Analysis
- max time kernel
46s - max time network
154s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
19/08/2026, 17:56
Static task
static1
Behavioral task
behavioral1
Sample
4e52f85b5be6cdcfc8a3493c0d56e99494a36871e53ef90ea915015a9fcbbdff.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
4e52f85b5be6cdcfc8a3493c0d56e99494a36871e53ef90ea915015a9fcbbdff.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
4e52f85b5be6cdcfc8a3493c0d56e99494a36871e53ef90ea915015a9fcbbdff.apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral4
Sample
payload.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral5
Sample
payload.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral6
Sample
payload.apk
Resource
android-x64-arm64-20260325-en
General
- Target 4e52f85b5be6cdcfc8a3493c0d56e99494a36871e53ef90ea915015a9fcbbdff.apk
- Size 29.9MB
- Sample260819-wh5l2sstd1
- SHA256 4e52f85b5be6cdcfc8a3493c0d56e99494a36871e53ef90ea915015a9fcbbdff
- MD5 e673f474ef3fbfb60c9ae9c32829d4bf
- SHA1 44c4be3ecc83a30db2483eb9895e30ec48fb6eaf
- SHA512 903ab32139331c0fcd72bdaf3f99081252a2622861f43be495a1fa6ac695757b4906bce36dc14cdedde8001346dadb7c301ce1e3cacb1cea1c4056c4bcda7c3e
- SSDEEP 786432:ctCiCLBpRFLh2AeNlUCwCeoJeZcFQGUBuLbXOQgJ:ctCiCLBTFLhpeNlBwCeoJEcFQGKuLLUJ
- TLSH T1DB67231AEFC87A6BC5F74236587A55254C430C44838BCA82EE9A752C2C776F1B71DBC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web 5030 com.jojo.sellfupdater /data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web!classes2.dex 5030 com.jojo.sellfupdater - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.jojo.sellfupdater - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.jojo.sellfupdater - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.jojo.sellfupdater - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.jojo.sellfupdater - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.jojo.sellfupdater
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.jojo.sellfupdater/app_behave/OArhW.web
- Size 3.6MB
- SHA256 a750dd7b6629c6bc56d623115b02c94263fc5fb7ebe13bf6c55ffecd55742342
- MD5 52234c255a739fa89d3556062b8d1ce0
- SHA1 a332b70707d8756b8b9e6dea7773814a890a48a5
- SHA512 4a5b7c65b890def63e7dc34965eb92e12513d496fcb83a86cf220bcb3450227c878aca987f0434a9d6c6057d1cb618cc22192b576a53b83d0a9c1ba608a4b6aa
- SSDEEP 98304:yBqHDaT9GcEhK764OGAJrMXZC1mhpyISrz5T30lJeNL7w:VjaxSX4Z49mYzmeNPw
- TLSH T13C063399728E4FF3C442C079B7C4BC70AE990D568CAB42559B1B4F71021BFDE32B65A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.jojo.sellfupdater/app_behave/OArhW.web
- Size 3.6MB
- SHA256 efcccc35610dcf62c20f59258b319b3bf7c3a59f708da3643bf6ece1b50c95d5
- MD5 92644b21c72157d780980c39eb2f4951
- SHA1 7cfa8726df55b673532a0bc7350f5a265ad9ec92
- SHA512 181f1efd68e9f3bfa87ea20e61581fbb1cc525132622bc886e28eaea77c1b674e77097653082075c99ed55002ee0ae42bb848d73ba1474ab6dd59cb93d30251c
- SSDEEP 98304:1FrbKlYan/4UB7F8HHwxNCHqgv1PoiGKP/wTUjcM+VECYq:HKp/8HHwx6FG0JB+gq
- TLSH T174063382C910307F7A0B78018F079DD98859A3D94D4B50EE62FB85C4EEB364BF999732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.jojo.sellfupdater/files/profileInstalled
- Size 24B
- SHA256 ab54fc09c79a0d74ea21b918bc7e2979344c00fbbde4a0222c92b04bd9bc175e
- MD5 36d88dd466e60b0df55e3bd91473371e
- SHA1 f41e9ac4a68ee5ff6e0ea6b75491df905eb31df3
- SHA512 515af5fb64d3a893a1a43fafee761a4439f7ea4f71bc7937aee657a64fd23cc9870683c47d8a252fd7c47ef39d79716e28fece1de022e85ad35674f4079c7e94
- MD5 SHA1 SHA512
- Path /data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web
- Size 8.9MB
- SHA256 f14035133064bad4a8dbccd4b683b6780155298822f44c5d92b93f8e4b23d965
- MD5 bb79965a285bff3960ec727f4d85c7fe
- SHA1 e9c452833b34f21ed9fc20874fee1928b3aade87
- SHA512 37eee7bfc98c31f45337c2cd5eb5c0ff0e6e8fec3325d5398155349fa2e869857b9d8b5b23cb5072d7bda1c458678489b12804f4a10b39b92699fea0dd482abf
- SSDEEP 98304:rZrplcCmKW2/mMqPyr1WJE3BwsQF4J+7qJxmi5Kqj:r/lnlQm+7qL
- TLSH T11B96AF67A616BC32D5AEC33ABDFB4300BB3210567763578B1184E9BC7DC32C15A9D298
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.jojo.sellfupdater/app_behave/OArhW.web!classes2.dex
- Size 849KB
- SHA256 bddddc355e6af0e007894940dc137c80bed6a4bbb91da0b3b6f7e3177120f1d7
- MD5 3a55b0f15295422bc6c23f8a85134115
- SHA1 24b8bf9122393b5bfbbd90d963f5492a0815a748
- SHA512 5f68cfe7125bea978435c6d9722698d5c695e7a0cc81944cb86bb39972aee5d4dc3f1777384bf26355797823be81945d4614266cc318708b64e377c00452eb06
- SSDEEP 12288:HL/1Z180acFtoY8CTznB2coSgQLUXkacj:z1Z1ocFuKznBXoSgtTY
- TLSH T17A0528A3F62C1E31D19A06B70CE722F1133963D75983AB43AE859569FE87281D71D32C
- MD5 SHA1 SHA512 SSDEEP TLSH