ed780b1afe60dcd2c329aaceacccb099c3b799b6c6a8d0c835a7f67be92b746a

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
540s
max time network
901s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
24/09/2026, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VinReestr._1790236766796.apk
Size 10.1MB
Sample260924-3ac1dsvale
SHA256 ed780b1afe60dcd2c329aaceacccb099c3b799b6c6a8d0c835a7f67be92b746a
MD5 6140d1eb546f0672c97443e69d2b20f7
SHA1 91eb2a58b830b91f9c50a20a22bf05053eee3dba
SHA512 deab4756a8f9881aeb547a7f0654d2944dd51c62d8b29b8e2e32101702a5d9c985974a009a2266c43bfc00bc578a0adb395ecd141574d322ce5fac0e32b414c1
SSDEEP 196608:DrQx4HVqA9c7/ksnroMdQhzLErLRg2GTHCZMNxvLULdX1lusXc:ox4HVqX79cMdQhzgi2GMMNxvLguF
TLSH
T1AFB61216460C5911C83F4A3618EE4B92E3746A424F42DE3B21BDBD6B7F731D1CB817AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.swgwe.qlqvatdi

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.swgwe.qlqvatdi

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.swgwe.qlqvatdi

com.swgwe.qlqvatdi
1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Checks memory information
PID:3300

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3300.tmp

Path /data/data/com.swgwe.qlqvatdi/cache/oat_primary/x86_64/base.3300.tmp
Size 32KB
SHA256 8c8355cb35a50b6c014e3fa853f41d54b1efcc46eac3075a09e3d78ed0e8c9bd
MD5 bbcb8b0363c8fde8d5c982e4b4b74ec2
SHA1 d0957b12fa907a295266dd3ba44b5ccbe43012cc
SHA512 21b681170c12c7fe7e66bc0ebcb517f024f38d6ccb863a7287cd7d85f88372c877f0318b4a76f59a249c567696cb055859e164f093803846738399449d1e739f
SSDEEP 768:VsT75p7NFF0ETtu/FEzcNpX3k3wAJ1JZdQs0u5kC:Vs/n90nazWp0p7JZdF0u5
TLSH
T1A0E25C7FA6214491C4EB79FB86DB04B5EF7B41A021162D06AC76D33EB920B045FB6F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads