8f1e3bbf48a2c64e78b8219056370a742374026514a69d907b401124fc07a21f

Analysis

max time kernel
23s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
26/08/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
msg.apk
Size 4.4MB
Sample260826-per38aydrf
SHA256 8f1e3bbf48a2c64e78b8219056370a742374026514a69d907b401124fc07a21f
MD5 7f496ef03249cba03202ff920fd5b53f
SHA1 527e109237a657d9e2c444b0cd4fffe3b6ea305d
SHA512 8194579b24b55d302270d62c11c1b7d95a6b244f7534a659fa753c9bc6420792392c3d51a3f06e28f1c355934c35db9fe693801e094855b893dd200cf8cbaec2
SSDEEP 98304:jzGGUEqVPTG/Yc+vN/qsdetF2pQHVO4lCSNwMWVn2nGaSSEOGy79BaHGGlJ:jSpE6qLtgpMCcnGaSSEO0H7
TLSH
T1CD262303F679FA5BC8B3E03212041372545B9D2AC593F6C669683BF964BBDE84B493C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.services.systemdata

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.services.systemdata

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.services.systemdata

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.services.systemdata

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.services.systemdata

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.services.systemdata

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.services.systemdata

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.services.systemdata

com.services.systemdata
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5084

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

Path /data/data/com.services.systemdata/cache/1
Size 44B
SHA256 aff93f63338b0e6eaa121e6f0dcc25ef4b1eaeb371799b17c550bfde8a177c53
MD5 8ea7f6e9bbf47a8a4b9d6d8a070add2f
SHA1 f8a105581956381f65aa31b98e1d44890c9aa03f
SHA512 909fd2afd340cbb1adc0105e611ab413e6e0660c1600966a6ad91250e08af5fd6aa53208c127856261f22ea744ced7b1b6383655afa8d6be70efe8f641cbfe01
MD5 SHA1 SHA512

Submit Download

~test.test

Path /data/data/com.services.systemdata/cache/~test.test
Size 4B
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/data/com.services.systemdata/databases/google_app_measurement_local.db
Size 16KB
SHA256 0a7d78cb869d0bc923e67dcf88143676027cc833221d92d57dd4ca5ffd230620
MD5 cc53b2bb1be1c042350d3bf0efb1579b
SHA1 36914e2c6e64190392042e522617776f9ab9e7e5
SHA512 e3effa109f21735508b9460e44b995c5517ae60c979c2b97ea8713b4c88ab81bcf891c03616bb892aec0c5329c336ea11d1c359e731ac1cf54bdac679733669f
SSDEEP 12:TL6EQ97LzmzsRmBEyPbP/DvJ+/0Fl6ogb/L:TLOxHmz3GSP/DvJlF4f
TLSH
T13C72ABCC9E10E603E127033A20CB93D21E38610E4373960B3A2008689D532C8B112F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.services.systemdata/databases/google_app_measurement_local.db
Size 16KB
SHA256 2fedea52619be3455caa7895bc7fbc518e5fb47b3cf785be5ecb303f1b778078
MD5 875abba3f779495fe27d32208925322a
SHA1 ceb4b8d860711618b16f4015e458e73e954e505c
SHA512 fb751ab2ad24aada2e6c4d8099236a261978edf1e4ae9eb6dedcd31e77a4083fced50fae3a6d7fdae2f85a832c1ab0044e82fdd1555b88a52166d152b0afff9b
SSDEEP 12:TL6UET7LzmzsRmBEyPbP/h1V49blqYFluGbvJ+/0Fl6ogb/L:TL63Hmz3GSP/h1V499F7vJlF4f
TLSH
T1E2728BA9FA24E613E227073D20C7E3C2293C301B0763D6063A154E2C5C83384A021F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.services.systemdata/databases/google_app_measurement_local.db
Size 16KB
SHA256 8b493a336f690b4f030a7d2711355b870173d02880d0fbf1e9598ccb25df28f5
MD5 c2d17347a08c2c2043b1594671e56ed3
SHA1 f10135caec5274ae00840711236e19a91c209ea3
SHA512 f0ab9998b21439a853c3744dc306f24d3e1772a843edcffb7bce0dee2a03e0b4a4f1b236e6a399ee6e68ffc57e1c02ad2cd583a57b9586f52b4577ea2aa2daeb
SSDEEP 12:TLUEe97LzmzsRmBEyPbP/LVPNAiOLauK/6AUvkWlU7e49blqYFluGbvJ+/0Fl6oM:TLYHmz3GSP/LpXKary5tT499F7vJlF4f
TLSH
T15A7224A9BA28DA12F2770B3D11C7E3D62A3831670763E2123D165F2C6C933849131B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.services.systemdata/databases/google_app_measurement_local.db
Size 16KB
SHA256 874f7578b5121d4c20d05102f566db73f9ea1b19d53b508a49723f60bd390f91
MD5 962c3b917fc6aac6b9954921c3a4a947
SHA1 71a83bdb89285e61219084c49bb4187a9ea4e2f2
SHA512 f322d53a62dcd6c4f5543df2471e9cf7285770b72a2df675896ecc2aacd7b31e96e4ac49c7621c8eadb6094592c6209701b19db49634dd9a090dfd2acbb9e133
SSDEEP 24:TL0VHmz3GSP/4tXKary5tT499F7vJlF41:TMGKSP/4t6aryz05j141
TLSH
T173722FA9BA28EA12F23B0B3D61C7E2D6293831670363E2127E125F2C6C933C49121B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.services.systemdata/databases/google_app_measurement_local.db
Size 16KB
SHA256 4bde1ca1e2485beaa00e15141df9ece2e9f402915b8e154b7d92294d2d3a1e14
MD5 175b71f8c3eb074d64b6eed1e9e21d6f
SHA1 dce0bbf3f327b40cf372042d10e0c75f104df368
SHA512 ff320ae691899d41de05e6d85b28519b1f4bc3ed6feb76b88e810f39fdd5838debb5287e2c6bc786315448e6961e9496b942f978f1c08b6ace0993730355e91f
SSDEEP 6:l9bNFlgls1iP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/Wy:TLuEi7LzmzsRmBEyPbP/W
TLSH
T11372268D8F106216C1270377B4CA53955F28951E8377AA472A740874BE53198F0A1F64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.services.systemdata/databases/google_app_measurement_local.db
Size 16KB
SHA256 60c0ccd987453f89ea3bc04d13e34c99f1fc4bcc4aee97c34e524d22f319b182
MD5 d5d65a0b4c6e6db83f30d16e24a0d306
SHA1 a768e9b3d93efae0ef42a9bdb203be9f2ee824d4
SHA512 b94841e2c87dfc2383e0adfe8bac6a5813a9faad61edbe953f4e953828cdeeba631ed0dc45e698dd680ccefc3fa6930f53483dcbc26149a3a6f26f9badcd1ef5
SSDEEP 6:l9bNFleLIls19P0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOwVQ:TLDE97LzmzsRmBEyPbBvOwVQ
TLSH
T1BC72D8CD8F10A716C5170337608AD3955F78951E83679647266408646E52198B051E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download