5ffced81041f92f0674de632bad930640eb91d00afc662c4f803ad25ebb4a137

Resubmissions

08/09/2026, 16:38

260908-t5ctfaeq2z7

08/09/2026, 16:32

260908-t18ejsgf977

Analysis

user interaction
yes
max time kernel
24s
max time network
147s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
08/09/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BBVA_Seguridad.apk
Size 4.6MB
Sample260908-t18ejsgf97
SHA256 5ffced81041f92f0674de632bad930640eb91d00afc662c4f803ad25ebb4a137
MD5 5a04f51bbb0d8eee78e63f4092821d61
SHA1 b5cf0c177228f277d31d301e026eb7f7b84fbdc1
SHA512 ac191d5cf8c989bd1df2ff0ac6d9378c7a3ad144e31b60948cc8facc9335d1c5eafba040e70a46105e3e8e9284a728842e024ca136c9956128c1b24017448481
SSDEEP 98304:oWAJ1D0mZ/RAVQ1n2mgGmg4hL9TTmRNHAvu5GJyoxHO/leWy/U:oN1D0K/qu5gG7oTqRNH100oxHzX/U
TLSH
T124363343F716F98DC4F667760B31222A8677A11CE3B3E34B96A95329045FBC4AF891C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cloudflare.sdk.v4369a85

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.cloudflare.sdk.v4369a85

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.cloudflare.sdk.v4369a85

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cloudflare.sdk.v4369a85

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cloudflare.sdk.v4369a85

com.cloudflare.sdk.v4369a85
1⤵
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
- Checks CPU information
- Checks memory information
PID:4679