ed780b1afe60dcd2c329aaceacccb099c3b799b6c6a8d0c835a7f67be92b746a

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
886s
max time network
802s
platform
android-14_x64
resource
android-34-x64-arm64-20260721-en
resource tags

arch:arm64arch:x64image:android-34-x64-arm64-20260721-enlocale:en-usos:android-14-x64system
submitted
24/09/2026, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VinReestr._1790236766796.apk
Size 10.1MB
Sample260924-3ac1dsvale
SHA256 ed780b1afe60dcd2c329aaceacccb099c3b799b6c6a8d0c835a7f67be92b746a
MD5 6140d1eb546f0672c97443e69d2b20f7
SHA1 91eb2a58b830b91f9c50a20a22bf05053eee3dba
SHA512 deab4756a8f9881aeb547a7f0654d2944dd51c62d8b29b8e2e32101702a5d9c985974a009a2266c43bfc00bc578a0adb395ecd141574d322ce5fac0e32b414c1
SSDEEP 196608:DrQx4HVqA9c7/ksnroMdQhzLErLRg2GTHCZMNxvLULdX1lusXc:ox4HVqX79cMdQhzgi2GMMNxvLguF
TLSH
T1AFB61216460C5911C83F4A3618EE4B92E3746A424F42DE3B21BDBD6B7F731D1CB817AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.swgwe.qlqvatdi

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.swgwe.qlqvatdi

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.swgwe.qlqvatdi

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.swgwe.qlqvatdi

com.swgwe.qlqvatdi
1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4352

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.4352.tmp

Path /data/data/com.swgwe.qlqvatdi/cache/oat_primary/x86_64/base.4352.tmp
Size 32KB
SHA256 a5d88d3ddafc777b4ac32b8b3c9923bd51b9bf6f1c23ada7b961605e4ad4f05d
MD5 36ac7a5fc09881fa844043d3270f9877
SHA1 d88b54dff0cea8985e5791a108ff0d7191075d2b
SHA512 d3a901227dc6be3f88dcaab388b337582cdda9aeceb0c372d3e12f25d2538de3c6823032c5bdf7bdc5111714d68601322902e36cf9ba3ffe000fabab38bf64aa
SSDEEP 768:wZ2XiIFg3EByVmDHQTJUld4PVu6HwYFO5ZZA1WFuFq2:G2tFbGIMJ+afUZZMwuQ2
TLSH
T1D9E25CAFA6228550D5FB6EF3EB9B05ECFA3F4120261B1D409861A73F9815B00AF71F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads