3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27

Analysis

max time kernel
46s
max time network
153s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
20/08/2026, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27.apk
Size 19.1MB
Sample260820-lkmtxatepd
SHA256 3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27
MD5 a1a4fe5ec1bd523034d08ae26b812a5a
SHA1 157744af9745209f418f732d301965447d8dbe66
SHA512 3e3842e2f44426778a3675422fd70f9bca65ab18e8b1eca610f6294188ac5c367483928fbd24e635df2749c6624f005db696dcb99ad762d7282edefcf1f46ac3
SSDEEP 393216:PMG3RgnY2bbdHBUQm+SPSqhlaVeAZzqrz+umPIlE2pEPnx73wmoMPKlIw:d31ySPSqhsVeAM8IlEQmZ3dPK5
TLSH
T19317229BBF4CE87FC43A5073CE669133327B9E164142A7737508B20869B35898F59BC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.memory.phone.data.storage.removal
/system/xbin/su	com.memory.phone.data.storage.removal

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.memory.phone.data.storage.removal/cache/1681310438574.jar	5172	com.memory.phone.data.storage.removal

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.memory.phone.data.storage.removal

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.memory.phone.data.storage.removal

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.memory.phone.data.storage.removal

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.memory.phone.data.storage.removal

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.memory.phone.data.storage.removal

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.memory.phone.data.storage.removal

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.memory.phone.data.storage.removal

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.memory.phone.data.storage.removal

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.memory.phone.data.storage.removal

com.memory.phone.data.storage.removal
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5172

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1681310438574.jar

Path /data/data/com.memory.phone.data.storage.removal/cache/1681310438574.jar
Size 11KB
SHA256 1d2c79f353a9a99d45110c1e8a86a160bf086d58662027912bdc7d1ff4776a06
MD5 9be9b2aaedfbd00175da4ca9aee3292d
SHA1 df4c68fe6432be3dc72f0ba4cf2b9f74c7423904
SHA512 67a5e085a9768aedd875bf133da6cde6ed320dece17437cf36f9d032cd96887fd3d78c5590ddf39a148835bac5d95447678c0fffa15919fedb7920eef447f164
SSDEEP 192:vevqX6aMltJZM/ZYbEe8uZQ9Sw2si2HRpM8D2Zr3hjjc92JxMH:vab9FeZYbE2wSwzzM8D2ZLhjjjJg
TLSH
T1CC32B0EA4B6DB48FD71BC6F939B89983B847E59C81B0125B53D8F05A7C93EA42F10C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1681310438574.jar.cur.prof

Path /data/data/com.memory.phone.data.storage.removal/cache/oat/1681310438574.jar.cur.prof
Size 151B
SHA256 e9a4ff5d705d4eb1b8da2777135ad41dff3f3c1663bd2251b5148ffa840ae6f1
MD5 c3f8be891720ecb7d9e19367aadcf12b
SHA1 f895aa6b4004d56c328b0da85bc37e32247131b2
SHA512 7514dd2e5a84dc64b2e864a8ce8f39f69a0c8e2b1424d01f67ef8849e4cc64dd71f1d7a4772e0965765f8037ecb9ce4985d52ad10c06dce8575d0f36d33ad186
TLSH
T187C08C1557684958AA72E028A6B23B6A4BA7C40C00408617664E433088E2D9CE80FC82
MD5 SHA1 SHA512 TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db
Size 16KB
SHA256 dac179f7170e7760b8b6cafbd24989ceb51b82e1cdce10db321de03bece00674
MD5 c756d29a2a8a2d14f7ab312ce8a7a27e
SHA1 5ecb5397d7342f5980dec46ba50998c889a8f878
SHA512 248b6b317ad45f3facb97a6b5dd668f9298d3587f6f4a5bfeaa0729fa2d1da8c09d244b95b5db4abb19a7f499fe02699ec39a400718397fbbac73cae1cf50ffa
SSDEEP 6:l9bNFleLOls1vlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/jqNs3:TL1Ev9zmzrfRmBEyPbP/d3
TLSH
T1E1722BCE9F102703C2770773B4CE93A15C24A21DC737DE472BA50474AE43449A052F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db
Size 16KB
SHA256 d51c3120077e51cf312c699b416cc468464ce7696541c6e0c5e5093f8e8a6074
MD5 e41f62f8dd98d4238e14121abc7deeec
SHA1 2d064dacbaba18807b1e06872850c1a703ade4d2
SHA512 0d56029ea6cfdc72b650f0390ff3b2b37cc240923ac46a0eda084d6e6091d5898906ef9ccb08187563c0b3339f8960444e58d2e38922582dfbcc03b6b63b8d17
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/P+/0Fl69u3x7:TLEvpmzr0GSP/PlFcuh
TLSH
T1C072688DBA016707D137473270CF93F11C34B3189333EA073A540468AD43184A242F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db
Size 16KB
SHA256 41539ddf0f347dda2d7c9a68a3f62b546f6bb82871a7101b2c16dc4162747edd
MD5 f22d9a0995cc780430f08d86a6661f46
SHA1 b620ed2fff11216c1b4639bf221c871ce94c2714
SHA512 8a07e3c353ca9bf21ac1ecf7d904ebe03e813f97418c4820d7ea30fda19655202269f98e4efa97369d0f8b98daac8289e7ecf06c757c939476b8f0b8271ed15f
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/hr/gW49blqYFlcIa/+/0Fl69u3x7:TL6Xpmzr0GSP/h1499FDa/lFcuh
TLSH
T10D725999BA119703E2374B3570CFD3D12C3872154733E6077A150A2C6C433859061F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db
Size 16KB
SHA256 c84f76cd7df85ddeb9d08ee2b69892a8f4c7594aafee7b6e8d50764c351866f3
MD5 a458dc15e2db404e53c5fc612d39d2a9
SHA1 acb1c629ea33ee1cff904554563a96fa8b87cf02
SHA512 0a25014b30b29e596867df7300df90cf77f9a80eb1b495ec7cee8a08a11218b5828589c0466fe1e89a4d1db49ea3527795def1377aef9616828d06f47f93c79f
SSDEEP 24:TLApmzr0GSP/JKabCCbJf499FDa/lFcuh:TkArSP/kabCCbi5D6Hh
TLSH
T1C1729998B9A5D703F2774B3860CBD7D1393872660723E2033D5A1B1C6C4338180A1F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db
Size 16KB
SHA256 903cddc5834787caa59e0b31e858399e621067155354acec42ce28f934305633
MD5 edbb244e02eb6216c07428585cec4d49
SHA1 bd55b314c2943eb5b93bc9dc4c1193044b2c948f
SHA512 a89c0ce527486aa7461f9a95646d73c7dc5caa40c227b36f5dd08719301858d77e442742323738d554cb9634d0f9cc14a94fd84c60ba9c7e4bfc4bcb56de4456
SSDEEP 24:TL0lpmzr0GSP/ooMKaxMJtF2/c3iKabCCbJf499FDa/lFcuh:T0ArSP/ooJaxGF2/AabCCbi5D6Hh
TLSH
T1E572599475E9DB12F2B74F3862CBDAC1293832AA0723E21779562B0C6D0239180A1B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db
Size 16KB
SHA256 1c786a592f3ab6f640bec34cde3158781e5bd0876b985c0d5caa73cca00571fc
MD5 28f3bdf9ff602e959183f8e2543e6c3c
SHA1 ed1878faafc14667a5480bba428e146d394de1ac
SHA512 b7ce229c7d1720329a0718ad1a2350e86011b5eeaba5505d83bf4e2371af1e903fb4dbb34446d3a4f09fb191461e1d2dfbaeb82c173d91bf69a9561a1972b600
SSDEEP 6:l9bNFlgLOls1tlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WT:TLuLKEt9zmzrfRmBEyPbP/W
TLSH
T14772C28E9E312603DA62077278C993696C14A21D873BEA472AA80464ADC34499091F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download