4a40103e62dc47f499cc05423118737f4e9a98850ccf7b408f677fe7468e59e0

Analysis

max time kernel
46s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
05/09/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
maxludo.apk
Size 7.0MB
Sample260905-pnngdsvbka
SHA256 4a40103e62dc47f499cc05423118737f4e9a98850ccf7b408f677fe7468e59e0
MD5 f8ffc71b10598a710334b9cab5bafb13
SHA1 7015c68cc939094f599d4c41a3fff9fb9afb20e9
SHA512 046575a74a4bbe6cd48600cd29d18ad9a0677c3e24fa86d177d63eb75f464d17ac555caae57d403ff819a9670d1a016b93af048cf5dd2bea33e7b8ccc5cf218a
SSDEEP 196608:3R5OeC8AsjtmEtvjJCpXmHByhVbiLS6nR:vOKRtRvj0aBIVbiLv
TLSH
T10F760185FB58E52BC47BB03606AA6722514B4D5A8E83E74369483E4C6CB79D40F4EFCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.MaxLudo

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.MaxLudo

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.MaxLudo

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.MaxLudo

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.MaxLudo

com.MaxLudo
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4879
- logcat -c
  2⤵
  PID:4916
- logcat
  2⤵
  PID:4934

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.InstanceId.properties

Path /data/data/com.MaxLudo/no_backup/com.google.InstanceId.properties
Size 2KB
SHA256 d30738967cbc2f3b5a09aec2484375b53f164fb2dfa5c9d4d3a9d1cdec60863c
MD5 9dd9f266ddd939495317f4466ab66f27
SHA1 1a633ec833b1b5da0baf85a46b11870fc3cbdf7f
SHA512 0d5cc8301df6a4c2540ac895bcfbc3aef5d978653b156b0ee248cf756a7a0c83c38eea2d4eb3f03b238cda7498302e2d5794e6287df6ce5685cc6b9a7c2b5b97
TLSH
T11A411AD04A703EC48B71A30D8F5A9457C09E57BB4B7BA0D2C789A89216F6094B27B116
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads