Overview

overview

10

Static

static

10

3bf85d89ea...27.apk

android-9-x86

8

3bf85d89ea...27.apk

android-10-x64

8

3bf85d89ea...27.apk

android-11-x64

8

Analysis

  • max time kernel
    36s
  • max time network
    154s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    20/08/2026, 09:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27.apk
  • Size 19.1MB
  • Sample260820-lkmtxatepd
  • SHA256 3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
collectioncredential_accessdefense_evasiondiscoveryevasionimpact

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Checks the presence of a debugger
    defense_evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.memory.phone.data.storage.removal
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4853

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1681310438574.jar
        • Path /data/data/com.memory.phone.data.storage.removal/cache/1681310438574.jar
        • Size 11KB
        • SHA256 1d2c79f353a9a99d45110c1e8a86a160bf086d58662027912bdc7d1ff4776a06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 d76ad22c81037c7ee0b15be6cf5b43960ce37b391e3378d41b58df02e93b9344
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 359c23354e39ad84d93ce1955377c22e45b8fa2b1d0bf6ef46995ccb9a4e59a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 449ca72cae40b36ae0f5d73fa801f2141aa82e4b59059a16745f05e84a563eae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 ccaf31ff6ffa148285550030f094900d928629a0f419cd7d5ccd8cb79272bbaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 8f2dad1a7acf359c81001d35b973fe70b46daf439c7f8ada20463af4fab9eaaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 73ac8cea973c0f1e5abbab4d7d0f5695c8d3cf77e31727203d1bc2714e3b1037
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 1fdfb5313ac0de83b7cfc072e1028d309e4d4359865b7b8beaa0587dd4232b40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 c7c149b5aac44eb04ba8cbb23100655e40ba8b1f3b0db63fad7bcdd732c1a8fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 621adeebebb3131a5897a197fe8d44e9329226efc68a9bcb884eb6a81058cf37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 318fa5818073efc3485cc4791c72560f62cf5d1a2587caf1957a0b8a0b203234
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 4476b5e7e72943d81c4aeca3faaf5d7a605531e470e63786e6a0626bcdde2295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.memory.phone.data.storage.removal/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 4be5dec9eb728d233159657796f95d807163a873860f45e00d19a7fdee9c46fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.crashlytics.settings.json
        • Path /data/data/com.memory.phone.data.storage.removal/files/.com.google.firebase.crashlytics.files.v2:com.memory.phone.data.storage.removal/com.crashlytics.settings.json
        • Size 806B
        • SHA256 bb9dda035f7d57e44409d16fc7d7b1c58b72d7f0ba3bf30006a2ad6197f3c757
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        report
        • Path /data/data/com.memory.phone.data.storage.removal/files/.com.google.firebase.crashlytics.files.v2:com.memory.phone.data.storage.removal/open-sessions/6A86CA7403B5000112F54885A8A71427/report
        • Size 765B
        • SHA256 6f1da80e029ad874bf21c6ef6d85291e0348e1ab45f1ad159538fee341497930
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        userlog
        • Path /data/data/com.memory.phone.data.storage.removal/files/.com.google.firebase.crashlytics.files.v2:com.memory.phone.data.storage.removal/open-sessions/6A86CA7403B5000112F54885A8A71427/userlog
        • Size 342B
        • SHA256 c491b66aef4bc42a4558f3f33502a9f5fde70a16d0a648154574ce77b43bf798
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        userlog.tmp
        • Path /data/data/com.memory.phone.data.storage.removal/files/.com.google.firebase.crashlytics.files.v2:com.memory.phone.data.storage.removal/open-sessions/6A86CA7403B5000112F54885A8A71427/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512
        Submit Download

        PersistedInstallation1269155754862482480tmp
        • Path /data/data/com.memory.phone.data.storage.removal/files/PersistedInstallation1269155754862482480tmp
        • Size 567B
        • SHA256 30fa5cfa1d790944ae553a46d0baf0ee9515e368a3816da312d52eb3bdd89add
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UnityAdsStorage-private-data.json
        • Path /data/data/com.memory.phone.data.storage.removal/files/UnityAdsStorage-private-data.json
        • Size 57B
        • SHA256 3f744679380959d886ce8fe12b906e90e2bb41784f03aeae46b52ff462617b6b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UnityAdsStorage-private-data.json
        • Path /data/data/com.memory.phone.data.storage.removal/files/UnityAdsStorage-private-data.json
        • Size 4KB
        • SHA256 c801b2e135ef719c41109d35d1a6496b66c61f6ae63824520878072080632f6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UnityAdsStorage-private-data.json
        • Path /data/data/com.memory.phone.data.storage.removal/files/UnityAdsStorage-private-data.json
        • Size 4KB
        • SHA256 5abfd081fdbd46c1bb179b3b7c4675c84050c3a989de7ef7bb4b154199e84e0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UnityAdsStorage-private-data.json
        • Path /data/data/com.memory.phone.data.storage.removal/files/UnityAdsStorage-private-data.json
        • Size 4KB
        • SHA256 755e0ea6c9e7e2d6742b0a57295a1f755ea147e8103c3577dbc01b32bcd51653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UnityAdsStorage-private-data.json
        • Path /data/data/com.memory.phone.data.storage.removal/files/UnityAdsStorage-private-data.json
        • Size 5KB
        • SHA256 88c314a0549bb89d28139046334b86ea35d8c83f26143af5ff0f619ad178b139
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        frc_1:198128199361:android:577e9f9021680f50c61640_firebase_fetch.json
        • Path /data/data/com.memory.phone.data.storage.removal/files/frc_1:198128199361:android:577e9f9021680f50c61640_firebase_fetch.json
        • Size 1006B
        • SHA256 f773cc852174eafb2212eecfdf53f3a754a21e4ae24e163cb8bec96736c4edf3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        frc_1:198128199361:android:577e9f9021680f50c61640_firebase_fetch.json
        • Path /data/data/com.memory.phone.data.storage.removal/files/frc_1:198128199361:android:577e9f9021680f50c61640_firebase_fetch.json
        • Size 1006B
        • SHA256 0abf231ea3288202b7c97ee4b0694de6f2c6326500749811d77b4a8452fe64f9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        frc_1:198128199361:android:577e9f9021680f50c61640_firebase_fetch.json
        • Path /data/data/com.memory.phone.data.storage.removal/files/frc_1:198128199361:android:577e9f9021680f50c61640_firebase_fetch.json
        • Size 1006B
        • SHA256 3c30cc42bedc0dffadfd1d09e44dc9ffe53a30ac7877a50d301bb1ff5fd6718a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Path /data/data/com.memory.phone.data.storage.removal/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 a86aca3de950392233adbfa99c71fb6385ad3916198ed1c4489f8372e9eb77f4
        • MD5 SHA1 SHA512
        Submit Download

        UnityAdsTest.txt
        • Path /data/data/com.memory.phone.data.storage.removal/no_backup/UnityAdsWebViewCache/UnityAdsTest.txt
        • Size 4B
        • SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
        • MD5 SHA1 SHA512
        Submit Download

        UnityAdsWebApp.html
        • Path /data/data/com.memory.phone.data.storage.removal/no_backup/UnityAdsWebViewCache/UnityAdsWebApp.html
        • Size 2.3MB
        • SHA256 6be3b179c4a241e3944f8c24402a0f59688dfddd6957930a87878945da5e9a22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UnityAdsWebViewConfiguration.json
        • Path /data/data/com.memory.phone.data.storage.removal/no_backup/UnityAdsWebViewCache/UnityAdsWebViewConfiguration.json
        • Size 798B
        • SHA256 2e7394552cb5ef67ace38026e48c19db0bb9e2c785a1d7717a2c60992a5533f4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/com.memory.phone.data.storage.removal/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        primary.prof
        • Path /data/misc/profiles/cur/0/com.memory.phone.data.storage.removal/primary.prof
        • Size 1KB
        • SHA256 8c2f5522b78e738d49fe2a9217955e54b914eb498870f9b1de54f47c88004bf4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        1681310438574.jar
        • Path /data/user/0/com.memory.phone.data.storage.removal/cache/1681310438574.jar
        • Size 22KB
        • SHA256 e1d0e321dc1c13a890f0ac8ce83fb20dd5188ab223459116df19d24606908a02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download

        UnityAdsCache-908648c7af5440978c981a1248470e0419d345772abc85456025b87ee8769ce4.mp4 (deleted)
        • Path /storage/emulated/0/Android/data/com.memory.phone.data.storage.removal/cache/UnityAdsCache/UnityAdsCache-908648c7af5440978c981a1248470e0419d345772abc85456025b87ee8769ce4.mp4 (deleted)
        • Size 220KB
        • SHA256 6714c9d20f91aa5af6de22e8ef3284e852ebb528e2c2bc13874cd7d329191217
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        androidx.window.sidecar.jar
        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 12KB
        • SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download