03e084cbbf1841589aecdb48909d53d4e68f2887c2efc928b71aaf3d4c92e9ce

Analysis

max time kernel
53s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
04/10/2026, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gurujiclubs.apk
Size 12.6MB
Sample261004-g5lecsxtcw
SHA256 03e084cbbf1841589aecdb48909d53d4e68f2887c2efc928b71aaf3d4c92e9ce
MD5 b08e3f4f0905b5fc55b9de022aaca4ba
SHA1 2bee3241df976c332e44ce34cfd877dc35fa6598
SHA512 56cb83777b15f93323fb5197c3ee60d0ac3e20c4ae15d623efc73ccc543c1fcdaf15200c075baebf8f6520d148bb6c5c8e704dcbb9f2fce1a0b87485470c4390
SSDEEP 196608:83hJ5dcbPBhOuB+P8ARhWFfMEvKb1WQWV8fYtA4J6A4Je1g/1Ar2YKaU2nRs:8RJ5CPGAC8/fk1X9dgDoYGws
TLSH
T1C6D6124AF749E95AD4F7A33649752A22521B4C368793D7C31B09723C28F76E00F4ABD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.gurujiclubs

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gurujiclubs

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gurujiclubs

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.gurujiclubs

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gurujiclubs

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gurujiclubs

com.gurujiclubs
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Checks CPU information
- Checks memory information
PID:4728

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation3607865405930362222tmp

Path /data/data/com.gurujiclubs/files/PersistedInstallation3607865405930362222tmp
Size 570B
SHA256 3ac716698e8e0aeed690988ad1789e60b400eb5a29f9869336f2fc34d07d8784
MD5 969657f682c9d466d1e44f9bacc4d48e
SHA1 60dac4dd462ca5ea22baf302e72a0bb6e61a6614
SHA512 e9d032186b5d0672e313667ffc148e8d77e6fbba7096d71d3c746ad3ddf43ba78b862ea7d98839487dec0466133ac177de5f5a6bd28e35096359ef1b99ed2bfc
TLSH
T1D8F0964EE1304578DC15535F622D78000D15D692235A13520FF6C9708CA89B773CF5C4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation3805274720858337801tmp

Path /data/data/com.gurujiclubs/files/PersistedInstallation3805274720858337801tmp
Size 90B
SHA256 8282bd249266682a63239f33a29ec6d789ec20c53f3dab98e57cabb1d39536c7
MD5 09b3991ff8857b94cfb88cb59fcee6d2
SHA1 d611a8994db0bf60be956fb84d2703de64e32a1f
SHA512 c3e26edd35dccf3d5d4ade32093ca9a3cc09052677fec53dfe0c75d2a9871d888558ddfbaae6f52e9a0cf04f38f2a37ee1a85fb4438fc1bb7687cfda330b6d5b
TLSH
T1D0B01204D63085C18499B2061C8E91445E8114820A0EDA454B48A04048811E09283BE4
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads