Analysis

  • max time kernel
    46s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    17/08/2026, 01:17

General

  • Target
    62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce.apk
  • Size 8.2MB
  • Sample260817-bngf7a1blh
  • SHA256 62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Detected google phishing page

    Potential google account phishing

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.fully.lantranslate.camtransltor
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4879

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1624498498047.jar

        • Path /data/data/com.fully.lantranslate.camtransltor/cache/1624498498047.jar
        • Size 9KB
        • SHA256 51dd5ff34a950c026bd39ba3b923c4c47126c097e844951ab1b71ea7c0ed824f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        journal.tmp

        • Path /data/data/com.fully.lantranslate.camtransltor/cache/image_manager_disk_cache/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512

        1624498498047.jar.cur.prof

        • Path /data/data/com.fully.lantranslate.camtransltor/cache/oat/1624498498047.jar.cur.prof
        • Size 138B
        • SHA256 4925176efc69c7980a0222c0d9a19a5cf78f061a99e98ab58e5a34300e5bc94f
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/androidx.work.workdb-journal
        • Size 512B
        • SHA256 461419dd2869855da71099e15b975a667ab3b12b7c0fd86496aea5e1c336978f
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/androidx.work.workdb-wal
        • Size 88KB
        • SHA256 6d555320811d120ec1737866b05f69bdf39694fe0bb37cd9a71c3143bbdd50c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 ad78dfc8d969034c97700a7a896ba402e87dcb0601b64cf6abb6edeeb25ce5ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/com.google.android.datatransport.events
        • Size 40KB
        • SHA256 100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 bd7e5debb01c9fbb786593b053d648eb1ceb189f3da589db639193160f465202
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 30b3bff75c9686f2710c37ce6022e0d99fbf378add29387ba245d424dc97dc6a
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 7732692ed85818c5915a27ffe65f21f074e330cc17987839f17975c3046f88d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db
        • Size 124KB
        • SHA256 bf0512349cab0f56b3a235c9f5b45bb964c6300d419d52a62da822a1fef8d135
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db-journal
        • Size 512B
        • SHA256 1cf3ea74911732790d95627abf5003658840eb9e24ab1fe6da88fade9220f41e
        • MD5 SHA1 SHA512

        google_app_measurement.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db-journal
        • Size 8KB
        • SHA256 61735eed912a464f7373b5128ce8f13bc78e8f0fa915841c57b6fcbe1b8ef9cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db-journal
        • Size 4KB
        • SHA256 0634c85b292e996c1c0bfaab505ccc67ab36a9cb21b29c0a6981dd0ce0210a9e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db-journal
        • Size 8KB
        • SHA256 0b975772e5ac1a1cdfc4dca7c848bf12218b975af2841a7d15ff5150cc9b0457
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db-journal
        • Size 4KB
        • SHA256 6798df327754f04f38b73c275d8534f80bda7a70858d7cb8604a5816a856f3ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement.db-journal
        • Size 56KB
        • SHA256 554f614d4b0ca7bcd379f90516b36d875783108756fda6ad58f92c41b616d8be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 bb29a1efd2a466b53ea37e3b66d6843a5208f4eda75155ced6b47b2f273458ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 8753418d0420c0a5732ab3dcdf1d9367a5086189222ae6aaf7f7064abb35110b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 057fa3eb3a0f513f00a527d2b74921425b919cddb45d930240dc22bb516dfb1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 5276accc0cb3cb6db4f0bf8722cc43853458a6b96851069f37fa3d282aad69a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 d99e326c2e099a8a9992f5788ea4b63ca28a287fd0dd9c41e80894cac2692b6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 d1e095f28ddaac53fe28fed54571bffa0d49efe51478fd92c896723a97f76606
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 49671a72107b865319f3930e1a2c8787a2e122dc2d956eb5f289d2002daf9e2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 0dd1448ce8dcaf4df389c75020fb7580ff5e63dd38e9a87acd32c796b4beaf11
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 14f0cb350a9b8a0b65e49217957b2802b2d5e64a73a1b516d2ff9fbc64dce409
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 b8509c53ed9f82bd92b6474e1718fedb3b370dd2b2ae84b4e9051b22a90c13e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.fully.lantranslate.camtransltor/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 83fc58d0d6ee7b3b99923473a57673566c5ffed71bf01ea4020117e488f3f4ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.crashlytics.settings.json

        • Path /data/data/com.fully.lantranslate.camtransltor/files/.com.google.firebase.crashlytics/com.crashlytics.settings.json
        • Size 779B
        • SHA256 9e4e436ca0fcecedcc4cc0a5710e3284ecab2e8f5a56363b888fe76d54b6c581
        • MD5 SHA1 SHA512 TLSH

        crashlytics-userlog-6A82612202260001130F4E23A1ECE326.temp

        • Path /data/data/com.fully.lantranslate.camtransltor/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-6A82612202260001130F4E23A1ECE326.temp
        • Size 457B
        • SHA256 9ca787cd69527c174a8f449843328c1bb5285e98bf82636940448f136e3a2856
        • MD5 SHA1 SHA512 TLSH

        crashlytics-userlog-6A82612202260001130F4E23A1ECE326.temp.tmp

        • Path /data/data/com.fully.lantranslate.camtransltor/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-6A82612202260001130F4E23A1ECE326.temp.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        report

        • Path /data/data/com.fully.lantranslate.camtransltor/files/.com.google.firebase.crashlytics/report-persistence/sessions/6A82612202260001130F4E23A1ECE326/report
        • Size 755B
        • SHA256 e50de334b4357c0b9b037cdee23a1981e0664515d974ffbb68952cf6bf90f526
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation140309002211901124tmp

        • Path /data/data/com.fully.lantranslate.camtransltor/files/PersistedInstallation140309002211901124tmp
        • Size 90B
        • SHA256 00dacbd5f468ac26f600eef4e11128b52d389335018ac700e4ec27070dfc72d2
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation8500300514041938517tmp

        • Path /data/data/com.fully.lantranslate.camtransltor/files/PersistedInstallation8500300514041938517tmp
        • Size 569B
        • SHA256 76a8e4e20128cb87dd41752739a1b4622abd2d9cf67dcd2f9d7eb77ebe6348b8
        • MD5 SHA1 SHA512 TLSH

        google_app_measurement.db

        • Path /data/data/com.fully.lantranslate.camtransltor/files/google_app_measurement.db
        • Size 4B
        • SHA256 b40711a88c7039756fb8a73827eabe2c0fe5a0346ca7e0a104adc0fc764f528d
        • MD5 SHA1 SHA512
        • Path /data/data/com.fully.lantranslate.camtransltor/oat/x86_64/[email protected]
        • Size 554B
        • SHA256 5a8c70eaea1d02d29c0400a11c18846388ae9186ca1a99003ac9ed01be448740
        • MD5 SHA1 SHA512 TLSH
        • Path /data/user/0/com.fully.lantranslate.camtransltor/[email protected]
        • Size 3.2MB
        • SHA256 08db2ca6e3f51676dc1c9b114d522ac5ed211ae2e359bf6270066aca651e6932
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1624498498047.jar

        • Path /data/user/0/com.fully.lantranslate.camtransltor/cache/1624498498047.jar
        • Size 19KB
        • SHA256 b8d90074a4efd78bcdecc27a24d4249d53b0b76134590750733d1136d9ad964e
        • MD5 SHA1 SHA512 SSDEEP TLSH