b5c5a72af83c757834802f0082d2bf51ecabba24e201a1d63c978be75122b7ee

General

Target
pockeloan_fjifu7_N2.1.8-20260113.apk
Size 7.1MB
Sample260929-ppa8fshb49
SHA256 b5c5a72af83c757834802f0082d2bf51ecabba24e201a1d63c978be75122b7ee
MD5 930287e97fbce0b02e63a469b7690beb
SHA1 20b7092674b7a2087c2bda2cc5c45705f0f34a5b
SHA512 1dee23b17ffcdab5a6bb08b660cb46a0c9e93b5617f8c6ff19ccbdcdccbd42326318a4ebd6220faabe672b84562cf2bddbc246340de64575907ff2b99d2f6603
SSDEEP 98304:YePfFS0ovfkyoJhc3ONh/YGWH4G3yEaqH6uiQf658vauTC6SwEhrEjibRjkzfrRD:1FKn2JSeRa4G3yXu1bvLC68gGtsTuqx
TLSH
T17676019EFB5C7D2EC87F4132595AD231215A4D258A83D7C72958371CE9B36E80F88BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.pocketloan.android

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pocketloan.android

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.pocketloan.android

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.pocketloan.android

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pocketloan.android

com.pocketloan.android
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4753

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events
Size 56KB
SHA256 7b5a04983350b0ace0a8d248a193263b229e5836e8b1d710c09b48652231d22f
MD5 0a6d3c1e7aab8a04824646ae2f398372
SHA1 aa042b64be695fb78f4fa49707ee49c7ef4124d1
SHA512 89980d6186bf41e501d0c9b15325b4ba6f47cc593ebe7df6acb176fafd1bd327c2991e568ca0284fa1880f69d058b78079d0b49d82b56f5e4966b849e380167d
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSH4:rAMEX0wIyNjaY
TLSH
T16943639D5F2C2221C57E283ED7E143635B7C93DF572392623D908CF98DC246974354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 46709fa026afb31082d080a9bd104fc68af70bb872eb89c3594fcc7b8c278444
MD5 c77e91d2834e7eb5e8e6f76907212d6c
SHA1 d7f4d646c6349dad12afd1f73ee46b2debd9fae3
SHA512 73510fdbab2e7e32154c44ceeac36a8e478fb02ae213fec6689d4203486a351738e431c9bfd716bca910665391d2c98667c0ff10802ac170b606311755fb59e8
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 becfa9fb7b0f9b25ff19b871a5423513eec2e33d14670ccc297ba65137f2bf73
MD5 b3008c64d7455dc4c99237e1f6bd048e
SHA1 184b76e3fd105a0308ec2fcfa5f2240b748608e7
SHA512 ab2c21fceae3fc2c30338b1a3365a27ed2c05d880e6932caa9a2399ddb41b4ea97d03c04bd95aafa8f2a3dac39ce2860fac007f596b0aa9004f9e4d423f745d3
SSDEEP 6:7+/l9fIgn1otng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKSa:7+t9uqLiuWdYRmBEyPby
TLSH
T14A02229C63800812CA2916FB90D483840E12B72895A1CB27169008982C078CCA4A0E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 aaf6d61c486c28a3bc8aa2291606fc3621c64d0d93ce0a75c0defc23112ae50a
MD5 5d9bd178d57495f5abbec5414925daf2
SHA1 a854be5de60bb42cbeaae59c3fa95e1440bf01f1
SHA512 ff661c5838996acc2b3a41f69b927ff90f539c91488523d6f54b800640f14fb59784382aeed6a03b71c7187f41721a8c0ced14df12dd335eaaffcf74a89b1653
SSDEEP 6:7+/l9jPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKwL//w:7+tpqLJdeWRmBEyPbPw
TLSH
T1B50222CA63400C03C0391F77A0C883401E20A7289263CB6726A10994FC466CCA891D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation3159065035623230292tmp

Path /data/data/com.pocketloan.android/files/PersistedInstallation3159065035623230292tmp
Size 90B
SHA256 2606723c8b49e5311b41f877050e0b766234753ded286c0da5f99f28231085de
MD5 6a57f769ee00f058243e1ab9490b0f40
SHA1 2762d65119be9c08865042930f45b200e65ce654
SHA512 532af4b58076971947641b924a8ad36c413b3697558c10463547406588958c03241dd4831b60d45ec2eae35e9c7b1e9ca4f9f50d6f1989e620185c1b0215ba1d
TLSH
T107B012445A34817284E5B3031E8D910C2F5128810C4E8E0A4B0CD08000911D8C5039E4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation8932324541804762609tmp

Path /data/data/com.pocketloan.android/files/PersistedInstallation8932324541804762609tmp
Size 567B
SHA256 bba61a0fb5b6051ed9c9122a05ae3e75c0134b279440374238edfae13bc13696
MD5 a555bd5aaab1ae5e70492ee2c53998c7
SHA1 1c940a9f6d7343237d4a54aff70e4e09b0066afb
SHA512 de109c79a75d41d6a4a7dbc536bdb01bebdf52978857bf9cf2f1a351bc700083752e32222a2dbe802995bac3b859d64aaca17d4fc3eed4eeb49d37f9fc098935
TLSH
T147F0264025AC9568C87930826C8D2D0FCE5D15E12E2F8568AEA78C781891A6F5746A85
MD5 SHA1 SHA512 TLSH

Submit Download

behavior_log.txt

Path /data/data/com.pocketloan.android/files/behavior_log.txt
Size 68B
SHA256 23937a78fb4945db3d77989bc7019e12933e29841a40619d9d6eb985e3b64af7
MD5 605079d23aa4ae93d857bdba5cce9f71
SHA1 cb50865bb9fd79edd0e9762528f22a8d534a74f8
SHA512 ef68a038fb34e35a755c183bd7e7a0136061cb77dc1a34512f03a3cf5c4cbaedf1181a9a87516635877f6a744c8215439355bb9b2a6354cac52370dc098210d6
TLSH
T1E0A024C114F5C5343C40DC00C1C1053C4704F1C053CC1714017100C0C5C040D014DD50
MD5 SHA1 SHA512 TLSH

Submit Download

behavior_log.txt

Path /data/data/com.pocketloan.android/files/behavior_log.txt
Size 55B
SHA256 4b5254fecd699038ed7a70b2f821cc1ede1d0d73d921fe3775e5c11e988ca58a
MD5 87771d4ffabe81c575ccdfc91dba9172
SHA1 135478032a0f52c412f3bc97af361dc77f19ef04
SHA512 25638c86896fc8c5fc647766a6a111ad60d355de297758ab6aa2d5abb9f62cc67c3254b740b7bbeca29328d81334b4501ac96d739af2f6251f2ab340ea290f0e
TLSH
T1DF9002571A759C3A15416009F35CAD29900CE56817C489605A05B011161560C5483619
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads