Analysis

  • max time kernel
    35s
  • max time network
    153s
  • platform
    android-10_x64
  • resource
    android-x64-20260325-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
  • submitted
    17/08/2026, 01:17

General

  • Target
    62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce.apk
  • Size 8.2MB
  • Sample260817-bngf7a1blh
  • SHA256 62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Detected google phishing page

    Potential google account phishing

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.fully.lantranslate.camtransltor
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5101

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1624498498047.jar

        • Path /data/data/com.fully.lantranslate.camtransltor/cache/1624498498047.jar
        • Size 9KB
        • SHA256 51dd5ff34a950c026bd39ba3b923c4c47126c097e844951ab1b71ea7c0ed824f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        journal.tmp

        • Path /data/data/com.fully.lantranslate.camtransltor/cache/image_manager_disk_cache/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/androidx.work.workdb-journal
        • Size 512B
        • SHA256 ab55330612005e92a55dc9681fa6fd23c5039648a1e230c829f1747715f1652b
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 597baa92c898b1bff07e1cfae453fc3bdd373a62c38c3e00eb4d8e80eef7ac7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/androidx.work.workdb-wal
        • Size 88KB
        • SHA256 6b5403068ec0f636a66a351237a6aec2df0703c766f7fe87b614b4ee7381b1c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/com.google.android.datatransport.events
        • Size 40KB
        • SHA256 e802fdc1ccd833b91d80bb1d8f54cab2b585393e6a07622c4d9feaab07633370
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 e4dbab890722241476b5723cd4e5a167fbb3be1fcea68d41a4fd708b508f2a35
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 39b61565722f80a88b3e0a0622f2586a2f4fcda288a7ce4b6cd787d90a04ff01
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 64c0e456ddf8f8fb0aa66c05aaa6ffd00cc6b9f5d8e33a3c4ad68ddf1c700e74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db
        • Size 124KB
        • SHA256 956d95307bc10c2ab0317e09f6f70d91f18e1f880a2b8b77e1573f6aa654ca89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db-journal
        • Size 512B
        • SHA256 068ee9b2ae595804ff30fcdeb8d868557548ee4d4e667e5ace76e647bb9d358a
        • MD5 SHA1 SHA512

        google_app_measurement.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db-journal
        • Size 8KB
        • SHA256 9dfcc66e7d8a821acc11d7e66340b5bf376b128c212e7522476e53d62fee3add
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db-journal
        • Size 4KB
        • SHA256 6a55440cc7a36dcb69891e48728adb7560517d2da577dc116d4594eb57818704
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db-journal
        • Size 8KB
        • SHA256 dc863f1aea2b722d129e47e10f258a7f09476bc0cc570adeb27320952eaf68fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db-journal
        • Size 4KB
        • SHA256 7ab51f86d99e0703247535c1e0cf5147e51f62630cffc47c45d6cae589fc86cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db-journal
        • Size 56KB
        • SHA256 acf39fa2271f332e4925e36ce97ef518ee14c7620ceffde738e02ada88f47a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 23fd6f4f8e5aa5812c9dcefd540c6114d112ef2a41505a9f387eebe16b2ced15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 950147168aac27783d4c85e01aa947acb00052adadb7a52ed2e30ed904aa8595
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 6576d264b4ba26b32c1a7e322d68748e794bd5915a41093b2ce41aafd383134d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 aead01a2603a7d6814c2cfa8b4abd9309f899adaff25f505af7503b68c41c631
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 d307254c5e9e321f43d002b567f7d88abf8c22bd269179f58f92d1818b238f51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 f31fa9d2a76778ac31ad9300d9d2f2c14690bd81dd2b09d710f67db5b8e05a07
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 ad1198799e57480b877de371e20ced8b95f850c892a60cffa52f1e889e5ca3aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 d35bd1ab49b87466f324d6f1eb6fbf6f11eab9b68f34d1524f57c4ae6067601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 46caaed0ea0575208348a39aca3c83922026138a8915d0f66d33d5e89ca40112
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 f650e32f5d08754ebd43eb91be68fdf1689a9a4b48ca997b6e01e057b964861d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 d77053df80abe6fef7e72b0d2a9fc540c26a897ea29699e403cce81a3c63d9b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.crashlytics.settings.json

        • Path /data/data/com.fully.lantranslate.camtransltor/files/.com.google.firebase.crashlytics/com.crashlytics.settings.json
        • Size 779B
        • SHA256 7fa9d36dd0ecc66c8bfb6d7c7b418f88d5414abe74ee8cba6245390aedefed01
        • MD5 SHA1 SHA512 TLSH

        crashlytics-userlog-6A82612201C4000113EDCA9B553FE3B7.temp

        • Path /data/data/com.fully.lantranslate.camtransltor/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-6A82612201C4000113EDCA9B553FE3B7.temp
        • Size 457B
        • SHA256 7cdb1936efbcf7e0f7bf1d28f7c024b95bf7f68a653e5921c23e8bc09c146b59
        • MD5 SHA1 SHA512 TLSH

        crashlytics-userlog-6A82612201C4000113EDCA9B553FE3B7.temp.tmp

        • Path /data/data/com.fully.lantranslate.camtransltor/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-6A82612201C4000113EDCA9B553FE3B7.temp.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        report

        • Path /data/data/com.fully.lantranslate.camtransltor/files/.com.google.firebase.crashlytics/report-persistence/sessions/6A82612201C4000113EDCA9B553FE3B7/report
        • Size 755B
        • SHA256 9f8242ae4142286b41c6d87305e4b0d1ebf24cb99b27d30a33aac3f3aee66898
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation1790393661465612375tmp

        • Path /data/data/com.fully.lantranslate.camtransltor/files/PersistedInstallation1790393661465612375tmp
        • Size 90B
        • SHA256 0219e5280868636bf3289300b05db057ee1486b446ec915cfc73e28ddba13f13
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation5454117417085273359tmp

        • Path /data/data/com.fully.lantranslate.camtransltor/files/PersistedInstallation5454117417085273359tmp
        • Size 569B
        • SHA256 3a7bf3cd897aa2a801eb9f32601cba5cea2ccf085bf62a8d6313d5026448c0e3
        • MD5 SHA1 SHA512 TLSH

        audience_network.dex

        • Path /data/data/com.fully.lantranslate.camtransltor/files/audience_network.dex
        • Size 3.2MB
        • SHA256 08db2ca6e3f51676dc1c9b114d522ac5ed211ae2e359bf6270066aca651e6932
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db

        • Path /data/data/com.fully.lantranslate.camtransltor/files/google_app_measurement.db
        • Size 4B
        • SHA256 b40711a88c7039756fb8a73827eabe2c0fe5a0346ca7e0a104adc0fc764f528d
        • MD5 SHA1 SHA512

        1624498498047.jar

        • Path /data/user/0/com.fully.lantranslate.camtransltor/cache/1624498498047.jar
        • Size 19KB
        • SHA256 b8d90074a4efd78bcdecc27a24d4249d53b0b76134590750733d1136d9ad964e
        • MD5 SHA1 SHA512 SSDEEP TLSH