Analysis
- max time kernel
75s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
15/08/2026, 20:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
OgaVerify.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
OgaVerify.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
OgaVerify.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target OgaVerify.apk
- Size 5.9MB
- Sample260815-y6wp6atake
- SHA256 49c16785567f8144edceafe7ce90bf9dcce7d078db7c23521fefb49b38f98404
- MD5 6a9da01753ea778216888ee8b4c52799
- SHA1 ace6c0a48c6c1438d642002b667e3c52d931e751
- SHA512 fca18c1dedfc18e38fe467c0ef83a8c08e47582f104481a6de4c2cd8683684eeaecab21147feb3abf56f21b449ca156023728a45937a56c6b1057f0f0ee06f62
- SSDEEP 98304:PevpG4kNi4zj0GHMqQ+ulQqEpAFOWWAjiwu5kCb9yuRo8zIrbVg9FMiu41Tt0rya:Pe2i4zj5HMqQcGaAjpUkCbb0g9FMiOMq
- TLSH T1AF56F18EF7199A2FC47710B68C76523312574C16E6435BA36968331C38BB6E88F49BDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener co.median.android.mbbnleb - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone co.median.android.mbbnleb - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver co.median.android.mbbnleb - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo co.median.android.mbbnleb - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo co.median.android.mbbnleb
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/co.median.android.mbbnleb/files/INSTALLATION
- Size 36B
- SHA256 17eac1915b5855a78f9017612a9085c932a4e3f72fea382ff122d2651bdbe31d
- MD5 7ed77dd02bc4882312143b2dbf79c0f4
- SHA1 69651066b0a03f5e0b4fabcfe8e9c2e1627fccbb
- SHA512 14535969413d3182337e3e50e2bab344e263fa582474b452cc0676055552281f8e5d82dc6262e8e79e4b2dda0618a978d366e28721d228c459e037cbc867b3d3
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.mbbnleb/files/gonative-config/regexintext.json
- Size 1KB
- SHA256 57682b02b3c053ae381e3ab9c90789cee43d7dd15a0cbd7c115490a6db81c218
- MD5 46e1a9d22d59ed0b1adecf9aaa54ce7f
- SHA1 af81368b16ef11ed0fad1d4c6655f570fb710afd
- SHA512 b63f7c8dd55a47a096b0e50961f95294c008f814a90f0c9dd20668208df0f9a785e8670e049c0290d310ba702e5576fbff5803a18ce44a1d1d63bea574eb0272
- TLSH T13B41B074C9694EB391C92860B2AE425B7A32514B6FD67C1EFBCC162C1F4D5BE68B020C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.mbbnleb/files/gonative-config/splashpage.json
- Size 3KB
- SHA256 2b6e488843b60860d8baff1aadb6af2d0bc54c123e438508683be68e2b16f392
- MD5 60dd0c60f16f962af5399d81c25f27fd
- SHA1 b0a3e8a803091ab5ec6ba3202aee7ed783b75325
- SHA512 b6b46cf921e6981cf08fe9503985121a7efa1c06a99234f6512cd370bd4788daa2c3787df23b31c367cfcfd11e04f931293d33b1275bf390247bfba40c5aab89
- TLSH T13081993C4841A2D329867768792CF39E5173F2F6FCD18784482621C4F1D92D6E4A6F2A
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.mbbnleb/files/profileInstalled
- Size 24B
- SHA256 3e4bd151d801c77769902fe076e3d7242d73f3e4115de1037f50e236e8f0f289
- MD5 d0c2c305a6f73989ce772caa460c7180
- SHA1 a556f6a06ca9edbe6462d7f9d404ba544c02f311
- SHA512 f5cfee5b46774f785a8c12d98ff67ea20b9429681cb390fe7babacbe259c84f18443780f6d3c89d0b23cbdb30feb3388f7164814de7b08c13ea8eb44ed5ebc4e
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.mbbnleb/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 802b9e31d3dd994d05c5715fe92c2e71c7b95fe15f328a3f9b68f509d43ccedc
- MD5 b730ff62ecd8b8c87140f470905929d4
- SHA1 043fa4fd7aab5d425cd69d87ca5b40a2fd816d8d
- SHA512 865996f1ad918a207746d9d2ac329bb924b09ff432d18be1482a4d748271f9667bb7107181211d8f534a8ba8c93c23d44d8650db395214f1d1c75e4c43b9ac8d
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/co.median.android.mbbnleb/primary.prof
- Size 1KB
- SHA256 34031638c9417f0b1d7f7b23a905bbec630f2f95f96aa256be4a480175f60da9
- MD5 8c25a8d7bb9663597120fcec3950f51f
- SHA1 e1c27c9c2dc61fde184802fa6669c74544232f76
- SHA512 99e411331733ab4efde34e1d9e194022b0aebc61439ed4ef706c7bc1cf3a3db6048490bf19868052bada08ac796cceb0d8f740eb9654816c14213cb84dfd5ca5
- TLSH T15D41F75AC495D0CA8B287A6BAC49543BFF5ABC3A1EBC404D222DE35AA8C6D640D0CB01
- MD5 SHA1 SHA512 TLSH