Resubmissions

06/10/2026, 15:17

261006-sn34macx8p7

06/10/2026, 00:27

261006-ar85yaxcph7

Analysis

  • max time kernel
    23s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20260721-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260721-enlocale:en-usos:android-10-x64system
  • submitted
    06/10/2026, 00:27

General

  • Target
    app.apk
  • Size 4.9MB
  • Sample261006-ar85yaxcph
  • SHA256 e89ea7b6c7444e8d216b521404bf2949006f96e7be0dc11077499504c96c2470
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Declares broadcast receivers with permission to handle system events 1 IoCs
  • Declares services with permission to bind to the system 2 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests dangerous framework permissions 15 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • io.ocean.life
    1⤵
    • Obtains sensitive information copied to the device clipboard
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:5074

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .payload-id

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/.payload-id
        • Size 64B
        • SHA256 35c998457e13fcac365c33b161707ab108b674848f04c972a1641733b7e5190c
        • MD5 SHA1 SHA512 TLSH

        child.apk

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/payload/child.apk
        • Size 2.7MB
        • SHA256 98893a584aaff97ac4d9ec3ccdbb86ac6f42c92bd56efaf8ea2117ca9c3f06e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        i18n-catalog.js

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/i18n-catalog.js
        • Size 69KB
        • SHA256 71b8c8d4e94f6378cfa580f9e5b5f9a6be2d6faaa86b4fbf9bee11bdaf23a4a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        i18n-runtime.js

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/i18n-runtime.js
        • Size 5KB
        • SHA256 88e7c3a649e93e2d076e84078761a64748a1558139047084132cf32dc7e9b45c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google-play.svg

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/icons/google-play.svg
        • Size 1KB
        • SHA256 8b25682204477dec055a59f72cb72574e2958196c715391b2364e4b086d314f9
        • MD5 SHA1 SHA512 TLSH

        star-outline.svg

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/icons/star-outline.svg
        • Size 278B
        • SHA256 c08437af20cb85cbd5f0a4c901f63476c2f717b37ba07ad546315ef514d317d2
        • MD5 SHA1 SHA512 TLSH

        star.svg

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/icons/star.svg
        • Size 381B
        • SHA256 513a0f450ac62c6bdc6c6cb8701896ea4ac7a82121b9e19cc52596fd7ce3b5fc
        • MD5 SHA1 SHA512 TLSH

        install-state.js

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/install-state.js
        • Size 9KB
        • SHA256 7466b2177edb95f11e6caef33be8315ad431ac52e4c17ecd84288b02dab88d2e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        shell-web-channel.js

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/shell-web-channel.js
        • Size 1KB
        • SHA256 e9d9d7ae0133cee912781e904c0f4a08f55cd393d4435d9189a146e74581298e
        • MD5 SHA1 SHA512 TLSH

        app.js

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/upgrade-template/app.js
        • Size 4KB
        • SHA256 21590da254f31b08f6c32433a5f9eae93c53bfac09655acb47a9a184372af776
        • MD5 SHA1 SHA512 SSDEEP TLSH

        i18n.js

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/upgrade-template/i18n.js
        • Size 10KB
        • SHA256 50d1c609c9e35a2cf7246e8757828ecfe45867af2f14c9a867d1da3a69720491
        • MD5 SHA1 SHA512 SSDEEP TLSH

        index.html

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/upgrade-template/index.html
        • Size 2KB
        • SHA256 4b568ab4fd8a1258d1d02ded8b4903b35a450482b726e39c54baf600b96c2bd4
        • MD5 SHA1 SHA512 TLSH

        style.css

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/upgrade-template/style.css
        • Size 10KB
        • SHA256 fe17237d9cd947f794dd6e3a197d2ea06575e7cbf0fe635fe9172238ad51dc54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vault-config.json

        • Path /data/data/io.ocean.life/cache/shell-runtime/staging/vault-config.json
        • Size 173B
        • SHA256 99a626f0c1e81e7d108c6c7f8adf2a90511e3be1969e39e19771f9488e12efa3
        • MD5 SHA1 SHA512 TLSH

        profileInstalled

        • Path /data/data/io.ocean.life/files/profileInstalled
        • Size 24B
        • SHA256 e35efb6b1e9d90ed40a4b1c58449336d68e9527bd60495f9a6da7e3898d6195b
        • MD5 SHA1 SHA512

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/io.ocean.life/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 e98527bc70d45c6b39aa054c88bf817cb0c8ecb98f83b0c93d3993eb159ac836
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/io.ocean.life/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 0cc91196dc3c2c9af8109f3ef72f95bfd52ae9a2bfaf828c429851ed0046af2c
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 0d997282344357d28566c588bfbd57f67b0b9bdf92ebbea9cc9e1b6ed5e381cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-wal
        • Size 124KB
        • SHA256 a79d24cd5d8c8a4b6f4c7801d99cd3f766ed9931a664dc95dc25f79863c8f7df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 667e3152f44796f1b86b227b478c50b2805ccecd636b590c6b6c8f65b5e04801
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/io.ocean.life/primary.prof
        • Size 1KB
        • SHA256 72d90ce739c27c515140f2ed753ef61b441fddef2c782a19c0d2239152f8e3dd
        • MD5 SHA1 SHA512 TLSH