f80d916e150176f2b05bac06f680a958c2f402950561735953ae89bac28a9831

Analysis

max time kernel
149s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
20/08/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
oxn.tour.apk
Size 3.3MB
Sample260820-aghv1aad64
SHA256 f80d916e150176f2b05bac06f680a958c2f402950561735953ae89bac28a9831
MD5 c0ca5985ad90a7be05941db4b2cdf857
SHA1 21c3995623a02cf71eea21f392bed1d4a2c2343e
SHA512 9bcb03c033168714f685024520924349fc705972e13a5aa85f913b202c6463c5dab582022c5d24ec83fe8b5b26badd18305425da969658728663feda21d1501d
SSDEEP 98304:qK53g4QqJVKkqo6Kr9Esz5QNLNynMN191v37O:r5/ikJJEsudcnz
TLSH
T1DAF5DF87F758992FC87740B24DAE523162574D428E83AB477C48372C687B6D82F5ABCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.oxn.dev.tour.ff

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.oxn.dev.tour.ff

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.oxn.dev.tour.ff

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.oxn.dev.tour.ff

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.oxn.dev.tour.ff

com.oxn.dev.tour.ff
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4783

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation7276252024366966935tmp

Path /data/data/com.oxn.dev.tour.ff/files/PersistedInstallation7276252024366966935tmp
Size 567B
SHA256 35e7aa27667ea9ca806e14a0cb71b863f124536cd2bc475f62417a7c843d5150
MD5 535927687bff47f7cb35394853ecb23a
SHA1 9121010a5747342524c7ee8853d2f4ca1de8ec92
SHA512 9653cb9f2d8ac159c6a5c3e506d3a4fd6166d8408a568a938914ee76a020b5657017277760a8bd87397ddcae514f107afc48190d7004e8a344247d611ebd1ca5
TLSH
T17BF096D053D4C448D5F6C9052C4D7C014C394C263B4A0CF85C8A91795FD873F125B7C0
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation7671580224951095384tmp

Path /data/data/com.oxn.dev.tour.ff/files/PersistedInstallation7671580224951095384tmp
Size 90B
SHA256 801ce388a28808a694208667e8f24342811d75b913279d653d1f61e3061bca79
MD5 465cea9240ebb792318278fe87c2e860
SHA1 0a89e6a687ffeda460c883a92f41c2a3e4fef893
SHA512 8ce5f9d76b041eaf1c330899ae237f07c4561029f131a0e2ca17517d0f5e9a746d683ac130dbd33b645b76c6a93bf9e672b811ed662590e06368e5491c1f1214
TLSH
T143B012408AB28191C5CDE3072C4CA2806E40145408898E050A0FD09140831DC81139E4
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.oxn.dev.tour.ff/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 fcb44aa7171beb7336820ecc4ebbd5478b1eaf300ee1a272d751b0eab3a95867
MD5 9683175451cbb7416b507d998b0a89d3
SHA1 625e12cdf845625fe3603822b3690c7a1d537b2e
SHA512 fc2b43e594177d13739d1bbef403eb91f927a9c474867057932744a282a605964292784b542969e60fb63bdc77a59d4589bfbbc88244b38bc2b71558090843de
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.oxn.dev.tour.ff/primary.prof
Size 1KB
SHA256 4b1e8798ba9f8a2fa2ddc6566ab031595e2ccd30629d0d76fb88ca1f87dd5a9a
MD5 21f22455a13c25aa957a98c0efd5da36
SHA1 335990a2624eb6fd816695b01a56181431d2f3fa
SHA512 be0ed4c17af255901340590927b219bc9032b198b4fbfb77738377f244d59fd222ca89d960487e4a4e6d6e5d014d6856bfd134365c73e0299894f2c9f2a36a02
TLSH
T198312A2111046A606C0C12FBA3DD939225D3E3B9D3DB6122069F833CDD286B8D0ED4CE
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads