f699c94d8e16531a47bf63d49cd65f7ae82da9463f5a826b00abcc36b45a6d39

Resubmissions

12/09/2026, 18:00

260912-wlly4sfe447

12/09/2026, 17:42

12/09/2026, 17:10

12/09/2026, 15:08

12/09/2026, 15:06

12/09/2026, 15:05

12/09/2026, 15:03

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
12s
max time network
18s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
12/09/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CleanerAI_Mobile.apk
Size 11.4MB
Sample260912-vp7vba1dnf
SHA256 f699c94d8e16531a47bf63d49cd65f7ae82da9463f5a826b00abcc36b45a6d39
MD5 3505505e14aa17915b4f74d16b6f67ae
SHA1 12f27e91dd2e2a8a5912fea13e614c5079b6213d
SHA512 a19ec6551796685aacee1ea6097a22c8ed836cd5b598bf1532c9a7c700a975b5f36b812753ab3f490a8b9bc5027c8a62fd1300f0afdaeca6b9d43779083d022e
SSDEEP 196608:Q5ti5trnfokfKH54j9NYy/4dKP1Y7rxa8FgqnHyiWHDDJv75gOxm:NwIKZQ9NY44dI+a8XHUx7qKm
TLSH
T1C3C611724A115D12C87D1A3674E2878233363ED5024296DBE1A8B5F87FF7EE1BA43760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.sync.media.hub

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.sync.media.hub

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.sync.media.hub

com.sync.media.hub
1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Checks memory information
PID:3246

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3246.tmp

Path /data/data/com.sync.media.hub/cache/oat_primary/x86_64/base.3246.tmp
Size 32KB
SHA256 9bf4c1e1d58bc472da5d58675d6d742479a06a8909741bc8a25268e667da6278
MD5 c0b2903632b9083d5184cf8b1d7488b7
SHA1 fe11ff4ee36b70d133a93c0699324bfc6a72e0dc
SHA512 c37d2a8c689a8da3eaa5f64323bef712fadaeaeb35d29163eb05d5cc85b51d7f1053254feee4908ccbd0fe826be7b34a0634d41b7fc6b1fde5c0a61e861e70f2
SSDEEP 384:0mBIMimMCCMSHcefePCUa/WLTozaFzRf+ZOkAtZoe+8eyLBrk5FDQamo+p9sUJ3o:L6hCoHc/qW6aFE2Zor8hBy+aJ+p347
TLSH
T1D6E24D7F76118490C5AB79FB4F8E05D4DB3A4291151A3D0AAC36D33EB822B14EFB2754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads