Analysis
- user interaction
yes - max time kernel
35s - max time network
36s - platform
android-14_x64 - resource
android-34-x64-arm64-20260325.1-en - resource tags
arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system - submitted
14/08/2026, 10:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
base.apk
Resource
android-34-x64-arm64-20260325.1-en
8 signatures
150 seconds
General
- Target base.apk
- Size 2.2MB
- Sample260814-ml5xjs1epd
- SHA256 5a0f05e297bf2f60935bfd589df3991e8086b85f7a698641a6ff7df79b283108
- MD5 55a527d469463c341ffebf7c5dae5e9e
- SHA1 d551c1403329810be4002959bd8ddc18d5eed52a
- SHA512 a10ea5d545b64f4acd0508523ce1fa1a998432bcb84f507e4bfed4c40d42b1bf7655e8aa3e9d6258ede6cfe1a4e6d567cdafe09ff513a3a6cd9e1da27278a77b
- SSDEEP 49152:1ygXeODhm2PllIV7UTuFBFyTnwnTob79XDFY9qiu9:PXeyPlqmTdTnXmqiu9
- TLSH T17CA5D081F74CF52BCCB3D0334AA28726154A8D468B42E74765A8B37C29BBBD44E95FC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 1 IoCs
ioc Process /system/app/Superuser.apk com.resetphone - Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
description ioc Process Accessed system property key: ro.product.model com.resetphone - Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.resetphone/cache/1675452915457.jar 4525 com.resetphone - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.resetphone - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.resetphone - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.resetphone - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.resetphone - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.resetphone
Processes
-
com.resetphone1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4525
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.resetphone/cache/1675452915457.jar
- Size 11KB
- SHA256 f174040e033d1045ef13695b4337c8e1ad65331f2f103248025e2d080fccd037
- MD5 600bb938c8786491180f21044aa0dd64
- SHA1 fce0ae8f59adda36aa0452b65b8c40d892e2cf12
- SHA512 1c12e6ab3f72f39addb1a2ce77a09cc5f90747567b7306f563d6afcfb49c46dbc18afabf61d9af2e7d6588e4dd70cff9e6cc7ad87021c57c605343e0ddcf67ba
- SSDEEP 192:5WPKIGKHTMd9nBEmJx029lAtnjZau5zHnpdxcTR1lQTir:5WPHLHTM7nL2YlAtnFaMHdcTR1x
- TLSH T1E832AF8D6DEED43FCEEBD872C59E8413975DC2FC6629B60B500AD2DC18718941B80E9D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.resetphone/cache/1675452915457.jar
- Size 22KB
- SHA256 0869ba6efa2a0c4abb878b75bd8063d6b1752e31618bdbfb00cddec68107a31c
- MD5 216bb03e148e333071ec13a5d000cba9
- SHA1 c50144c39f6ad80d7b0cb5a30701272851e66851
- SHA512 df7882aa119eb88af3d859292a4a61e3852cc45d58c47466ec1adb8813622bed872fa977342e62718aa2a4c5f9a202f2a198ed1ac2aaeade0aabeac396bc4d56
- SSDEEP 384:QKhDiRhyHqEXqQ7S/afBc18U0VlvuvMNbArEor0QSZ64DB88:QjCHqEXqUy0Bc1jvOgARDBn
- TLSH T130A2D763B391C5B3E6BC9A7F647E5380B761F220891393076809D7DEBCEE3A05A518C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.resetphone/cache/oat/x86_64/1675452915457.vdex
- Size 960B
- SHA256 e5f88774ac9a97c007b9ca4f14d57ae1aa45f372d6dd6adc1d0ec0aaa3442c01
- MD5 a1a226086efb63e44a230d8b93ea30c0
- SHA1 ef6ebe13e011a900eb17e198d23f7976ea0ea742
- SHA512 8badab2b8c76a51c83febc5cf2900c668cb95c29736349ee80c6dc62d8e41d53adae95413777c45f84ae1fa0e41fe49c427231ac67e1421a1ed0b6be092fef49
- TLSH T1C011FECDBE4BA935C4A895772583CC00807FE2334948A84F35E0CC3E703BBA01C0884D
- MD5 SHA1 SHA512 TLSH
- Path /data/user/0/com.resetphone/cache/oat_primary/x86_64/base.4525.tmp
- Size 164KB
- SHA256 6c5722579a8491c8d3aa02479dcb332565770e78a4363a81d76b1b2183568134
- MD5 2a9d660835da649139cf316effd6621b
- SHA1 c0a7ce37e78e364ff5565ae3ead10f002384ccf2
- SHA512 af037ac89cfdfc5ff692b7bc183ac99e861fe4528806f560019c79fa931a5d78a5b1ce7ce416ff5de83d063b1c2d044457b07999f5fb77b7ff2d87099ad2e0fd
- SSDEEP 3072:fOmsVXkITUiVi9ibd7xXFCa8Lxt7Vs8jvYxR7FMkgsosO2akcVp:fpmUiVkiJx1Ca8LGk2R3Up
- TLSH T14DF35B1FE2522090C2937DF547894AE8EB6A9864D58E3D5494B1F33FA853F10EF72B80
- MD5 SHA1 SHA512 SSDEEP TLSH