Analysis
- max time kernel
72s - max time network
151s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
05/09/2026, 00:18
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
qfsglobalpay.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
qfsglobalpay.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
qfsglobalpay.apk
Resource
android-x64-arm64-20260325-en
6 signatures
150 seconds
General
- Target qfsglobalpay.apk
- Size 6.9MB
- Sample260905-alsk1aba66
- SHA256 353196b2ede5221debba620d1c50843246ea7b855f96cff3f05ed6a56a9702dd
- MD5 920f8e3cf18e6fc208a84da40a3b3bc3
- SHA1 8fb24b2e68cbc533103b1539298408fc5ece1def
- SHA512 34183ed20c442818fb1f2964d419a88bbf76e008831b6a235dfa31bc39be19f64d7d814c778d38fa0a10e6119ab247a9a5990152901c5ae62d7ddfa7f9062ba8
- SSDEEP 196608:s3/DxbTS6/W27DKRo/7usBbchzaZJ+Jx9BSJ+Jxc/foO:uDxHShbRo/nBwNl/EZ
- TLSH T14076029EF7689A2FC87710B24C6A5631124B4C12978757A3696C331C38BB7E80F4DBD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
description ioc Process Accessed system property key: ro.product.model co.median.android.weerlle - Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /system_ext/framework/androidx.window.sidecar.jar 4757 co.median.android.weerlle /system_ext/framework/androidx.window.sidecar.jar 4757 co.median.android.weerlle - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener co.median.android.weerlle - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo co.median.android.weerlle - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo co.median.android.weerlle - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo co.median.android.weerlle
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/co.median.android.weerlle/files/INSTALLATION
- Size 36B
- SHA256 71890c2a9cec5cd61ead3450d677727086f07d620fdefebe90868444f6474da1
- MD5 eb4e59ccd90f313f94f250c3fc68b7d9
- SHA1 95d56fb6fc30aa2812aa79ce96ec8f19f4007325
- SHA512 cc86e008bc802e3191dcbce40b5d7da07c9b0cdd31167e712b4bcaa2054596795ec8f040ae887941bd04e29ba558807c963738765a23e44c241696d64846753a
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.weerlle/files/gonative-config/regexintext.json
- Size 1KB
- SHA256 c79dc8b564b721909d4aa6b18879f7a07af7c3b79537cea4b3f2e2239c977149
- MD5 a034137e1fa5bb19278e53da8946c9a3
- SHA1 cde24873beb9088537db4172df9b68f3593136f9
- SHA512 bec62e9680a59c3e6aaddfb737bb947a2a6e6152b65a790fa22a238465fa45a5668fa72aef979c8d6b0990a9797341f5717cfa7cd482bfadbf5487af64fca461
- TLSH T1AE410274C9290DB398C82864B26E421B3A72615B2FD6791DFB8C062C1F4C5BE69B820C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.weerlle/files/gonative-config/splashpage.json
- Size 3KB
- SHA256 f12ac425f18a4f4b2893175a13f4adeae6ae9addbd83a51a90010899de97cb1d
- MD5 be6f8c07a6898db02af9e8f6139b694f
- SHA1 7e4dfb818a7a0ebc316b4dbbc131c2cc516d64b6
- SHA512 8f9db5c528d5030a04a9c0e5b41df0bb9960862a6452206f07f3db67b56eb377c217360af54284eb1b519335621d54763e5093eb5cd383750d80ffb9f899e3a6
- TLSH T10A81C51C048185070B843B64757CB8BB9033F797B5E50CD66C2721D7E8DBAB5E481DBA
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.weerlle/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 405242d9dce3a26732fe841b076fe12400ff9be8c565f5b9f1e72fe424beb853
- MD5 dd79d703619101639bf94e9b1a0ba43e
- SHA1 82255ed8c4ad0f778f38aa7cf3e0a2f151cd4afb
- SHA512 9d6710cf6e817c710415a6a208be011a77b407ca5950dfd0f44f211db263b4d9d929c3617c208890616fbe470ee4744e70c12d001ec842dc583654e25f991637
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/co.median.android.weerlle/primary.prof
- Size 2KB
- SHA256 3370839d6cb91647e1a141eae856156b9b2663e9fbae1029738a146b72960102
- MD5 4fb3d2c67087f71498ff43f3e38332e6
- SHA1 66a9af6b5e08a547d651d7e247f05e3c90be1b42
- SHA512 989df5c8879ce58e0daf793f184a82651f42e263ddee8700a78352bc82d686656871fcafb14439dd392228c25a9340a21433a7d33f4773aae8ebbe5d541a9c6f
- TLSH T1AD41EBD326500D7456106C9D961DFCAEFED9CECB4F9EE071142C2A7D39E897312425AC
- MD5 SHA1 SHA512 TLSH
- Path /system_ext/framework/androidx.window.sidecar.jar
- Size 12KB
- SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
- MD5 bdf3529e80318eb14e53a5bf3720c10d
- SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
- SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
- SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
- TLSH T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
- MD5 SHA1 SHA512 SSDEEP TLSH