3d088eefc58b6e39fd16ecda3d4deb0cff0851b358f496aab4a58059f2319e8f

Resubmissions

26/09/2026, 10:10

260926-l7htga1cpd7

25/09/2026, 17:49

260925-weeapaga437

Analysis

max time kernel
148s
max time network
153s
platform
android-14_x64
resource
android-34-x64-arm64-20260325.1-en
resource tags

arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
submitted
25/09/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
photon.apk
Size 4.9MB
Sample260925-weeapaga43
SHA256 3d088eefc58b6e39fd16ecda3d4deb0cff0851b358f496aab4a58059f2319e8f
MD5 08fdfae01c6af8981c4b74f7662b9859
SHA1 9cf1e4a8c14c8d9f519b40061289f52cc38af27c
SHA512 213102ce25ae96489b88d38e569a387c2bc7c4ebbf7bdc139efbad0b7df09c0e39cba10c6f9965e6da95a53e6853c062cd2a5ca6ac142a86dbbfedf4f4cbfefa
SSDEEP 98304:9ioxIDK1gVAtz5R40Zy9bFlVH+Z6ogSElMxM1YPhFSZcI:9TxCVAtzEBbFlJSpA+I
TLSH
T18A362246EBE9E91EE9F3C33ACB35556A40468C628347D3878961723C18BB5D05E86FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	rlru.lfwlrp.vnjjchl

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	rlru.lfwlrp.vnjjchl

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	rlru.lfwlrp.vnjjchl

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	rlru.lfwlrp.vnjjchl

rlru.lfwlrp.vnjjchl
1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4317

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.4317.tmp

Path /data/data/rlru.lfwlrp.vnjjchl/cache/oat_primary/x86_64/base.4317.tmp
Size 12KB
SHA256 1e24e7e341aad9d270436634eadd20cc1e920a30a46ff37bbe8e9078bea6598a
MD5 67aeca7fed12c1eb5556de5ad15f98e3
SHA1 4a2d4d1213ca228ce2f8b49919669cf32607e817
SHA512 2b5cafe7abd142ff9351715510c6325b6c3ed622523ed0656cbc70b666bea9e265ab8016d1b7b84b342fa00c15a2f8377e1a9adad8b6488ffd89fe374ad4471d
SSDEEP 96:JRCWEBvAnzFqabiUG1/hXWQVdbbrX1msYuQgCxGMDuEWsvj72WESaVDHE:JQlunUi81//r1msbQhQGu2arSY
TLSH
T14F42316BC9A3B1A0C0A3ECF7978B268CF66F8079060D1E5990617BBE6544302E751EE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof.bb2PdJ.tmp

Path /data/misc/profiles/cur/0/rlru.lfwlrp.vnjjchl/primary.prof.bb2PdJ.tmp
Size 253B
SHA256 cad8ee1eecd6a64e631a1c83aeca1d50de69f820932ef67344d885c5f10b04a2
MD5 3f71d9541a0cfa0e5736136484e9ff76
SHA1 052334ba50d48c7a75a2ce18218b4e38aa6c7b64
SHA512 da3937dc25a758550dec2ae3ac22915016b0a7238998f6ecc4ced0f2bd437957cfd32208f3bc001c3c34a2403a9199cc5055e73a1ecc7d0fdaf5b973622c776f
TLSH
T173D0230353643B08CC8EC634048415D38070CF87002A0ACF0528C45040A0647D538443
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads