Analysis
- max time kernel
22s - max time network
153s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
06/09/2026, 22:13
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
lexpad.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
lexpad.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
lexpad.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target lexpad.apk
- Size 6.6MB
- Sample260906-145amade48
- SHA256 d2f23ee841bc0dcb3211bc1475b80dfeff8a7747f2aa75127c4433ab900411f2
- MD5 b65705118fa8e077dfcc7d02ed62c97c
- SHA1 be567f12f25d612f4a38ec4e075fe594a80f708e
- SHA512 300789609e46dba06c25a50aee95cc6b3578b658fad3563d6d555462651c1333c7172b4370073eb7b086c5b39325e02d40ea9d8969db750fc156aff16f49faf8
- SSDEEP 196608:mQfsLV9qZC4pBUjjiztb3j6DSJ7NPaUrb8:mQfdC4s/ixb3jLno
- TLSH T198661242F7A89E5FC87741720D9B5732266A8E12C7A3E343991837797C736E80E84BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener app.lexpad.android - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone app.lexpad.android - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver app.lexpad.android - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo app.lexpad.android - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo app.lexpad.android
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/app.lexpad.android/files/profileInstalled
- Size 24B
- SHA256 c407c2af1fae46bf80627b1440f11d78ac05fa5a762c7deb18e876e18e6feaf9
- MD5 17f00942115bace25550dfd941cad184
- SHA1 ee725f02896e93694c79fb9895ea8538874c6aef
- SHA512 900e3f261073c0d7e212256fb79e6e0b2e6292c2cac759b1e5686c37e788703753f4b4f785c390753dfe73dd514c16a98774be2dbbeebcd50083406a30ebee08
- MD5 SHA1 SHA512
- Path /data/data/app.lexpad.android/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 4852c27426e91b6769a4868624d9ef104811990aca3b687829313e6987ac9b57
- MD5 59a72565ecade4a744b75c2427a676da
- SHA1 bef7aab402382cba13e568936444fa08fb447dfc
- SHA512 467977e549666880a16858d0ad09c7f2f6e469ec994019dba61e9c59be0cf3cf8b47c94b9c42ccd1cf5934194a0781ca475f31d7ae21b3a24f268757e8af8816
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/app.lexpad.android/primary.prof
- Size 2KB
- SHA256 158c3c5359da03e4b7665fae41ce95c8743b7686926507a01f2d01a3f5231994
- MD5 8eff5e72650a718867d0a92e56916450
- SHA1 2f77b230740babed5faac56d668ff2f629698efe
- SHA512 272fd6c06c38b06244b1e8764b69277825e5520f5dcba7345ce03c73eb081660ac70f5c813dc67cd6e80c015fadaf34da8a5b5349fd68603f1457bfb7c1006ef
- TLSH T1E0513A0A9D40EE81A5E2AB41E828B40DC7D1DE8EAF42D831FA595F2B0407F5837E15CD
- MD5 SHA1 SHA512 TLSH