2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b

Analysis

max time kernel
17s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
01/10/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
latest.apk
Size 26.3MB
Sample261001-g243aszelc
SHA256 2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b
MD5 ec4ccdd4d47fb22e04c95675749766a7
SHA1 cbaea572450a221f2f6ce318f02f89936eb54e2d
SHA512 21869cdb2a40fca9fa9ace5a1224aa52d208a26399ab2639ad9dfb28162f4c5612c16fb9ad23fde15f495a67995939cd5ed9455ab6f570b6529e438092cd7357
SSDEEP 786432:P9pMvxvIW8Vk9OoCgx8IutdK5GEa/4IT4d1lGZC4K:VSvqW8VS4WOdKwEa/vTwMZ+
TLSH
T176573356FB59E41FF4F2833A1531C9A9C001AE5A8B42D39757A8737C0D7B7C08B4AAC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.koishort.app/[email protected]	4815	com.koishort.app

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.koishort.app

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
30	api.ipify.org
32	api.ipify.org

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.koishort.app

com.koishort.app
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks memory information
PID:4815

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.koishort.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 e2ca7dc5d023581a39dbefefe3dd570613c07c8dbbd70cfed613b87c994547a3
MD5 4496436f706287e9c45cb03c075af2b9
SHA1 0a441dfda3a61df609f1d4318d23068e8e347b83
SHA512 e98073b84de6b2061d19fb31f34480b4b9450a6a8632f9327117090df5f95062beed71d457e93149cd36d09be3308ce7bdfeb8619d59bf31631459d6ff255ed6
MD5 SHA1 SHA512

Submit Download

[email protected]

Path /data/data/com.koishort.app/oat/x86_64/[email protected]
Size 345B
SHA256 d20a615ca31e8fdfa19165c520b7fbaf47717740585dc91a11f07cf678fa0145
MD5 ec02349dc54dd82e703f866d124d0299
SHA1 ad9d9a0ca374bb7fbfed3d9d7f73325ce6eedd57
SHA512 2bf8c3d03e5315c156d07ccfd131154d89ec1245db1a5426b59c3acba168d9b9ff67b360930796d8561855d1c430094db51ee997023a616ebb398de04b4a5d63
TLSH
T100E0C0A126494410CD11563427D8150333892ED23C414EA319DB0681B906CF97A0B427
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.koishort.app/primary.prof
Size 119B
SHA256 ecef7b223926399ee2159ab29d697ddc309ed9b6574e5a7bc4bf10a5d53709c0
MD5 6cf23e9036461333a4a894c79e68a2b7
SHA1 4dd48d286abcf0c8f00e1484bfc382ecdb9d3d7e
SHA512 eb626cd37e1b7e6b3f5a10ae0bf4ee069400e21ff765a0e270d056bcdc5d55c8a351a1736cfd64588a13c42496a326ea991c6d6898158877097b89cce439333f
TLSH
T117B09B7C092487054127555011D98D170A75016AAA57851D575C495E4815449E6E5151
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path /data/user/0/com.koishort.app/[email protected]
Size 701KB
SHA256 7bc2c2e87ac11b5f0c632649efce5a9fcb577e98b4cc34456579229693f9b390
MD5 8390ac51de36d4dba2e066d0a8c8e44f
SHA1 bb0e3508ca27d68c58519fd1e463be716263e583
SHA512 8d3e3883d83d36d188472ca1a0f9f940bcb563f9c2479aa6caeaba29a657bd5196b1c86c5e2a690737a743a44838e84b307a5e5faf6f7051c4dfb82fcba96b1d
SSDEEP 12288:Eoml46zWGCPi8NO10fIa7cs4/HqArYSyDM2/5tu3XY:EH46zMa8NLg6csiqArlyo2xtAXY
TLSH
T153E46B02DA865D67C8AF933D58E2034173357992EB978B17212C81F5BC436FAABD53C8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads