Analysis
- max time kernel
136s - max time network
153s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
27/08/2026, 10:20
Static task
static1
Behavioral task
behavioral1
Sample
Sam-Helper-No-Root.apk
Resource
android-33-x64-arm64-20260708-en
Behavioral task
behavioral2
Sample
Sam-Helper-No-Root.apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral3
Sample
Sam-Helper-No-Root.apk
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral4
Sample
screen_mode.apk
Resource
android-33-x64-arm64-20260708-en
Behavioral task
behavioral5
Sample
screen_mode.apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral6
Sample
screen_mode.apk
Resource
android-35-x64-arm64-20260325-en
General
- Target Sam-Helper-No-Root.apk
- Size 3.3MB
- Sample260827-mdk76ssgrf
- SHA256 3df336b217fc7381231eee413ea4b54b17cdbf2d72b034bdbb22c0edd4b78567
- MD5 47b541b2b93edaf3709c4a8ba7a10381
- SHA1 024a1de60d1e795ef9819061eaf831341fd0be03
- SHA512 cbcdcde8cf65fbbf965a9a14f0a4c7b4f7e8a9d655a4e625ed90341e427164a3a63aba835de72906901a875a04c8fc42a32deb29ba2e764fda00d5956b7f98e9
- SSDEEP 49152:YF03ly8zrim+kx1dD73gyILVQlLU7gtcZOpksoDRw0N6ajyGe1nOhYYl52:by8zrim+kx1dD2+6UoDRw7HFnOh92
- TLSH T1F5F5D096BB85AD2DC87B51324CAA1336739B8C168FA383576944371C2CB79D80F59FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.litebyte.samhelper/code_cache/1787826079368.dex 4760 com.litebyte.samhelper /data/user/0/com.litebyte.samhelper/code_cache/1787826079368.dex 4760 com.litebyte.samhelper - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.litebyte.samhelper - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.litebyte.samhelper - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.litebyte.samhelper
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.litebyte.samhelper/code_cache/1787826079368.dex
- Size 2KB
- SHA256 3834c792435933cd916d886f9842894316a99339a0368f7bae255b53683a515a
- MD5 b5226ede1106261e7c438744eee9a864
- SHA1 352593a2577dbaa67b26eefc1629a19cc2c9c2da
- SHA512 7e410caae4666f8473266cac4bd163f7f2093d3f2e8778b50d347eeffe3cd4ed37e0d8b84c38ae85a28b7e50a2a2db3e8661ec51b71a1d9db876e98827aef627
- TLSH T123518733AE426342E1AD617F54CBC7A0223084045941DB17ABDCB62E3DEB1E92FD769D
- MD5 SHA1 SHA512 TLSH