5ccfa27512646c59fb2d25a0c6e00847970332d76a4c37789b79a05f9115527b

Analysis

max time kernel
143s
max time network
153s
platform
android-13_x64
resource
android-33-x64-arm64-20260708-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
submitted
03/10/2026, 07:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app-universal-release.apk
Size 496.5MB
Sample261003-jvqbnstdke
SHA256 5ccfa27512646c59fb2d25a0c6e00847970332d76a4c37789b79a05f9115527b
MD5 58e16a0d6a4e1663efeaa2b1d37de2b0
SHA1 8ca6553ea5402ff4f139d5ff3562aa8ed0001005
SHA512 e4c96099792356d77fc185b26725c0f3b1feab7c8318168f55fe5054d1cf389e21e0ef812750642e206d1c137e1de3dd2ff4bf938bd8403fc3527cfe2fbc366a
SSDEEP 12582912:Pn9qiWUD/jBKS7OpJBM/FE3z4dRqpXhkf+RIfDj3tMQx9f5:P9NvTjnCKAzSkPe++DjWQj5
TLSH
T10C49334AF322AD2BF93710770E736236C24B4C219B4297BBB6693749957B2E08F153C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.extensions.jar	4157	com.emerald.legacy
/system_ext/framework/androidx.window.extensions.jar	4157	com.emerald.legacy
/system_ext/framework/androidx.window.sidecar.jar	4157	com.emerald.legacy
/system_ext/framework/androidx.window.sidecar.jar	4157	com.emerald.legacy

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.emerald.legacy

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.emerald.legacy

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.emerald.legacy

com.emerald.legacy
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4157

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

primary.prof

Path /data/misc/profiles/cur/0/com.emerald.legacy/primary.prof
Size 1KB
SHA256 76828946695b88b9a19bf9cf9b9f608748d3e6b3df36527205e7f47d71b64be3
MD5 eea4fd06889129806fe7eaa7130d6782
SHA1 0747ee43f850d20fd50776c74bc8f45efeebca0f
SHA512 c35312c2006ebe882de107faf4a269a5f3b5f2f649918ac61d847947ef3ac2bb190a5bdf2dd865b74b9f827cb89cc1fe1aa56191b456a90bb1d2c60544d1fe52
TLSH
T1C3310689C0ED42A7D883893985478F02817C84468A2B723399C1DB32D258EA1D84E5B6
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.emerald.legacy/primary.prof
Size 4KB
SHA256 c13e4be8b87acfebc26bfdcc92127188f4e5c5ff7f9906a7636f6b2998c539ee
MD5 6b2189fa849e6a1053c7466af0de4a76
SHA1 4acb316d2eb06ebb9516417e6902b37234b81bc3
SHA512 ef0ca45a665b14c339ef4ab7093a6aa2671fe42ddf25dbbaf5914f615933bcdddbe08dcda91b1d5674977a7504911f57283d2417febdca278ffc1f53b7ccb4cc
SSDEEP 96:MSKiTCGYXPcgDLNDOenW7cQluQqVRn6uyf2WHBPe0A4pZ9zmBMgrQAqGlom:PBTCtXPcgdD5W7EKp2WHLjNmBMoFJom
TLSH
T1F3919FBBCCDBA1AAD779413176E97C9D44DECE5330C857D01849CB7B2153006AA438D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/user/0/com.emerald.legacy/files/profileInstalled
Size 24B
SHA256 acd73c07b3d4de6f725f48107b0818664b8158c1da1bde7d15296329151123bf
MD5 362958bee6f5b9df817bc3af89dfc782
SHA1 6157c17e68171f083093b13a22efa2bbbde544ca
SHA512 769c04a42c8d42040d24b745947e52630e4c2e54663a6365e31cf2201b49e93eb86606d441bf1849694f5e2cecd59b756c52b1948e7967ea7985ad2f884318aa
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/user/0/com.emerald.legacy/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 5ce292d5828f1f6a62dc6a965cbb902da85a99e5fafc9e386cce5e1d5c0a2f41
MD5 00d5312272c43911ba662b02b4cbf150
SHA1 7ce8f1dd74dcf10e2cba24e88023a07cb2d6429f
SHA512 de0886d6e7dc4d8de6e575e7014d50d71d7666a3a349936a90b2192f37d78b7ffca25eb0361c1e1bed0a458eb1acffa90855acbc642a96fe9f0d9b12e1e2838d
MD5 SHA1 SHA512

Submit Download

androidx.window.extensions.jar

Path /system_ext/framework/androidx.window.extensions.jar
Size 123KB
SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
MD5 3056e1bdb7d4e19789d0319eff484bd0
SHA1 6791ae47aa9466fe0bca27ad6643f846853bbee4
SHA512 c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658
SSDEEP 3072:8Pmsa8v0v8FYNMhpjLXZ/pziNQdysk4p26PQ:Qmsa8vXhRLXXOQGJ
TLSH
T19DC31951FA4159A1DEAE933B959B1301AB30A648AB2383137654D0BCFCD73C39F87AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 25KB
SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
MD5 29469324e59dfcc052f24b5af4e7b2c4
SHA1 10c1e17ac6f598037bb51baa07945663645de4eb
SHA512 5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2
SSDEEP 768:bjydnTmp8WNAupUuvkg5NrtsESOMXIpc3dRwQA0:bjydCpF0uhtsxOQIqdSj0
TLSH
T1A5C2F716E7400C63E9FF9A3B6A5B13009F35E3A4AA43471B640585A4BDC63D3D9EE7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads