49c16785567f8144edceafe7ce90bf9dcce7d078db7c23521fefb49b38f98404

Resubmissions

15/08/2026, 23:17

260815-29t8aahp5z7

15/08/2026, 20:24

260815-y6wp6atake7

Analysis

max time kernel
74s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
15/08/2026, 20:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OgaVerify.apk
Size 5.9MB
Sample260815-y6wp6atake
SHA256 49c16785567f8144edceafe7ce90bf9dcce7d078db7c23521fefb49b38f98404
MD5 6a9da01753ea778216888ee8b4c52799
SHA1 ace6c0a48c6c1438d642002b667e3c52d931e751
SHA512 fca18c1dedfc18e38fe467c0ef83a8c08e47582f104481a6de4c2cd8683684eeaecab21147feb3abf56f21b449ca156023728a45937a56c6b1057f0f0ee06f62
SSDEEP 98304:PevpG4kNi4zj0GHMqQ+ulQqEpAFOWWAjiwu5kCb9yuRo8zIrbVg9FMiu41Tt0rya:Pe2i4zj5HMqQcGaAjpUkCbb0g9FMiOMq
TLSH
T1AF56F18EF7199A2FC47710B68C76523312574C16E6435BA36968331C38BB6E88F49BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4922	co.median.android.mbbnleb
/system_ext/framework/androidx.window.sidecar.jar	4922	co.median.android.mbbnleb

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	co.median.android.mbbnleb

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	co.median.android.mbbnleb

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	co.median.android.mbbnleb

co.median.android.mbbnleb
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4922

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

INSTALLATION

Path /data/data/co.median.android.mbbnleb/files/INSTALLATION
Size 36B
SHA256 fe2def602e9f433cd2a6b96accb106bf07928e45506051ec28ae4aa7d4aef583
MD5 05b2b92790e31975ab0fc40d6234f5a9
SHA1 e3ca8d33807fd986a5d5cc1013d611f3893c59ad
SHA512 e4ca743f7d4ab495356b6699393d5772b1b7d33505ec0f7f346ea803a90096bc1b11a93eb0be69d583503f4f867758eebeb233834e0be83df0e4335c0cadacf4
MD5 SHA1 SHA512

Submit Download

regexintext.json

Path /data/data/co.median.android.mbbnleb/files/gonative-config/regexintext.json
Size 1KB
SHA256 57682b02b3c053ae381e3ab9c90789cee43d7dd15a0cbd7c115490a6db81c218
MD5 46e1a9d22d59ed0b1adecf9aaa54ce7f
SHA1 af81368b16ef11ed0fad1d4c6655f570fb710afd
SHA512 b63f7c8dd55a47a096b0e50961f95294c008f814a90f0c9dd20668208df0f9a785e8670e049c0290d310ba702e5576fbff5803a18ce44a1d1d63bea574eb0272
TLSH
T13B41B074C9694EB391C92860B2AE425B7A32514B6FD67C1EFBCC162C1F4D5BE68B020C
MD5 SHA1 SHA512 TLSH

Submit Download

splashpage.json

Path /data/data/co.median.android.mbbnleb/files/gonative-config/splashpage.json
Size 3KB
SHA256 2b6e488843b60860d8baff1aadb6af2d0bc54c123e438508683be68e2b16f392
MD5 60dd0c60f16f962af5399d81c25f27fd
SHA1 b0a3e8a803091ab5ec6ba3202aee7ed783b75325
SHA512 b6b46cf921e6981cf08fe9503985121a7efa1c06a99234f6512cd370bd4788daa2c3787df23b31c367cfcfd11e04f931293d33b1275bf390247bfba40c5aab89
TLSH
T13081993C4841A2D329867768792CF39E5173F2F6FCD18784482621C4F1D92D6E4A6F2A
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/co.median.android.mbbnleb/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 e91c2af45873795665f711cd3e66ac2d2532b0663d03aeacc9fed51549a1ccd7
MD5 6a684bf745fc15c980a4b3dfaa544708
SHA1 d3fb28877c7a099807bcc7ebd1596fae25638165
SHA512 a614c088f6a5b959143294d5326c92f775c180c0aa9bc3efa9904b03d8142c176d358693dc5cf276406f6209411c33ff531fcca223ccf8d6007fb16245963afd
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/co.median.android.mbbnleb/primary.prof
Size 1KB
SHA256 34031638c9417f0b1d7f7b23a905bbec630f2f95f96aa256be4a480175f60da9
MD5 8c25a8d7bb9663597120fcec3950f51f
SHA1 e1c27c9c2dc61fde184802fa6669c74544232f76
SHA512 99e411331733ab4efde34e1d9e194022b0aebc61439ed4ef706c7bc1cf3a3db6048490bf19868052bada08ac796cceb0d8f740eb9654816c14213cb84dfd5ca5
TLSH
T15D41F75AC495D0CA8B287A6BAC49543BFF5ABC3A1EBC404D222DE35AA8C6D640D0CB01
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads