Analysis
- max time kernel
24s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
02/10/2026, 00:16
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
abispay-1.0.1.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
abispay-1.0.1.apk
Resource
android-x64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
abispay-1.0.1.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target abispay-1.0.1.apk
- Size 60KB
- Sample261002-ake9aayfjc
- SHA256 6f2cdb1d798b15211d3bc3d39f4036aae55550da64156f75bf3dc7abc50fa572
- MD5 1f69bd265a80f178a0b56fb834b08b0c
- SHA1 17fd4009359ae580554d858a97811ffd09bd1af9
- SHA512 35001454c9f610b6bafedaf5a998d81e0fec7af270113b5462ddb1379820a35683918bd52c9643635a677434945736c3e3ad4fbe55715e721cae12f3a150cd12
- SSDEEP 1536:bGcy9/U+kWkXl9rQPypzKHf248O6zphDkPu/uj:hyxUlWCl5CAgf6nDc
- TLSH T19D53F1A36724702AF447933002BF77B72D50E4D8A369607B256A629818FDBC461DC7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener net.aioffices.abispay - Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
description ioc Process Framework service call android.content.pm.IPackageManager.canRequestPackageInstalls net.aioffices.abispay - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone net.aioffices.abispay - Requests dangerous framework permissions 2 IoCs
description ioc Required to be able to connect to paired Bluetooth devices. android.permission.BLUETOOTH_CONNECT Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver net.aioffices.abispay - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo net.aioffices.abispay - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo net.aioffices.abispay
Processes
-
net.aioffices.abispay1⤵
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5117
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/net.aioffices.abispay/cache/abispay-update.apk
- Size 60KB
- SHA256 21e2e9fc6501efee0b4ce29f5e81955e09cc2d53a1314a3aceed8c1c13a18924
- MD5 a2b45cc89eb6bc0625e8adacff97d294
- SHA1 92178774d2ecb1ed6b7549a997c1a1656bdc7c57
- SHA512 9146458bb0c5a1098bc57112f02194c3be1757a828ba7543cb4d0d057b035224139d69b68e6212ff9497be88dd7f35df6f96631f9d64f70917c3c972f10bb61e
- SSDEEP 768:zgft4Xzwe5Od0dmdydz/UFYaiiW0NRuOl9rQP9Dgpmg9T/VyKmUpQg/YA0Li/4Wr:zg1Ocy9/U+kWkXl9rQPypz/yuF/bxr
- TLSH T16B5302FB2760311CF089E334417FA7764E64A0F443A6D426656A25B828FCED9F88C677
- MD5 SHA1 SHA512 SSDEEP TLSH