Analysis
- max time kernel
135s - max time network
153s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
05/09/2026, 12:28
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
maxludo.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
maxludo.apk
Resource
android-x64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
maxludo.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target maxludo.apk
- Size 7.0MB
- Sample260905-pnngdsvbka
- SHA256 4a40103e62dc47f499cc05423118737f4e9a98850ccf7b408f677fe7468e59e0
- MD5 f8ffc71b10598a710334b9cab5bafb13
- SHA1 7015c68cc939094f599d4c41a3fff9fb9afb20e9
- SHA512 046575a74a4bbe6cd48600cd29d18ad9a0677c3e24fa86d177d63eb75f464d17ac555caae57d403ff819a9670d1a016b93af048cf5dd2bea33e7b8ccc5cf218a
- SSDEEP 196608:3R5OeC8AsjtmEtvjJCpXmHByhVbiLS6nR:vOKRtRvj0aBIVbiLv
- TLSH T10F760185FB58E52BC47BB03606AA6722514B4D5A8E83E74369483E4C6CB79D40F4EFCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.MaxLudo - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.MaxLudo - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.MaxLudo - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.MaxLudo - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.MaxLudo - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.MaxLudo - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.MaxLudo
Processes
-
com.MaxLudo1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5054
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.MaxLudo/no_backup/com.google.InstanceId.properties
- Size 2KB
- SHA256 676302008841950516a9a8106c2c4ba973a3fa7c5b51b12f49f229e856580707
- MD5 07fcac04fe92c2b66ef4d6e5e87cbb60
- SHA1 968f5f85b0e7101f2b305a3b23ea74b99eb68dc4
- SHA512 9a420df38775951074a46684115bbcd2d57025a36654fc2950dc8f1bff1b6c9f041ed01a6e636d2fd7675d11e8159d2f584f81378f481d6cf29dc8efee6db221
- TLSH T1D3413AEB2A5B50BF5796FCC4CDA6D2622C357DB99740D40E73DC1DE5141080073721D8
- MD5 SHA1 SHA512 TLSH