Analysis
- max time kernel
23s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260721-en - resource tags
arch:x64arch:x86image:android-x64-20260721-enlocale:en-usos:android-10-x64system - submitted
06/10/2026, 00:27
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
app.apk
Resource
android-x86-arm-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
app.apk
Resource
android-x64-20260721-en
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
app.apk
Resource
android-x64-arm64-20260325-en
6 signatures
150 seconds
General
- Target app.apk
- Size 4.9MB
- Sample261006-ar85yaxcph
- SHA256 e89ea7b6c7444e8d216b521404bf2949006f96e7be0dc11077499504c96c2470
- MD5 87d2495b4b653140c37bd844e281b326
- SHA1 56e684847f4bcf49bb670dbf12905c5c84aa8999
- SHA512 036c365ff5b0a4970e6067a4e5fa47694e6efb52f981f18d8ce13c39f8329b3ca010bd2166b82bf6ea7614e128aaf66902445a82f02bb1d4e192ab4d77197863
- SSDEEP 98304:EvM6OI6cZCyLaquelbh3cv+9R6gU4i73IPlTPBE9IL2HmLW1nDT6UmPvza:9PT/yvuem+94gVC3UTPBEOiV67za
- TLSH T1093601617F8CC83ACD37913499AF22923E4B5D60C8A2665FB440366D38F37D44ED9E98
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener io.ocean.life - Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN - Declares services with permission to bind to the system 2 IoCs
description ioc Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone io.ocean.life - Requests dangerous framework permissions 15 IoCs
description ioc Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application a broad access to external storage in scoped storage. android.permission.MANAGE_EXTERNAL_STORAGE Allows an application to read image files from external storage. android.permission.READ_MEDIA_IMAGES Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker. android.permission.READ_MEDIA_VISUAL_USER_SELECTED Allows an app to post notifications. android.permission.POST_NOTIFICATIONS Required to be able to access the camera device. android.permission.CAMERA Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows an app to turn on the screen on, e.g. with PowerManager.ACQUIRE_CAUSES_WAKEUP. android.permission.TURN_SCREEN_ON Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver io.ocean.life - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo io.ocean.life - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo io.ocean.life
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/.payload-id
- Size 64B
- SHA256 35c998457e13fcac365c33b161707ab108b674848f04c972a1641733b7e5190c
- MD5 5939b7948b7730794bb77898afa29888
- SHA1 6bef6858a4ad4b5f7237e677e06e351e78afd954
- SHA512 9491c8450e4aad4ba603971f01caf0b98b963b99f79db25a180137de5061dbfe2fd0743286bcb99a5d7e9ee4fa92fa74c740e1818ef973fcfd8c28e1419a14ed
- TLSH T145A02200808BE80F00230A0323CC0002033E300300EBC0832CF800830F02AEBEE30A80
- MD5 SHA1 SHA512 TLSH
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/payload/child.apk
- Size 2.7MB
- SHA256 98893a584aaff97ac4d9ec3ccdbb86ac6f42c92bd56efaf8ea2117ca9c3f06e6
- MD5 6e59ee8df7e645cfb57b39eb508ea7d5
- SHA1 333e08a8479f9dffb6d287c962ffd95f1947fc8d
- SHA512 fd725df066a7b97abbc249934454367f0d308f3c67ec1f3acb97f44f76c7323ca46126f98c9734b04a218fa0cc84f3241bdba577efbd1fa7d1ecc8ecea744313
- SSDEEP 49152:a0LOVnw1yLsLl1WoHSw3u0MxDr98cgitrIUGfaI+n9c/D8gLJ6wz3LDOnr7/JmKP:9LmuyiDWoHSw3uPDJ8c1rVGfIcr8gLJO
- TLSH T12DD533A37708D867ECF3D632D7AB06B4442ACE688856625EF143390E1D7B3CB5B421D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/i18n-catalog.js
- Size 69KB
- SHA256 71b8c8d4e94f6378cfa580f9e5b5f9a6be2d6faaa86b4fbf9bee11bdaf23a4a9
- MD5 e593483e946cd8f27a7f5389feb427ea
- SHA1 b080abfcd5bda047ef767401b9a75553106eec5a
- SHA512 7a8081cc0308d41147d00fc213822c7d3876f72a2209c2172ac67f6525bb4a9d0cf95f6bbf6fb51b0fa7a2f4b62c687ee21a9649255291c33c616d8ad76fd1b5
- SSDEEP 1536:Avr8KxTwF7jvL8AxdQ0PbdaN+FfHyOFZwpC2uiKx2nQf+biH82vJC3ft9hcT:Avr8KxT6jj8AxdQARaUFPy8Zwo2uiKxL
- TLSH T142632D5BC18452306D70A384890A3520FE144ABF73225AA77CFE19D15FBB4A8E3977B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/i18n-runtime.js
- Size 5KB
- SHA256 88e7c3a649e93e2d076e84078761a64748a1558139047084132cf32dc7e9b45c
- MD5 4fcbb5ab18c1185138fa69f86669d14f
- SHA1 1a62a5db351edc10ef4de1aa3f633732fdb74087
- SHA512 de307013a50f1ef5f56be701bff374e8baac2dc8160167ab0ddc8cf8dcd6d2afb5f797db2ca375d872c311f6423e989f04af5cdbdd759d9d5159b92d6ac6207b
- SSDEEP 96:jlAoYK5ZZ7oeqXo3ZoRkXPzELKbpwxbxwvoonoEoHoPo2oXokoilNCsFtwWc/dyt:5AyNYC9XIwpwbRLwWc/dy07skh3NdN1Q
- TLSH T1DEC1DCABEC8315429134637C896B4644FD25431F015E4A43BCBDEC492FB04A972EAFEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/icons/google-play.svg
- Size 1KB
- SHA256 8b25682204477dec055a59f72cb72574e2958196c715391b2364e4b086d314f9
- MD5 579b8189936bab6778bfdd8c19fc493b
- SHA1 f81cfd87d033bb64c537dec8031ea542d8f22b03
- SHA512 7532233d9561bdb8072beb7f97144a278f61a9c8f478c69f95434d00d34217f4aa9e3dfff7e8c540c320ee4f350714a96f5a188a1f5b7d108e338ef5e806a00d
- TLSH T10631310DA5965C3F5A72C7A462F49D8B673224C783A8C8DC85A92C3EE65C5C021BC6FD
- MD5 SHA1 SHA512 TLSH
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/icons/star-outline.svg
- Size 278B
- SHA256 c08437af20cb85cbd5f0a4c901f63476c2f717b37ba07ad546315ef514d317d2
- MD5 a5feff4b1477efe7a3d525856fbcea71
- SHA1 298d27aefbff453371ed0e432117fd3c0f0f1eec
- SHA512 d76e3af49a883214cdba317f9e215a476e84c79c04357e3c5efc2951a49792c43fd3396289de584b64182e568487f14d1c3839ff5b358a4bb10db0e1aa14a2a5
- TLSH T15BD02B3BE0296D88477F429109B9CC8DB27D921B45DD003DC9BA514485A1AFA7B2A4BC
- MD5 SHA1 SHA512 TLSH
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/icons/star.svg
- Size 381B
- SHA256 513a0f450ac62c6bdc6c6cb8701896ea4ac7a82121b9e19cc52596fd7ce3b5fc
- MD5 fc5fd2338d246078b4a4fa29413f23e6
- SHA1 52d73cabeb5e64bb9e1e024623a90a0e0cb888b6
- SHA512 8abce8608cc9351440e7ec2cb624841b9357f1e6a8a9f926f4801f11b691c8cc1a2961c5c22373b677255e8ed51856932c33bfd4245ab1836c43c03a7ddb8afe
- TLSH T142E0680BCA1C6626838C0655A978B884D13F436A426E52DDEAF751106408BBFBC4EB88
- MD5 SHA1 SHA512 TLSH
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/install-state.js
- Size 9KB
- SHA256 7466b2177edb95f11e6caef33be8315ad431ac52e4c17ecd84288b02dab88d2e
- MD5 23743b157c3437972179d9887c0fdb64
- SHA1 06e040677fd3d36ff5e0659e9ba470df9721ee19
- SHA512 d0dcb67cf26d1e50e7f6d09e8aac9e7833125bc8f81d2aa148253c39c75dd747fe48fff02b80750ef0e2bf9d054a230935e8820a8e43dc2d59118147f766cab8
- SSDEEP 192:pd3jNkD5WkoQ/Qu80TGyo10dfoPnE74AAeDHl7pPcsOPEHr6JSFP8e:pdmx74epr6IFJ
- TLSH T1A812748BD8D714B59C17B974C15F80543D215957140DFD10BDADEA90CFC30B8A2BABEA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/shell-web-channel.js
- Size 1KB
- SHA256 e9d9d7ae0133cee912781e904c0f4a08f55cd393d4435d9189a146e74581298e
- MD5 cd9fe57246945b42e35226b41e02df3b
- SHA1 6f02ed9bd50ff18cc7cf5aa17c48647343395243
- SHA512 4456f0a760e0bbb7f98834b39e5efe0f8ccec322fef89c44ddbd524f9685f2f66b81833d68ada985744d64fb52b8102e8ef863cf1bc38e035016921eb2b83f6d
- TLSH T1F441CF8C39D7A4194523313E1EAF88167075D103044DAEE0FBDC9374AFA552C6667FC9
- MD5 SHA1 SHA512 TLSH
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/upgrade-template/app.js
- Size 4KB
- SHA256 21590da254f31b08f6c32433a5f9eae93c53bfac09655acb47a9a184372af776
- MD5 1800064c6209e6bc2c1fda303d8d96cb
- SHA1 6ff1ab37b70a0c1a8765a26fd773779292ec08a4
- SHA512 783244ef333c2b92597f1c257fb8deb63aedc1d9426e0b3e2ffe055b7cd5f7b64a1c797e36b925fb641e8411ec04c5aebc4d0951e4a712221b021fe823cd418e
- SSDEEP 96:qMvxKkxAjMvhSb/sDhbUe+VqgL8sxhMYDFeJinlVWxLa7aMC:qMvxKkxAjMvQb/sDh+qg48hMMFeGlVAN
- TLSH T1BDA142586852147D8975B32D672B3648FE2741530002AA1E74BCCC997F76D5393EDECC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/upgrade-template/i18n.js
- Size 10KB
- SHA256 50d1c609c9e35a2cf7246e8757828ecfe45867af2f14c9a867d1da3a69720491
- MD5 9bf1488299b4d9c6b60d5f8f2e4f7306
- SHA1 5ba5a1faa066909f261afe2f1b7d9ae5e79c189f
- SHA512 22fb5b300c573e8c067fc4c1f2abbc814431d4d6ea2602b142466e8ffb48585d93746fab56ec800a4be687240c782e236b2c6befd502ebb9f98e744b6549cf96
- SSDEEP 192:RaVEaiYYqwT1gST4icQrK0K10Xt6ZrneAmn0BMCSwJDNuv:Ra7iYPwSST4yrtYW6FnQWMNEDNuv
- TLSH T1DC22952506CB2455C9BCA357628C3B32F5BA98BF2705A4E0BC3C91D41FBA5325324F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/upgrade-template/index.html
- Size 2KB
- SHA256 4b568ab4fd8a1258d1d02ded8b4903b35a450482b726e39c54baf600b96c2bd4
- MD5 7def7115a1162f33d6074de8484ee2e9
- SHA1 30e4f0c1104d72cbf5358119fe71cf742b6e7563
- SHA512 eaedec1b85f3d1bd69d2d63034830b11af5878ddfb4c52ea2c420e89718d5c25608c886974520ee801ea2fe9204d139f5f00416f93e2445268f6759fcc80295a
- TLSH T18E51CD1264F5A13B01A390C539A27E0EB6E5CA07CB57441532FC8AA54FF2DC9CD0756D
- MD5 SHA1 SHA512 TLSH
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/upgrade-template/style.css
- Size 10KB
- SHA256 fe17237d9cd947f794dd6e3a197d2ea06575e7cbf0fe635fe9172238ad51dc54
- MD5 eff83f68b893847e5e3a6c2acd567102
- SHA1 60605d2c6a4bc95f8cebe3f34c59e73e4c3c73c7
- SHA512 754cee095fc66252bb6d381ff06736e2d2483a852f7a09b3c50431ed5fcae9ef881a39694ce9ddc928743fdf12fb981bcae8580772ad5c6c1389f4192728ee3b
- SSDEEP 192:VArgWLXaui42Lkz7ZB4Vw61xPmN3CtYeK7cxFwAF2VL2C6Y/2LfBKFCw3YI/NxE/:4lJW1KwvQl6gboFkhgHl
- TLSH T141324312A630D57D7C3FD6BD670B5B1AB7688906090ACDED6DE8200C5FC53FB6422B49
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/io.ocean.life/cache/shell-runtime/staging/vault-config.json
- Size 173B
- SHA256 99a626f0c1e81e7d108c6c7f8adf2a90511e3be1969e39e19771f9488e12efa3
- MD5 1906e3dd3c9630c00ff018602996cdbf
- SHA1 be9241bf6e468df7b1a01d55f12e55dafaa1cf75
- SHA512 48350cd7d614ac1a1d12fdcaa12debf29012f0507db396ee5375989f5a3ba153c2d6a6d9809d03b8ec20c95509b75843894d6ecf742f7945a97bf5b028c43bb7
- TLSH T1C3C08064E35B05D715FD0245367EC4305C5C57C1435405F27FA719183D9F62176D7E89
- MD5 SHA1 SHA512 TLSH
- Path /data/data/io.ocean.life/files/profileInstalled
- Size 24B
- SHA256 e35efb6b1e9d90ed40a4b1c58449336d68e9527bd60495f9a6da7e3898d6195b
- MD5 1be2e135d637415d1ad7b71264c78153
- SHA1 61524241bddbf0004ab9866a0a618141ec4760a3
- SHA512 f156304e27c4399a617d7be9a004e244aad715e9c456afa84e017e78c504cf9e001f2115cf958d512e18534ba0a9d56dde29c16c2116b01b1f72e9e6f05e3fa5
- MD5 SHA1 SHA512
- Path /data/data/io.ocean.life/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 e98527bc70d45c6b39aa054c88bf817cb0c8ecb98f83b0c93d3993eb159ac836
- MD5 381f8e66d917962288abefcb7dbdaf1c
- SHA1 b3006039bbd1b02796495793f8a99d4bb6e1bf69
- SHA512 58fdfdef7440404535e374e031624e2ae136171a30bfa489dda16f9448c6c80d76965b313e3876295409d2d174f69f855225b2628f73ab5e49819f2b0f9a43ab
- MD5 SHA1 SHA512
- Path /data/data/io.ocean.life/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- TLSH T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
- MD5 SHA1 SHA512 TLSH
- Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 0cc91196dc3c2c9af8109f3ef72f95bfd52ae9a2bfaf828c429851ed0046af2c
- MD5 b48e5b408e69504392c0685a5530d6fc
- SHA1 ae33a07c522a0dacb9f56334c2b65f583047191b
- SHA512 6b52249b41afb2bac0a27a3fc72e7518d7c59ede639b1636c6533defda129216c536f59e3298261c436d3184c9c18e2898c1b02669e33165e6bd42e82e8846b6
- MD5 SHA1 SHA512
- Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-wal
- Size 116KB
- SHA256 0d997282344357d28566c588bfbd57f67b0b9bdf92ebbea9cc9e1b6ed5e381cd
- MD5 cbf7756e7f111fd388d725ebc1aa98d7
- SHA1 b5d0dd5e9e67660b48dd4f9b0798fe9f5c5b417b
- SHA512 442b2c142aec550a88a54ff4e501e3d0b0984a5391bd56f6ae5978568eb83097ad4d948948bbcdd36441492c950d3c3dae21a34a6542dc5790b219d3ef57b27e
- SSDEEP 96:bLUvG0k6+etidjnZRWzzb8/KeKcK+zSHddKz+ZD86u0ExV:6G0VtidjnfWzzb83zSHde+ZD86u0ED
- TLSH T18EC3028D0F1D2610C09D58F0D9E00BB17A7E412EA797E3D17592107AADD3921DD29CFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-wal
- Size 124KB
- SHA256 a79d24cd5d8c8a4b6f4c7801d99cd3f766ed9931a664dc95dc25f79863c8f7df
- MD5 ea7cd659da6de8f6a21890ad6f6f0642
- SHA1 fa1365830ad352728304060d650928da8b1aa01e
- SHA512 186564a2bae47dd98a5ab4a37e4205ab108674e7da8426eab315cf9df6cb9a22f26d53d4ff522d03dabdd82cf2160899f07fd67512a43543ad3b44b100180067
- SSDEEP 3:x4VGKNqlEwzXtRKVjWniAylllJJVCyqvtcHljd0XllgoqKXtRKVjWn:+VGpv72VBAmHVvqWf0p2Vq
- TLSH T1CAC392E3279C443FD0160FF8EE6F56A96326DA00519B6E71746B2DEA6D413880164044
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 667e3152f44796f1b86b227b478c50b2805ccecd636b590c6b6c8f65b5e04801
- MD5 03b9c7bb345672b68b679bc7d46be87e
- SHA1 5208534cd5c7564a6aa8d9a7456094adf5bf80a3
- SHA512 7af00b442e8b68a3381cfdd5047d1d7cf67d8082b3c9ad0b54a66545dcb50460d59e405ae0e9be107803bc46e483019abc9a3d934af62e6336b4f48038485cb3
- SSDEEP 6:Kqs3bltiJOd9FZdrlOERX4PBX4ogLugMBX4suuK+/9nt02/Y3ogOw2:KrLyJezdTRmBEyPbP/9ntMYgOw2
- TLSH T1E772C24863440977D10D1AF284E7C3623FB1A61A7253CB8F3257241E7CC3B88D650E08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/misc/profiles/cur/0/io.ocean.life/primary.prof
- Size 1KB
- SHA256 72d90ce739c27c515140f2ed753ef61b441fddef2c782a19c0d2239152f8e3dd
- MD5 c07c4fdd118a16082bbf4e3d0dcec2ad
- SHA1 0f1b7935ef7a088b5bd65357fd3070534d48bc2e
- SHA512 941b8286165a8b144c69272e7a8d261b74744e10bb242cba6c4764d612c6da438dd772783049b48e63f3f07bfb098ae6fe9257f9912b0afadadeb191912f6d61
- TLSH T1BC210D7B94771A3E0644416134F623CF5676AC34A53FCD7041DDF025190C9CF8A6D361
- MD5 SHA1 SHA512 TLSH