0d4578
SSDEEP 12:TLiEq9zmzrfRmBEyPbP/P+/0Fl6k876YNqo7:TL4pmzr0GSP/PlFj89qM
TLSH
T128726FCCBB106703D273473AB0CB93E21C34A2299333DA0B3B8A0528AC42188A082F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.kimcy929.screenrecorder/databases/google_app_measurement_local.db
Size 16KB
SHA256 73acd5c8d1f29db247e5febe4c2c97c4a737848729d3e6e478672fc97314e599
MD5 5bfda121d03398a0e148e53fdb1fde28
SHA1 6de249567160417dd2957158ab6781cd6c6d092e
SHA512 d77710166487e91adbaf5d5c07c2782100ef6769b4b18a32bea73c00a23b28b113e067948bcd8a4c4481a7995dd26c45e8089a772dee821e56f4524e2feb5dc8
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFl2+68+/0Fl6k876YNqo7:TLopmzr0GSP/h1499FPlFj89qM
TLSH
T16672E99DBA109707E2774B3971CBD3D22C3872265733D5173E462B2C5D423855052F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.kimcy929.screenrecorder/databases/google_app_measurement_local.db
Size 16KB
SHA256 e953c38fe44bd70a1a2acd6c785813adef97e7f06d867e6d2147c78837fe8ce6
MD5 d7c2c7449f174c49937ebe8458217db7
SHA1 60a890267ffd46f47df78c8df065d42aa550d810
SHA512 72ff838e9b2e39c0bfaaa87ced7377d42a0563a83623d83e944e290429e12bfd9e380824266f9020f65e035f22252ec48f591087adb4fe238bfff14a90e56894
SSDEEP 24:TLYpmzr0GSP/JKabCCb/c499FPlFj89qM:TcArSP/kabCCbd5/j8Z
TLSH
T19C722698B564D707F2774B3961CBD7D22838B2661723D6073D4A2B1C6D423918161F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.kimcy929.screenrecorder/databases/google_app_measurement_local.db
Size 16KB
SHA256 503ec7e0a88c33c3a81e189518998079e2339734d839d4c511b4a4e14f0d63f7
MD5 a4e7257a978e6ebfb6dfa31b3f24cd49
SHA1 186c1c7db625047ef11991b43132277289d2976b
SHA512 8a9298ef5a9fb22bf9ed1dc68fb1a8f92c321915479512ce76396d2f6add4002cf9d9a1294f345cade74cce77c763fb3269ede5b4a9207c4c95df68bf8258e9f
SSDEEP 24:TL6vpmzr0GSP/uKabCCb/c499FPlFj89q0:T2vArSP/7abCCbd5/j8R
TLSH
T1EB722698B664DB03F2734B3D61C7D6D2393972670727D617394A2B1C6D423918061F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.kimcy929.screenrecorder/databases/google_app_measurement_local.db
Size 16KB
SHA256 5abf901afe4acee0de05bb82f63a879bcfdff67bc220002e07e91acf6d00ddbb
MD5 6286bbd6deb70624839261d1179db230
SHA1 bb1a99e2d3ab8b13021afc02321ed3991e38643a
SHA512 ee7615bf1279b716c8fa1805f4b569ae8fe807e846f21eaf639d0e79159e300038e4d240ecf3a24ebaf84a302c42d27e1a2fb69bc645f9961c56cbfea2c43b14
SSDEEP 6:l9bNFlmls10l/nlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WDzWe:TLUE0lv9zmzrfRmBEyPbP/WDzW
TLSH
T163722BCDDF102707C5770B77B4CE93915D54A22D83379E472BD50470BE434899091F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download