d5ad0e81226591eed3db70488553b6c76bf67bc338cb1982c496622e71f3eeb4

Analysis

max time kernel
135s
max time network
155s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
07/09/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1win-agent.apk
Size 9.0MB
Sample260907-pterfavwbs
SHA256 d5ad0e81226591eed3db70488553b6c76bf67bc338cb1982c496622e71f3eeb4
MD5 b89c8292987007bd07bdfcaa1cdaaea5
SHA1 f0693448ee9f661c89c97dcdb304eaffc8d64d4d
SHA512 50c88b2a57d79d43f6cd2c9b942ebbd7fa095730305bf373667d41d4e957c4f445da9a777d2076f61eec3fdacf5a0b838be3ebaf4801300bda4c66baf0ed320c
SSDEEP 196608:tGKwa0WDNc0TgDI7Jqk79a19GOqKuoIuKYv:wKw2jTgDIoD/GO7rIuV
TLSH
T103962341FA98ED1FC433C03309A61776824A9E56CA06D7976518739C7CFBED84E86BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	win.sunpay.lol

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	win.sunpay.lol

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	win.sunpay.lol

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	win.sunpay.lol

win.sunpay.lol
1⤵
- Obtains sensitive information copied to the device clipboard
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4799

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

app.log

Path /data/data/win.sunpay.lol/cache/debug-logs/app.log
Size 311B
SHA256 8b9e00250566fc20e771025fe24562ea71f65e79bd399e1164f290edc267dc0d
MD5 83d4e816562423c9ebd0582e45e018e0
SHA1 d4e83179715c42e1b35bfd487961eb65566c81fd
SHA512 e7e4cb1e03cf20ee8b7d44a7dc22ea3ecaa974b234c536de1ebe30b3e9ebd1369e78d71b954c71c98c5f29099483b1a2adab5cba02908477afd47a6791543457
TLSH
T10EE0A71E62EB57F399DB4010B828406D28117D7C3B966355E52AD7450A1630D02C3811
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/win.sunpay.lol/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/win.sunpay.lol/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 af3ae067c370720158807564be8cc85ea76c0464c5489cd632a4f25119067d00
MD5 b73d3aa0b2b1c80c43c4d8c7d55a302b
SHA1 a39438556fc9e7a7a86237f82ec9237107ebabd8
SHA512 056ff9c74d61a1588132aa8b33d2e57bd28c12a66cbf2a2c2356f21d02b6c1bd2f74b8b6e2d80362f1c892d88d93f77af1988e163f080349c3110522ff022ff9
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/win.sunpay.lol/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/win.sunpay.lol/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 4c1d4be09ab9546897ff37986098776eab7973e4cb7255894ea04377dd824e89
MD5 9c7c3223f51652da7d3523f7104e4fb2
SHA1 55e2027db4367524a87bcd3eb1523bb52ff4de9d
SHA512 35a5e4add7e5348cead113f7600bb10c430f823c9bfe0d8f81ca2f644b97afe43025edde42640f51ad23b26c399a6afb5646d2d25035673110d017c42af27d06
SSDEEP 6:KEtBssisd2V9FZde/kPlOERX4PBX4ogLugMBX4suuK+/iQ0uzFn2AzF9qOw2:KEtBssiqWzdeWRmBEyPbP/irYnV9qOw2
TLSH
T1D572C254A3820993C52842F260D8C306BEA817386352D71BBDB1045A2C0268CF491E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/win.sunpay.lol/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 1a32350084e8669cbc85d73ded60e5ea8d5bc16f5bd42b7e67d20049cd784e1d
MD5 5ab71ca248061d6959c3de508df1f426
SHA1 1deedb09c878d3ba96e48bd75c501ca7c79720a0
SHA512 cf97e038c09963074b7667e2ceef0f4ed1ea5e8f7686a03ca792db3d189e143f77afe479fe8ca29492f90eb4f29c57015e9ec8e9debaef8b788c9e36fc999719
SSDEEP 192:ljqljlOtidjnfWzzb83zS2de+ZD86u0ED:5jtidjnfWzzb83zS2dhZD86u0ED
TLSH
T19AC3F08E0F5A2640C0AD54F1E5D00BF1BD7E423E97A3F3D179910075ADD2925DA29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads