Analysis
- max time kernel
26s - max time network
151s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
25/08/2026, 03:09
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
kefu-laike.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
kefu-laike.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
kefu-laike.apk
Resource
android-x64-arm64-20260325-en
3 signatures
150 seconds
General
- Target kefu-laike.apk
- Size 138KB
- Sample260825-dnk6gswelf
- SHA256 5b1879eb5c806d7cd9f03d37a3da2af9197a0810961a3c2862b8abffe9fd856e
- MD5 c2ff5876e307837434e64f37ed957cdb
- SHA1 64942c3d806e9d2e16a1ad421bb0fdc12e0f900a
- SHA512 2d3ea59fd0806757a62e70db8be7e684b7f2bf43947ba5af93559213e8f8752781af4ad56ab8c2802373bb6b7d6cef5c228a486c4df3162ca4b9667e8c2387fd
- SSDEEP 3072:lnwgkNmobnZX2kp0n+480xU2sjC3eBzhogYGXNOnlcfjkD:4molX50gMswOSIi
- TLSH T143D3F1A3F757A529C1639E308BD619D6FA262C60C7C6E1234E03B16D2F750B9E344DAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.laike.kefu - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.laike.kefu - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.laike.kefu - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.laike.kefu - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.laike.kefu