Analysis
- max time kernel
74s - max time network
153s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
16/08/2026, 00:11
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
OgaVerify.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
OgaVerify.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
OgaVerify.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target OgaVerify.apk
- Size 5.9MB
- Sample260816-agzhrawdle
- SHA256 49c16785567f8144edceafe7ce90bf9dcce7d078db7c23521fefb49b38f98404
- MD5 6a9da01753ea778216888ee8b4c52799
- SHA1 ace6c0a48c6c1438d642002b667e3c52d931e751
- SHA512 fca18c1dedfc18e38fe467c0ef83a8c08e47582f104481a6de4c2cd8683684eeaecab21147feb3abf56f21b449ca156023728a45937a56c6b1057f0f0ee06f62
- SSDEEP 98304:PevpG4kNi4zj0GHMqQ+ulQqEpAFOWWAjiwu5kCb9yuRo8zIrbVg9FMiu41Tt0rya:Pe2i4zj5HMqQcGaAjpUkCbb0g9FMiOMq
- TLSH T1AF56F18EF7199A2FC47710B68C76523312574C16E6435BA36968331C38BB6E88F49BDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener co.median.android.mbbnleb - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone co.median.android.mbbnleb - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver co.median.android.mbbnleb - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo co.median.android.mbbnleb - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo co.median.android.mbbnleb
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/co.median.android.mbbnleb/files/INSTALLATION
- Size 36B
- SHA256 6f40e5d9ac4a1d1245d1d67c44ca25696f1bd3092a97ed60203cdb45a7717948
- MD5 c97e6e7616ff4a092af70ae357a437cc
- SHA1 904135895bb6828c3bc942c895ca3c49128dd965
- SHA512 b35d421afd88b769686b96dec5119c68ff4a56cd60f4d7d9559a7c20c6d275c15f88762accf4d8c549ea40c48286c6424ccf1ee0c7d7d5938956b071dc6fbb45
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.mbbnleb/files/gonative-config/regexintext.json
- Size 1KB
- SHA256 57682b02b3c053ae381e3ab9c90789cee43d7dd15a0cbd7c115490a6db81c218
- MD5 46e1a9d22d59ed0b1adecf9aaa54ce7f
- SHA1 af81368b16ef11ed0fad1d4c6655f570fb710afd
- SHA512 b63f7c8dd55a47a096b0e50961f95294c008f814a90f0c9dd20668208df0f9a785e8670e049c0290d310ba702e5576fbff5803a18ce44a1d1d63bea574eb0272
- TLSH T13B41B074C9694EB391C92860B2AE425B7A32514B6FD67C1EFBCC162C1F4D5BE68B020C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.mbbnleb/files/gonative-config/splashpage.json
- Size 3KB
- SHA256 4dc469841e5bace04a2283f47f7d50f3c35205704188a60d4f54b0755ecfb529
- MD5 0f71c868dd9863204a8380c66d40efc4
- SHA1 2e962b491f1932493644ffc5de34e7946f43b130
- SHA512 6b55ae82a7d6ed1897126c31e202c3fe924de41c453762c6b399dbce3e9608f9bf968cb268530c1df76fda0c0990d8338213769a2cf154a9a5c58700cac0d25f
- TLSH T1FD81EAFD401071935649672E77ADB3A92237F667FCC093970C1520E4F9C02BAC266C2E
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.mbbnleb/files/profileInstalled
- Size 24B
- SHA256 db725be0542af2593676550268fbed8b7c5d965fedde082f7403b38b21ff4186
- MD5 369d6faf39f796e710ca6dd9eb6ab050
- SHA1 5005edd5ff407c88ef36dd0ac56a283529c9e9d5
- SHA512 df1ffe77038ff48f386ebb9f5e0b3fcfb1a674df8a05fdef139b48f1f08a6e08889ad196c4851a6199512e6a06d2ed06ab44dca7b09fb59f4a26a4e64963f4f7
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.mbbnleb/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 ce73183031270666df2840915948a2923889c969b5e76ee07e5769800d8bc794
- MD5 00ceee1571dbdcc700df6811ac15a498
- SHA1 360d56e40c88d2c75c5a08c1b4399fa203d924df
- SHA512 749ea6129b71dd7470168637d5aa22ab448ddc490eab1c5a6b3ba9b0575621ce2fb946413291e8675363b1eba270c48aa0ebd35ff7222fed89e377b7977f79ce
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/co.median.android.mbbnleb/primary.prof
- Size 1KB
- SHA256 34031638c9417f0b1d7f7b23a905bbec630f2f95f96aa256be4a480175f60da9
- MD5 8c25a8d7bb9663597120fcec3950f51f
- SHA1 e1c27c9c2dc61fde184802fa6669c74544232f76
- SHA512 99e411331733ab4efde34e1d9e194022b0aebc61439ed4ef706c7bc1cf3a3db6048490bf19868052bada08ac796cceb0d8f740eb9654816c14213cb84dfd5ca5
- TLSH T15D41F75AC495D0CA8B287A6BAC49543BFF5ABC3A1EBC404D222DE35AA8C6D640D0CB01
- MD5 SHA1 SHA512 TLSH