Analysis
- max time kernel
141s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
05/10/2026, 18:26
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Paragraph-Android-1.4.1.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Paragraph-Android-1.4.1.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Paragraph-Android-1.4.1.apk
Resource
android-x64-arm64-20260325-en
3 signatures
150 seconds
General
- Target Paragraph-Android-1.4.1.apk
- Size 80KB
- Sample261005-w3mlzazdph
- SHA256 4ca6464b56e61703852756b40e0c9889d530d7e92f7ec612507774ffb2839038
- MD5 1ad58e7ade23f08824046735ab5c369f
- SHA1 95c68fbc1896197cc1719f829e9998a48192e6b9
- SHA512 5a478852e9bcebd2424f056ea125a1341a9d025140951bf128daa620ef7715c64f967d7ba61e48eca4d5232de0004f28599ea35be27c6197e3ad6be9223f6a04
- SSDEEP 1536:JlTEEkKtbV0tuE4yuJQqvhDcH/8NUYY9WeLRAK9wafSWD8T:HsKHyluJQmcHBYYnLeK9waabT
- TLSH T17A83022F573984CDCC6DB1399C593BCEC21365A44BA1982D0B38C1A8AFC5BEA897F505
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener chat.paragraf.android - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone chat.paragraf.android - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver chat.paragraf.android - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo chat.paragraf.android - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo chat.paragraf.android