7a9331f3cfa3d8ddeb2825bcc8c95b0dc26c9c0d7022d49484f2fc5ae106b0b8

Analysis

max time kernel
86s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260721-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260721-enlocale:en-usos:android-11-x64system
submitted
24/09/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app.apk
Size 12.5MB
Sample260924-pnf3batdrf
SHA256 7a9331f3cfa3d8ddeb2825bcc8c95b0dc26c9c0d7022d49484f2fc5ae106b0b8
MD5 87c005b63c395f780c791cdd11dadb86
SHA1 f22134b38047304cc00828dbd2793e368e8a485c
SHA512 d43890a8b7a7ec71bdb59ebb489f32c53bae16158a54138d7575e2cfb8b254fe90387b5d2854e8069274f64eff0b613fa83654dc42a26e3437408c20c49b4d45
SSDEEP 393216:EEssycD6O0uSaHREV0dW7S1F2ZTQykFWYrG:VtycDSuRNg7qgZTX3YrG
TLSH
T156D61286F758992FCC7790724DAE5632114B4C958E4397977E08730C28BBAE80F99BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.webviewgold.myappname
/data/local/bin/su	com.webviewgold.myappname
/system/bin/failsafe/su	com.webviewgold.myappname
/sbin/su	com.webviewgold.myappname
/system/bin/su	com.webviewgold.myappname
/system/xbin/su	com.webviewgold.myappname
/data/local/xbin/su	com.webviewgold.myappname
/system/sd/xbin/su	com.webviewgold.myappname
/data/local/su	com.webviewgold.myappname

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.webviewgold.myappname/[email protected]	4995	com.webviewgold.myappname

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.webviewgold.myappname

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.webviewgold.myappname

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.webviewgold.myappname

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.webviewgold.myappname

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.webviewgold.myappname

com.webviewgold.myappname
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4995

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

SummaryNotificationIds.db

Path /data/data/com.webviewgold.myappname/databases/SummaryNotificationIds.db
Size 20KB
SHA256 314f20e0e49d7e9febfb7c25a5e13665ce0b305b541c89a733c90d5823f9d276
MD5 8b7f7181d6921a57f53386379535ba7d
SHA1 38eff20390c04a1b0a621f1938506f0aee04865a
SHA512 88f36cbd2867c4056140f34bd407be7d733e98760e74f1ee48e5b5ae21695a278970ff4fd3d369aa02119aa3ee6a94dc3cbb18b502bfc7f48dacd8e06600628c
SSDEEP 12:TLyKPGYuOXNr2rt0rZd8rpj++ar/artRmBEyPbAVOw:TLy3pOX1803GSE
TLSH
T164922BC7A300125AEE9E20B35067C3D15D73626D8AE3864B1BD70420AD41284E5A6E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SummaryNotificationIds.db-journal

Path /data/data/com.webviewgold.myappname/databases/SummaryNotificationIds.db-journal
Size 12KB
SHA256 5d1e85e3bb7e49a06862a5ce3e54c32450318bb753054d91c431a5fd7f3a731c
MD5 52a2f3a2043ce41abb3a77a5f94802e9
SHA1 bc62e7058d61d111bb9d986f48b02eba69769ba0
SHA512 d5c0d05f712c7d327aac2788ec824ef72f101780195ce5ecc414a9b0cda47f1f34575cbf651a532b675061f3b769e9a15318339540fc6117d9e2e7a52240375d
SSDEEP 12:7+tmEYORqLmGGYuOXNr2rt0rZd8rpj++ar/artRmBEyPbz:7+t8ORqLmpOX1803GSz
TLSH
T1AA42E5CAA7000A56EE9E20F3547783D16C3326AE85E3CA571BD60420AD022D4D5E6E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SummaryNotificationIds.db-journal

Path /data/data/com.webviewgold.myappname/databases/SummaryNotificationIds.db-journal
Size 512B
SHA256 693973cff19f390268280efff83cdc5aa90ae4a501b5d0cbf5c7df575e41507b
MD5 12390d3487fbc5e9ebb58488a7954d55
SHA1 c180be30d1745d70eb26625b4fd4688391bb6c99
SHA512 4e2d0a0eede692f2e53d1c74ff8034de44697f77c51e4756e85dfc484188ce5c9fa17b5f5918f918c95b96702ebed77fd90c166eb45a2732dd74b93d33d6de39
MD5 SHA1 SHA512

Submit Download

SummaryNotificationIds.db-journal

Path /data/data/com.webviewgold.myappname/databases/SummaryNotificationIds.db-journal
Size 8KB
SHA256 21e249f56e0b222100f9447b9b7dc07f1612dddb7c9651620b0acf50148cf9f4
MD5 c947987154ae0ad69ba08453bf3ca435
SHA1 e8d8e71030037f581f6ddbd98cfdf4cb45780e25
SHA512 9a938783618962255ba79be8ede451281f727fe2ba3baae9c741e78b0c79b572f9906edd5cdbd3e190fa2ae4afca0052846d480189068a9d83dabd0e32141447
SSDEEP 6:7+/l9bn1gg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKp:7+t4qLiuWdYRmBEyPb6
TLSH
T1E502228863C02812C82B1A77A0EA83B40E04A728CDA1CB1716D008983C0B8CCB8A0D14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SummaryNotificationIds.db-journal

Path /data/data/com.webviewgold.myappname/databases/SummaryNotificationIds.db-journal
Size 8KB
SHA256 e0a4b059508a89c493f4a59b6f1097a8335383ca8072dee9229da34ad2df567b
MD5 08c27addf485f7919ea1e5b444d0dd3f
SHA1 1a926a690d3c3506e504e7466690c51f4ba2e312
SHA512 a856f369713e8628c108a9c2efd273c557c61f2f016d6bdc309b6f6520e5b1584c4e3fa9b3a3f47d82ec3ab6cdfabaafc4ffbc1ef87868784e67a8097ac25e33
SSDEEP 6:7+/l90gPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKzns//U:7+tS4qLJdeWRmBEyPb6nsXU
TLSH
T1500222D863400803C0291F7BA0C883402E10A728A323CB071AD108542C8A6CCB898F30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.webviewgold.myappname/databases/com.google.android.datatransport.events
Size 56KB
SHA256 a0821012f4354f89af47ce7d0b169332b806ec94f994f749befa067749f71427
MD5 694c152e720462d071c58d2c6f00810e
SHA1 2aa5e8e0a8fa780c99662e9fb608f905593d8bdb
SHA512 0138ab422cbbf5f68508abc44cf0d88d12fd94a59d0869ebab8f660b412fc381fa214192a5aade518bd3ffa05adb235a1bf40d7fba88e4d84fbd78a31566d4fa
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSy0pFv4Fz:rAMEX0wIyNjayD
TLSH
T19B43339D1B3C3320C56D283ED3E143A35A7CA3DF5716937239A48CF98DC24697825959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download