Analysis
- max time kernel
46s - max time network
153s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
30/09/2026, 00:18
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
app.apk
Resource
android-x86-arm-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
app.apk
Resource
android-x64-20260325-en
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
app.apk
Resource
android-x64-arm64-20260325-en
6 signatures
150 seconds
General
- Target app.apk
- Size 5.5MB
- Sample260930-al4y2aae68
- SHA256 1f2002943779ced887651c82d516732ffad9ff278c4fb079c0a81fad73ae1449
- MD5 c7995c9e7e2ffa92726ca18869888d22
- SHA1 21d9a8a9fa8811ab11200f2446c86aa1c3267c6b
- SHA512 a2adfe2c63b9971f4efa2f821cfe28ba422ff935543556d545f93b3f91b5f1e1b794b1dca74996e453e11e8ffb3811c44261af0d551da6a6ca6af32a5ab55e97
- SSDEEP 98304:Uzv1E/SbwnzgGuRMNGYKw2bV0wnoJor/dk9UOIoCn6qleP/f23V1iCOkp5:Uz1E/qwWqNH2VPoJojdEUOx5COO
- TLSH T11D463355474F443EDA0AC6F9BCB6C20B4F5CE6AD25E8F204CF594F80EEB81651A82D6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener io.superdeltaserver4237 - Declares services with permission to bind to the system 2 IoCs
description ioc Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone io.superdeltaserver4237 - Requests dangerous framework permissions 15 IoCs
description ioc Allows an app to post notifications. android.permission.POST_NOTIFICATIONS Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to receive WAP push messages. android.permission.RECEIVE_WAP_PUSH Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application a broad access to external storage in scoped storage. android.permission.MANAGE_EXTERNAL_STORAGE Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM Required to be able to access the camera device. android.permission.CAMERA Allows an application to record audio. android.permission.RECORD_AUDIO - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver io.superdeltaserver4237 - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal io.superdeltaserver4237 - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo io.superdeltaserver4237 - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo io.superdeltaserver4237
Processes
-
io.superdeltaserver42371⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5054
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/io.superdeltaserver4237/cache/_t.apk
- Size 5.3MB
- SHA256 3a68b8a4b79ebcd41d18f1e20097fb1acee8322fcfae7c76ee3a01211fb322d5
- MD5 89a9e4b356d273339c5ba0888f9b0455
- SHA1 88d912fc5c0b37e9ad2287499c35cc75e37feeb5
- SHA512 565607d348fc1b4e5387a695dfd5617dc1ab09de820d681790a3daad14dc2c3eb652357861a534fbf34b863a09cc7bfec88105f4d46cbc1ba232b6a25b62eb5d
- SSDEEP 98304:Z4GNjNU86oVVYK/zZZXJoPJfDgckIcAXZSZ1llU+ytFAB0pNcCM9i5eSiy:Z7RUgVVYK/vqPJfmXgrpFAScCM9isSiy
- TLSH T1E04633E66464CD1EEB7C22B3E4A8C74896FB954F727C0B30865047B4981DF9B4E603AD
- MD5 SHA1 SHA512 SSDEEP TLSH