3d088eefc58b6e39fd16ecda3d4deb0cff0851b358f496aab4a58059f2319e8f

Resubmissions

26/09/2026, 10:10

260926-l7htga1cpd7

25/09/2026, 17:49

260925-weeapaga437

Analysis

max time kernel
148s
max time network
149s
platform
android-15_x64
resource
android-35-x64-arm64-20260721-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260721-enlocale:en-usos:android-15-x64system
submitted
25/09/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
photon.apk
Size 4.9MB
Sample260925-weeapaga43
SHA256 3d088eefc58b6e39fd16ecda3d4deb0cff0851b358f496aab4a58059f2319e8f
MD5 08fdfae01c6af8981c4b74f7662b9859
SHA1 9cf1e4a8c14c8d9f519b40061289f52cc38af27c
SHA512 213102ce25ae96489b88d38e569a387c2bc7c4ebbf7bdc139efbad0b7df09c0e39cba10c6f9965e6da95a53e6853c062cd2a5ca6ac142a86dbbfedf4f4cbfefa
SSDEEP 98304:9ioxIDK1gVAtz5R40Zy9bFlVH+Z6ogSElMxM1YPhFSZcI:9TxCVAtzEBbFlJSpA+I
TLSH
T18A362246EBE9E91EE9F3C33ACB35556A40468C628347D3878961723C18BB5D05E86FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	rlru.lfwlrp.vnjjchl

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	rlru.lfwlrp.vnjjchl

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	rlru.lfwlrp.vnjjchl

rlru.lfwlrp.vnjjchl
1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Checks memory information
PID:3274

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3274.tmp

Path /data/data/rlru.lfwlrp.vnjjchl/cache/oat_primary/x86_64/base.3274.tmp
Size 16KB
SHA256 42b0acb8d1c2fb8d85baa7f5408a227c49b0ef2083a451a5c437d7167d15270b
MD5 c7941213a5f3d3df269fb749ee1210aa
SHA1 bc262eed1e0fcd6f486e42c000ee3c4d62458ef1
SHA512 c1c7ac9b27764589c8ec0ed34af1c9e97122a8c6fb5eafb47ce2d515c3683d050f45c19b23a5014d1274de352c34b1380fccbad5c2749ac48666267e83e7a6db
SSDEEP 96:8TFCSaVr5IgEZwA+rnCCZ1DPnLijnB4MZ+EWT10KM5E27:KkZ5yZX+rCCr7QnSu+De7
TLSH
T16C720C3F4250A1D0C0A7B5FC4ACB0A69DAB205B1165A3E0AAC76D73F3E107148FA7BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof.bj4EDc.tmp

Path /data/misc/profiles/cur/0/rlru.lfwlrp.vnjjchl/primary.prof.bj4EDc.tmp
Size 201B
SHA256 cacfcb13137725118805a27b1b9b710e846795441594b3a9911a4756fcd90d9f
MD5 78a59fd5bcd8a659168aec602aea3216
SHA1 f23cf18ead89de9dba418ecbdb2bce4e2bbffd2a
SHA512 883f5ce99c19f762a9f74fe0d30cd280a3b12d488ce92ecd15edb6aa0549f40aac052163c29bafa2040170fc1c54b504e037555b7b917651ea1b675b0dbd346f
TLSH
T1BFD0C0139B600F04C5CEC330109109C30060C78B04A29ACF441CC40C88502C4C9B1403
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads