Analysis
- max time kernel
18s - max time network
153s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
- submitted
17/08/2026, 04:29
General
- Target 8c2e3c0c7fd591f1377e9318fbcfbcae85db4875a2f405b99da46edf9b70eefc.apk
- Size 3.9MB
- Sample260817-e4lmmatvbx
- SHA256 8c2e3c0c7fd591f1377e9318fbcfbcae85db4875a2f405b99da46edf9b70eefc
Score
10/10
Malware Config
Signatures
- Detected google phishing page
Potential google account phishing
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Hides multimedia files using a .nomedia file 1 TTPs
Android's media scanner ignores any directory that contains a .nomedia file. This hides your photos, videos, and audio from the gallery and other apps.
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.skyclean.clearlite1⤵
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
UnityAdsStorage-private-data.json
UnityAdsStorage-private-data.json
UnityAdsStorage-private-data.json
UnityAdsStorage-public-data.json
UnityAdsTest.txt
UnityAdsWebApp.html