2dd15f8312c79175c30a4a0f568446254035c8a3cd76519464a60b1c87bae583

Resubmissions

08/09/2026, 15:51

260908-tay37atepc7

08/09/2026, 15:03

260908-se3fqssgla7

08/09/2026, 10:25

260908-mf4gjaxtcs7

Analysis

user interaction
yes
max time kernel
68s
max time network
287s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
08/09/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PAAC (2).apk
Size 12.7MB
Sample260908-se3fqssgla
SHA256 2dd15f8312c79175c30a4a0f568446254035c8a3cd76519464a60b1c87bae583
MD5 035ef918c68caa71ceed8ef33e5e3c09
SHA1 94d1300c7ed250eff822794f21db29f58d417e66
SHA512 ac38b825331ee101275c8eb002c5b372667ae693ffc6d07d7036c29f6c65208ff9aa514424936d0333065fceb8817fbab6430cf34af92bffe643897963fe5ece
SSDEEP 393216:9fT3iAtyID8UaPOrCdRRcI2yHPP+/1rNE1qC86w2:xLiTm8UaPtd12yGX2
TLSH
T17FD6235DABA9D83DFDE7413D0B76166612029C72C3A346C7A620706C287F9D48B44EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	iade.wkyoao.xbedrzp

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	iade.wkyoao.xbedrzp

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	iade.wkyoao.xbedrzp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	iade.wkyoao.xbedrzp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	iade.wkyoao.xbedrzp

iade.wkyoao.xbedrzp
1⤵
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
- Checks CPU information
- Checks memory information
PID:4803