Analysis
- max time kernel
46s - max time network
153s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
27/08/2026, 18:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Liveludo.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Liveludo.apk
Resource
android-x64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
Liveludo.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target Liveludo.apk
- Size 7.4MB
- Sample260827-wr668scl91
- SHA256 48e4bd0aab29babee5c1b18a2085e7990b5018112c8aaa53f685a3a04e6890c7
- MD5 a5c5b3306ef5307f1d1fb4fa0afe8f93
- SHA1 adf06c28bd578cc621e172e1f5944d237ff0b77a
- SHA512 1ec60e711e1065b37a231ed0cdbd4ea93d72134afbfc82c7b01563a5846a78b8dcc6651d592de65a4f275c1b38ea10cfd2983f0417821ca086647805a2a1d040
- SSDEEP 196608:AWRakzmRC8AsjtmEtvjJCpXmHByhVbizI/:haYm9RtRvj0aBIVbizI/
- TLSH T148760285FB58E92BC47B703605AA9732558B4D068F83974369487E4C68BB9D80F4EFCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.Liveludo - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.Liveludo - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.Liveludo - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.Liveludo - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.Liveludo - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.Liveludo - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.Liveludo
Processes
-
com.Liveludo1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5062 -
logcat2⤵PID:5168
-
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.Liveludo/no_backup/com.google.InstanceId.properties
- Size 2KB
- SHA256 dcbb7bb012badc7503a0a676fc64c37e7d82aa7e3f6a4a21935453350a564950
- MD5 8ef3480de8ab3b20bc49d3964bfc96fb
- SHA1 e6a071c786cd5341f4b6f097a962f682cab4677b
- SHA512 4b031859bf7c187d23c9dbc61071d17521b55e4b96524a7d96451912a031a5f7d05b3ba9b6618a6c49939c9283753c6e970ca282d205253debe71df50c8b58e4
- TLSH T1AE411C934A0ABCA242399787FDEB03F625A851E02EC28164B4B714405011ACCFB74B6A
- MD5 SHA1 SHA512 TLSH