9c228f0eedac203f1f34e6c29134a34e069a3f170b8dafc02fdf32640246493f

Resubmissions

24/08/2026, 03:52

260824-ee7tkaxzc17

24/08/2026, 03:51

260824-eeykwscn316

23/08/2026, 06:56

260823-hqd76stgjb7

Analysis

user interaction
yes
max time kernel
34s
max time network
38s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
24/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

exit status 1: "{\"level\":\"error\",\"stdout\":\"\",\"stderr\":\"I0824 03:52:25.367206 1264804 opengles.cpp:285] android_startOpenglesRenderer: gpu info\\nI0824 03:52:25.367239 1264804 opengles.cpp:286] \\nWARNING: could not open libX11.so, try libX11.so.6\\nWARNING: cannnot unmap ptr 0x7fd28fc01000 as it is in the protected range from 0x7fd20fc00000 to 0x7fd28fe00000\\n\",\"error\":\"signal: segmentation fault\",\"time\":\"2026-08-24T03:53:05Z\",\"message\":\"Emulator process unexpectedly exited\"}"

General

Target
Earth Recycle.apk
Size 9.2MB
Sample260824-ee7tkaxzc1
SHA256 9c228f0eedac203f1f34e6c29134a34e069a3f170b8dafc02fdf32640246493f
MD5 e86572cdbe1fb3950c0e154ba877cad1
SHA1 4941d6ef43875b4d230d2efffbc2af3d8ceb8a1b
SHA512 4e1350be82f370e507056eae44d0a87587ed2f4d0e0b39a59dd5a5b84e5dc95467242729ec4bfb14c8f00cac69df534084a3ab67c9aa931d86c175cf9a773cb9
SSDEEP 196608:kaPwE07y/Wn42QoNQNjrJENY6sj+AWH211P89c55fwH+eAgqcCLnG:twE0GiQoyx156UdWWfP8qI+eAgqfLG
TLSH
T10AA62312FBA6C91EEDEF82310B394F2765178D9283D3836BE520723C6877EC48595AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	qnto.jtumdm.bzhaico

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	qnto.jtumdm.bzhaico

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	qnto.jtumdm.bzhaico

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	qnto.jtumdm.bzhaico

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	qnto.jtumdm.bzhaico

qnto.jtumdm.bzhaico
1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
- Checks memory information
PID:3314

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3314.tmp

Path /data/data/qnto.jtumdm.bzhaico/cache/oat_primary/x86_64/base.3314.tmp
Size 16KB
SHA256 9fc6cfee0a095651e4ed09bb96bf4f810f5d64897c526f584bcefe4bdc560f91
MD5 9ea901ba6809007bb6385b1cee5f618c
SHA1 bfd8e4e3da6771986d20464827e4c45b2e691c44
SHA512 331b6834555802180d3de56608845d0a7d89de00434737d8dd1bd5eaa55838b3fc3b8521ca2be625dd87123b3e32b95dc95cbd2ea114c111b9efd7be0bd1e180
SSDEEP 96:AAsSavFE3l0Iw/2+FdsnCrOZ1K6yjub8eVh2yaC3N0:ARWDw/lFdsCCrNyKqyaq
TLSH
T163724E2F930190E1D4E670FC1ACA0A16DE7302B515593E0AA87AD73F7D147189FA7BD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads