b008e30590725d6a5bde09ebad2cfe6ff0b002b16b3b93fe9150a608a180f511

Analysis

max time kernel
36s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
20/08/2026, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b008e30590725d6a5bde09ebad2cfe6ff0b002b16b3b93fe9150a608a180f511.apk
Size 11.8MB
Sample260820-nwbbcsda47
SHA256 b008e30590725d6a5bde09ebad2cfe6ff0b002b16b3b93fe9150a608a180f511
MD5 9193f646d7470a0df8496bdf29fa8848
SHA1 c4a0d212ac3d34daa4affe7c422e92f12c2eea3f
SHA512 63c5f68b8722bf6b2a63cd5e9ad793ab490d7b75ff162d46d4f0e0b7ed79a62b26ca7f9ba3385482e6c67275850b3ee07b6619923ff2f6c6eed1d59de5d24214
SSDEEP 196608:46yHFPs0u9beP2aNSDynXmnOIXzWzHliAIb6aqd0KWd5iJcyRtQkGEHjR:46ss0u9bePuyXmOIXzqFiwaRJQUkJ9
TLSH
T155C601ABFB1CF92BC4364032C55AA132B26F8F118E4297777908730865B35E94F65BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.text.chatting.messaging.messagebox
/system/xbin/su	com.text.chatting.messaging.messagebox

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.text.chatting.messaging.messagebox/[email protected]	4968	com.text.chatting.messaging.messagebox

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.text.chatting.messaging.messagebox

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.text.chatting.messaging.messagebox

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.text.chatting.messaging.messagebox

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.text.chatting.messaging.messagebox

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.text.chatting.messaging.messagebox

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.text.chatting.messaging.messagebox

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.text.chatting.messaging.messagebox

com.text.chatting.messaging.messagebox
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4968

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.text.chatting.messaging.messagebox/databases/com.google.android.datatransport.events
Size 56KB
SHA256 0b1d8ef7ae11c4583497473f7d008733a8a3a9fe4a08e203a335cd30ceddca07
MD5 2a1ff77c6da674b99c2e9d0955248f82
SHA1 684e8f81aaf827e37c13a872575f23965e7539d7
SHA512 0cf25cb05eee918d89db46672e4a5dbf23e6db6de4835ab32f8da34445be473956404aa5f6cf3cc1297ffeae3241fdc25c609f77b2eaf641d5d91bd45ca1c243
SSDEEP 48:T2159MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSP/Za5FXfbjtFXfbln:iRMEqzAiwIyNjaPxybjjbt
TLSH
T1F743948D593E222DC66D783DD7F2C3A32A3C43CF5722D1603EA48CE6CCC206974254A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.text.chatting.messaging.messagebox/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 ecd36489458c36e2ee58c71b7403122efedd620fb22cb950c08d0b28d9c40a22
MD5 ef7d120e24d6d21c2a50ded4edd523c7
SHA1 00a8273d5bef1d28a8f7a22e5f30d237b04d1760
SHA512 b2d0ab74c53fbf403984c11c664d20480add553db5e623aaae514108dfee728d6e23c47035b34ebaffc88ad9edd34144deaa4350e4c0f8c50c54fe12c7c72304
SSDEEP 48:7MtUqG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPST:7sU9MEqzAiwIyNjaT
TLSH
T156B2745C593C2610C5BE283EE7E242535F3C53DFA72392603EA49CFF8DC2469B0255AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.text.chatting.messaging.messagebox/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 fbea8bce381528ed7626db15627aeef73f9b95b89199174f9b576e2d547e6c26
MD5 f42f9f520bd360ceb32e148ab85419eb
SHA1 eb1ebbe6f457cac66927595e5b6800209385304b
SHA512 f12af59ff012612749367a472f704c9164a821b08e5fa8794e39d4f7268f8ce0446f97b3ee7c97e26338388c5be60e50f9e9fc87a9525cbb3eb7112b930742c7
SSDEEP 48:7MQF0vVjHyS9Yw6v+W6QWlxq259MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPS6:79F6ZH9+nGpvtMEqzAiwIyNja6
TLSH
T12472965E6D3C2621C67E687EE3D243A35E3C13DF5B13A0313AD88CE98DC5069B0355AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.text.chatting.messaging.messagebox/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 a751678afe878044df4fb52b0f3119a4fb9210cae66ef934786f064a710e6ee5
MD5 7a19cc9d6ae7d8fce5bf94f6a2323209
SHA1 9a866488af7190397c78690d4bd04c3568199ac2
SHA512 5f6bc2bfc7a279431c8c69e94d08ce65ddc1e569aa4089b0fdbc934395d97af87fc5ad5108640a49e283efa61ac69c29d43da72bc33daa26bc9f8211254e3693
SSDEEP 96:7aZ8O80noUEJ7OfsAeAoAZ6ZHDRnGp7dMEqzAiwIyNjak:7ivsAe/NpDRGpn3J
TLSH
T13A72FA4EE83C1932C6BDA67EE3D015432E3C13AE5F52703439EC8DA48E890AD7026666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.text.chatting.messaging.messagebox/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 8a9767853f792f3bbfb32c4061787ac7fa2689dd04f2a8de297789000b126260
MD5 670bd154a11944def3ae134baec3c2c0
SHA1 bf1261ef05362a6ae57e65f75a62ebc9f736c9e8
SHA512 fde5d38ae475d5ad1d2f4da64804d1ef40667e09c6519d5e20e52c89e1267186bf9fa964b51a0f3227574aeaa40a7033de30a8a177d15684e5d145b93b2e671a
SSDEEP 96:7ZX6Zxqr8O80noUEJ7OfsAeAoAZ6ZHOCn4s9nGpENMEqzAiwIyNjav:7QOvsAe/NpOm4uGy33i
TLSH
T1C872F84EF82C1E32C7FDA67EF3D011421E3813AE5F52B03939EC4D649E8909D7062666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.text.chatting.messaging.messagebox/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 559eceaae8a250cb76bb75df1fa188c050d64e3911de6f5ea5ecac15d6fca724
MD5 bfab0f8b2a78004d853948dad14c7814
SHA1 5073487341c77c3575d0272598fb631d8a0ae52f
SHA512 af484d61c4d81eb78efd3d9a4fb5465006a73bed32f807b355483840ec73218d97b17eb76e20a6c681b28a75e9c6fc2e2b9faf5f00d0c4858097d8e8fbd40928
SSDEEP 48:7MdVKqG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSH:7T9MEqzAiwIyNjaH
TLSH
T1AD92555D5E3C2311C6BE283ED3E143A35D7C53DF672391603E949CEA8DC246AB0255B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.text.chatting.messaging.messagebox/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 d062210bf46ff2ee72adc639d2c112c9e31df95d83bdac73c62f6db2093509f6
MD5 bc1536e8cb489a5bf76e2b199c26a8ce
SHA1 4069413882c934aa2066171096a6a1aa56649265
SHA512 c546711af00bd65cb2557517b3aec21a785fe4e0bd10d0880d1216c7765c27a3815e6367257b21cc646606ca3dacc1139a0f7db7f712a6f0495f64e9c38c4001
SSDEEP 48:7MgFVFXfb2q259MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPS2:7nZb2tMEqzAiwIyNja2
TLSH
T11802735D593C2211C2BE787DD3E242A35D3C93DF972391603EA48CEACDC2469B0254A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.text.chatting.messaging.messagebox/databases/google_app_measurement_local.db
Size 16KB
SHA256 1bca042ed642c444932d4c6efef1e058e53e301317c8bc3e57a857e5ffe66312
MD5 85343b5fbeb63676ffd5604635db337c
SHA1 1870995e6ffb1deb01da2dc566e41a91392af886
SHA512 0abb80b9e01c58acdb2c5fd8022dbf71659bdd27884d3ee655df32427479e96cf14168ebd7bedd07ede73c0a35fe97715a814b1fd898ff89b3b1444d68b49be4
SSDEEP 12:TLIEU9zmzrfRmBEyPbP/d3hk/0RT/VM/QCI:TLYpmzr0GSP/d3h/RT/a2
TLSH
T1F872558EFE209707E1774736A4CAD3D22C38726A0363D9073E850B5C5E8264555A1F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.text.chatting.messaging.messagebox/databases/google_app_measurement_local.db
Size 16KB
SHA256 32874691a5e70786f6afac9bd7d3fcc113a13a038002ee9047409333c3407773
MD5 a32c4cdd20c2659b729e138f67e20eed
SHA1 456f9b8846e24b2a143f5c5b1f7dd57f7faa0add
SHA512 65edf5bed647d4ce52bf94afa25753d94ab7dc48dddbcabd81825d171a163abd730b879bc806a06495bddbec062088aff9c7410785a0238c86a0dcbad5b6b4ab
SSDEEP 12:TL6uER9zmzrfRmBEyPbP/3p/0RT/VM/QCI:TL6vpmzr0GSP/3SRT/a2
TLSH
T1447255CDBA209B03E2734336A4CAD3D23C34326A0367CA473E440A5C5E82645A0A1F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.text.chatting.messaging.messagebox/databases/google_app_measurement_local.db
Size 16KB
SHA256 f2c4ed7c8368b1d95c15c1408fa4ce804137e80226989a640b1a66fbf99e4a2b
MD5 072c9371efb4a7412d87ab995cb7a82b
SHA1 22b4bcf2452ecb49b277b7976df13a76499033bf
SHA512 e7129a214ed217e855ba07fef14369e7454ca7ebf06316a582141a2cb0864d278295f5e72c48d0f916b04d0234b3b8d485eb2b8c9d2f765c3b94b8df9a28f82b
SSDEEP 12:TLuEe9zmzrfRmBEyPbP/hZt1kn+/0Fl6zE73O4p/0RT/VM/QCI:TL4pmzr0GSP/hZtunlF2ErSRT/a2
TLSH
T1F272598DBB21DB07E177873264CBD3E22D3831660323D6567F890B5C6D827855151F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.text.chatting.messaging.messagebox/databases/google_app_measurement_local.db
Size 16KB
SHA256 219b049283d02430b4ee3f90e157c2aface11925260b08be73748fd175da0018
MD5 c40b8dc32096ed36d76df337ca930769
SHA1 b1e1fd3a5e71276c7be344b642cecaa788bae232
SHA512 4734382402ac84e223a71764fdc3489964b013869bf2ec6c0b9544eaeec03d06b970ff97c455b176455be003901fdb5250a6e1899c5dfa3414cdd275d1cdb9eb
SSDEEP 24:TL09pmzr0GSP/s499FfaPnlF2ErSRT/a2:TsArSP/F5faPn2Erib
TLSH
T17E7249C9B625EB03F677473560C7D3D23C3831620363D256BE4A1B1C6D823968261F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.text.chatting.messaging.messagebox/databases/google_app_measurement_local.db
Size 16KB
SHA256 09c3f44ef299547c89232e98d3d636ed6ae4e18f85f3f74f078a9dd81b1092d1
MD5 967d112e99915b323c8689ccd5478281
SHA1 5a8d18d3dcd4997854db021408c7cc74cba88f19
SHA512 67962f0a95fcfe4415b3df92265acc836dd09823cf98d8c72aabd6294c0f40443f57fba3dbe5dafeb65c51eadbf922a0607fc88b84cf6f0869e68beeb2417092
SSDEEP 24:TLElvpmzr0GSP/oOl5hKamNZ2o8JX499FfaPnlF2ErSRT/a2:TgvArSP/o0camNovI5faPn2Erib
TLSH
T18A7266C9B278EB03F6778B3961C7D2D2383931A71723D2527E4A5F0C2D423918161F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.text.chatting.messaging.messagebox/databases/google_app_measurement_local.db
Size 16KB
SHA256 734a40dbb394f5fabc4d2286deceea6fe518eb8a823ad7c7b4d68d933b20f811
MD5 95f57e6329ff8666eed6cf4435d31130
SHA1 0b64e9d68fe09480af367eddbb917a0a3858dab8
SHA512 4dec8600ea3dac67ee57e9f5e81e0dcac7e7467611833f6c57ac3bb4c0279cb57b8996479335824bda3080c1ba7aa9e24472217e6c51cc40bdc604fdcab7ba74
SSDEEP 6:l9bNFlaLOls1TnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/jqiOweqllll:TL5ED9zmzrfRmBEyPbP/POweqllll
TLSH
T1C172268C9B102A02C6A20633B8C9E3506D65922E8337DA1F27950870AE025C85451F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download