Analysis
- max time kernel
22s - max time network
85s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
10/09/2026, 06:33
Static task
static1
Behavioral task
behavioral1
Sample
Z.AI-Chat-v3.3.1-release.apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral2
Sample
Z.AI-Chat-v3.3.1-release.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
Z.AI-Chat-v3.3.1-release.apk
Resource
android-33-x64-arm64-20260708-en
Behavioral task
behavioral4
Sample
Z.AI-Chat-v3.3.1-release.apk
Resource
android-34-x64-arm64-20260325.1-en
Behavioral task
behavioral5
Sample
Z.AI-Chat-v3.3.1-release.apk
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral6
Sample
Z.AI-Chat-v3.3.1-release.apk
Resource
android-x86-arm-20260325-en
General
- Target Z.AI-Chat-v3.3.1-release.apk
- Size 18.7MB
- Sample260910-hblcyasthz
- SHA256 b3b42a2227ec6fc462ffc98a1c38f7ea7512382e09bebb3be2636bf378b59f9d
- MD5 615158e0a4355d07f3eaaf7af38399c9
- SHA1 16e936558d96ad9e841cc4e6551c63f8e793d99a
- SHA512 c134bfdf582eb0711a9bc413826f115eee7b1bd7918386305ed436409242c049c2878603ee64ae3d667890680435ec550ac4e91fd10e8afc83ebeed52813cfd7
- SSDEEP 393216:3ZOFUuPXw0M8RjPlXXDv8Pg0Jm7JZ1D8StC39B6agjT0ne48:QLPPM8pPtUg0J0QD7y
- TLSH T1E5173386B3588C3ECDB691349A4E87316225EC259716E6177B80B63C3E371D18FAC7D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener ai.z.chat - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone ai.z.chat - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver ai.z.chat - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo ai.z.chat - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo ai.z.chat
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/ai.z.chat/files/profileInstalled
- Size 24B
- SHA256 1c8f2f8b9c704b015323c244f30764b954e1a105d93573c5a1be6703fef11af0
- MD5 92d0bf20aa3eb456e1323813ae996dd0
- SHA1 48ba24712339f6bbc21341ffe9ed866bc0459b12
- SHA512 53857db29ac2b4c4c867dfa58554706b7c5fc3983def757bdabb734c8da2bc9084b08bc0fe835675f7ec549eae7f5a3b5bc7cb53e33f4e9590a55e227490aed2
- MD5 SHA1 SHA512
- Path /data/data/ai.z.chat/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 6bbe24c34d9594d6b0753793900b3c51cc2d9ea0f0be4af23f2b54c181ff22d7
- MD5 268af4f6c1d39697026c13c571821ccd
- SHA1 4a99a19052e32d51c933d807bb0f9179143d3b1b
- SHA512 dc275cb80546d533f4e77bb932161981d41a5763183012e974d47edc2665699ac2b8067af13f24f36c69ed9ca172f7e0343c6b65db1304302e081042c1a86c45
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/ai.z.chat/primary.prof
- Size 1KB
- SHA256 b40365758f3c03e07183a319c5e27f421edd4534d0bfbfbda06f450ce69894c9
- MD5 0034aadfb41dedfdf00849e6ef0a9124
- SHA1 5288b90862abc0ca9f458db06fe219bfc0889462
- SHA512 0bfdccd24621965a4ebee1c5e7361412b9966dc934ea214528fac4be37208a680dcc6b55c4726749209ceefbdc0abb7f0df44a3a219af5b81e99a344cd8315cd
- TLSH T17A21EA061F5C6B94169A4DC650F60181EF7E00108CC29F67D1F37FB4A2FB64C136A5E2
- MD5 SHA1 SHA512 TLSH