e89ea7b6c7444e8d216b521404bf2949006f96e7be0dc11077499504c96c2470

Resubmissions

06/10/2026, 15:17

261006-sn34macx8p7

06/10/2026, 00:27

261006-ar85yaxcph7

Analysis

max time kernel
22s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
06/10/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app.apk
Size 4.9MB
Sample261006-ar85yaxcph
SHA256 e89ea7b6c7444e8d216b521404bf2949006f96e7be0dc11077499504c96c2470
MD5 87d2495b4b653140c37bd844e281b326
SHA1 56e684847f4bcf49bb670dbf12905c5c84aa8999
SHA512 036c365ff5b0a4970e6067a4e5fa47694e6efb52f981f18d8ce13c39f8329b3ca010bd2166b82bf6ea7614e128aaf66902445a82f02bb1d4e192ab4d77197863
SSDEEP 98304:EvM6OI6cZCyLaquelbh3cv+9R6gU4i73IPlTPBE9IL2HmLW1nDT6UmPvza:9PT/yvuem+94gVC3UTPBEOiV67za
TLSH
T1093601617F8CC83ACD37913499AF22923E4B5D60C8A2665FB440366D38F37D44ED9E98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	io.ocean.life

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker.	android.permission.READ_MEDIA_VISUAL_USER_SELECTED
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to turn on the screen on, e.g. with PowerManager.ACQUIRE_CAUSES_WAKEUP.	android.permission.TURN_SCREEN_ON
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	io.ocean.life

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	io.ocean.life

io.ocean.life
1⤵
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4754

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

.payload-id

Path /data/data/io.ocean.life/cache/shell-runtime/staging/.payload-id
Size 64B
SHA256 aa07712a7058d3de64476043739fc86ec160ace0d8c1396155f191c31a93b75e
MD5 be423bb89b11003bdc840f8ad99a0b86
SHA1 828440c93c0807be7b74679fc35ca63e8c9e4f52
SHA512 be94391ddc4ab35816899a4b1d4c75b1f011379719dbe47b5d5ed9a2500295597183b4acdc6b250e550f76e07bf550b7a49b19bfb2bf3b73724fc8894b8d1081
TLSH
T103A0027C6419572A5ED809A64160ACD553C887253C91AD3FAD711B2911425C99411B74
MD5 SHA1 SHA512 TLSH

Submit Download

child.apk

Path /data/data/io.ocean.life/cache/shell-runtime/staging/payload/child.apk
Size 2.7MB
SHA256 98893a584aaff97ac4d9ec3ccdbb86ac6f42c92bd56efaf8ea2117ca9c3f06e6
MD5 6e59ee8df7e645cfb57b39eb508ea7d5
SHA1 333e08a8479f9dffb6d287c962ffd95f1947fc8d
SHA512 fd725df066a7b97abbc249934454367f0d308f3c67ec1f3acb97f44f76c7323ca46126f98c9734b04a218fa0cc84f3241bdba577efbd1fa7d1ecc8ecea744313
SSDEEP 49152:a0LOVnw1yLsLl1WoHSw3u0MxDr98cgitrIUGfaI+n9c/D8gLJ6wz3LDOnr7/JmKP:9LmuyiDWoHSw3uPDJ8c1rVGfIcr8gLJO
TLSH
T12DD533A37708D867ECF3D632D7AB06B4442ACE688856625EF143390E1D7B3CB5B421D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n-catalog.js

Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/i18n-catalog.js
Size 69KB
SHA256 71b8c8d4e94f6378cfa580f9e5b5f9a6be2d6faaa86b4fbf9bee11bdaf23a4a9
MD5 e593483e946cd8f27a7f5389feb427ea
SHA1 b080abfcd5bda047ef767401b9a75553106eec5a
SHA512 7a8081cc0308d41147d00fc213822c7d3876f72a2209c2172ac67f6525bb4a9d0cf95f6bbf6fb51b0fa7a2f4b62c687ee21a9649255291c33c616d8ad76fd1b5
SSDEEP 1536:Avr8KxTwF7jvL8AxdQ0PbdaN+FfHyOFZwpC2uiKx2nQf+biH82vJC3ft9hcT:Avr8KxT6jj8AxdQARaUFPy8Zwo2uiKxL
TLSH
T142632D5BC18452306D70A384890A3520FE144ABF73225AA77CFE19D15FBB4A8E3977B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n-runtime.js

Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/i18n-runtime.js
Size 5KB
SHA256 88e7c3a649e93e2d076e84078761a64748a1558139047084132cf32dc7e9b45c
MD5 4fcbb5ab18c1185138fa69f86669d14f
SHA1 1a62a5db351edc10ef4de1aa3f633732fdb74087
SHA512 de307013a50f1ef5f56be701bff374e8baac2dc8160167ab0ddc8cf8dcd6d2afb5f797db2ca375d872c311f6423e989f04af5cdbdd759d9d5159b92d6ac6207b
SSDEEP 96:jlAoYK5ZZ7oeqXo3ZoRkXPzELKbpwxbxwvoonoEoHoPo2oXokoilNCsFtwWc/dyt:5AyNYC9XIwpwbRLwWc/dy07skh3NdN1Q
TLSH
T1DEC1DCABEC8315429134637C896B4644FD25431F015E4A43BCBDEC492FB04A972EAFEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google-play.svg

Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/icons/google-play.svg
Size 1KB
SHA256 8b25682204477dec055a59f72cb72574e2958196c715391b2364e4b086d314f9
MD5 579b8189936bab6778bfdd8c19fc493b
SHA1 f81cfd87d033bb64c537dec8031ea542d8f22b03
SHA512 7532233d9561bdb8072beb7f97144a278f61a9c8f478c69f95434d00d34217f4aa9e3dfff7e8c540c320ee4f350714a96f5a188a1f5b7d108e338ef5e806a00d
TLSH
T10631310DA5965C3F5A72C7A462F49D8B673224C783A8C8DC85A92C3EE65C5C021BC6FD
MD5 SHA1 SHA512 TLSH

Submit Download

star-outline.svg

Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/icons/star-outline.svg
Size 278B
SHA256 c08437af20cb85cbd5f0a4c901f63476c2f717b37ba07ad546315ef514d317d2
MD5 a5feff4b1477efe7a3d525856fbcea71
SHA1 298d27aefbff453371ed0e432117fd3c0f0f1eec
SHA512 d76e3af49a883214cdba317f9e215a476e84c79c04357e3c5efc2951a49792c43fd3396289de584b64182e568487f14d1c3839ff5b358a4bb10db0e1aa14a2a5
TLSH
T15BD02B3BE0296D88477F429109B9CC8DB27D921B45DD003DC9BA514485A1AFA7B2A4BC
MD5 SHA1 SHA512 TLSH

Submit Download

star.svg

Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/icons/star.svg
Size 381B
SHA256 513a0f450ac62c6bdc6c6cb8701896ea4ac7a82121b9e19cc52596fd7ce3b5fc
MD5 fc5fd2338d246078b4a4fa29413f23e6
SHA1 52d73cabeb5e64bb9e1e024623a90a0e0cb888b6
SHA512 8abce8608cc9351440e7ec2cb624841b9357f1e6a8a9f926f4801f11b691c8cc1a2961c5c22373b677255e8ed51856932c33bfd4245ab1836c43c03a7ddb8afe
TLSH
T142E0680BCA1C6626838C0655A978B884D13F436A426E52DDEAF751106408BBFBC4EB88
MD5 SHA1 SHA512 TLSH

Submit Download

install-state.js

Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/install-state.js
Size 9KB
SHA256 7466b2177edb95f11e6caef33be8315ad431ac52e4c17ecd84288b02dab88d2e
MD5 23743b157c3437972179d9887c0fdb64
SHA1 06e040677fd3d36ff5e0659e9ba470df9721ee19
SHA512 d0dcb67cf26d1e50e7f6d09e8aac9e7833125bc8f81d2aa148253c39c75dd747fe48fff02b80750ef0e2bf9d054a230935e8820a8e43dc2d59118147f766cab8
SSDEEP 192:pd3jNkD5WkoQ/Qu80TGyo10dfoPnE74AAeDHl7pPcsOPEHr6JSFP8e:pdmx74epr6IFJ
TLSH
T1A812748BD8D714B59C17B974C15F80543D215957140DFD10BDADEA90CFC30B8A2BABEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shell-web-channel.js

Path /data/data/io.ocean.life/cache/shell-runtime/staging/shared/shell-web-channel.js
Size 1KB
SHA256 e9d9d7ae0133cee912781e904c0f4a08f55cd393d4435d9189a146e74581298e
MD5 cd9fe57246945b42e35226b41e02df3b
SHA1 6f02ed9bd50ff18cc7cf5aa17c48647343395243
SHA512 4456f0a760e0bbb7f98834b39e5efe0f8ccec322fef89c44ddbd524f9685f2f66b81833d68ada985744d64fb52b8102e8ef863cf1bc38e035016921eb2b83f6d
TLSH
T1F441CF8C39D7A4194523313E1EAF88167075D103044DAEE0FBDC9374AFA552C6667FC9
MD5 SHA1 SHA512 TLSH

Submit Download

app.js

Path /data/data/io.ocean.life/cache/shell-runtime/staging/upgrade-template/app.js
Size 4KB
SHA256 21590da254f31b08f6c32433a5f9eae93c53bfac09655acb47a9a184372af776
MD5 1800064c6209e6bc2c1fda303d8d96cb
SHA1 6ff1ab37b70a0c1a8765a26fd773779292ec08a4
SHA512 783244ef333c2b92597f1c257fb8deb63aedc1d9426e0b3e2ffe055b7cd5f7b64a1c797e36b925fb641e8411ec04c5aebc4d0951e4a712221b021fe823cd418e
SSDEEP 96:qMvxKkxAjMvhSb/sDhbUe+VqgL8sxhMYDFeJinlVWxLa7aMC:qMvxKkxAjMvQb/sDh+qg48hMMFeGlVAN
TLSH
T1BDA142586852147D8975B32D672B3648FE2741530002AA1E74BCCC997F76D5393EDECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n.js

Path /data/data/io.ocean.life/cache/shell-runtime/staging/upgrade-template/i18n.js
Size 10KB
SHA256 50d1c609c9e35a2cf7246e8757828ecfe45867af2f14c9a867d1da3a69720491
MD5 9bf1488299b4d9c6b60d5f8f2e4f7306
SHA1 5ba5a1faa066909f261afe2f1b7d9ae5e79c189f
SHA512 22fb5b300c573e8c067fc4c1f2abbc814431d4d6ea2602b142466e8ffb48585d93746fab56ec800a4be687240c782e236b2c6befd502ebb9f98e744b6549cf96
SSDEEP 192:RaVEaiYYqwT1gST4icQrK0K10Xt6ZrneAmn0BMCSwJDNuv:Ra7iYPwSST4yrtYW6FnQWMNEDNuv
TLSH
T1DC22952506CB2455C9BCA357628C3B32F5BA98BF2705A4E0BC3C91D41FBA5325324F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path /data/data/io.ocean.life/cache/shell-runtime/staging/upgrade-template/index.html
Size 2KB
SHA256 4b568ab4fd8a1258d1d02ded8b4903b35a450482b726e39c54baf600b96c2bd4
MD5 7def7115a1162f33d6074de8484ee2e9
SHA1 30e4f0c1104d72cbf5358119fe71cf742b6e7563
SHA512 eaedec1b85f3d1bd69d2d63034830b11af5878ddfb4c52ea2c420e89718d5c25608c886974520ee801ea2fe9204d139f5f00416f93e2445268f6759fcc80295a
TLSH
T18E51CD1264F5A13B01A390C539A27E0EB6E5CA07CB57441532FC8AA54FF2DC9CD0756D
MD5 SHA1 SHA512 TLSH

Submit Download

style.css

Path /data/data/io.ocean.life/cache/shell-runtime/staging/upgrade-template/style.css
Size 10KB
SHA256 fe17237d9cd947f794dd6e3a197d2ea06575e7cbf0fe635fe9172238ad51dc54
MD5 eff83f68b893847e5e3a6c2acd567102
SHA1 60605d2c6a4bc95f8cebe3f34c59e73e4c3c73c7
SHA512 754cee095fc66252bb6d381ff06736e2d2483a852f7a09b3c50431ed5fcae9ef881a39694ce9ddc928743fdf12fb981bcae8580772ad5c6c1389f4192728ee3b
SSDEEP 192:VArgWLXaui42Lkz7ZB4Vw61xPmN3CtYeK7cxFwAF2VL2C6Y/2LfBKFCw3YI/NxE/:4lJW1KwvQl6gboFkhgHl
TLSH
T141324312A630D57D7C3FD6BD670B5B1AB7688906090ACDED6DE8200C5FC53FB6422B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vault-config.json

Path /data/data/io.ocean.life/cache/shell-runtime/staging/vault-config.json
Size 173B
SHA256 99a626f0c1e81e7d108c6c7f8adf2a90511e3be1969e39e19771f9488e12efa3
MD5 1906e3dd3c9630c00ff018602996cdbf
SHA1 be9241bf6e468df7b1a01d55f12e55dafaa1cf75
SHA512 48350cd7d614ac1a1d12fdcaa12debf29012f0507db396ee5375989f5a3ba153c2d6a6d9809d03b8ec20c95509b75843894d6ecf742f7945a97bf5b028c43bb7
TLSH
T1C3C08064E35B05D715FD0245367EC4305C5C57C1435405F27FA719183D9F62176D7E89
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/io.ocean.life/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 216e925b599f99f7ff62c62aaa5bccb3ae1ba19e04f48bd56c50465a8224ff54
MD5 bde7c6cf22a93302a2c84b271d04f32b
SHA1 25edb49737fcb42f45fc332874b963324152b84b
SHA512 34bc127c4492fd9e56b6b9ba78b65207e620f44e86854ae3e8c6d26d59972279cd3006df67355503456c4321bdb7e9827545c8ca91f030a5111d4a5c0aeae03f
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/io.ocean.life/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 55e5a9a2679b4a110ae787dab3e35a842bc4c6cfbb950f0aeff359a2a8324b07
MD5 95e2951b255fd1d00e47a834c0c4cdc6
SHA1 a444f82298eed274b94743b7ff777602fe2317fd
SHA512 75e66bead0884a1a46bd77869df43f476e0c4d0a1b60c71bc7034915bad189210c767641dc7e6fcd08806f165c3675003d74c30cac30c697e2cbc6b5f3e77294
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 468622084d216f75141fef204e5e283eb8e76843d97663922391f3b1c184b770
MD5 3991a335b42b63907773efb2d555deef
SHA1 dd52efefee6511fa6ff6b4549905205f82d4c353
SHA512 962fb821c4df45357b298c8d44beb1531cd7316c84c6be7fb64fd894066df84efbc58510ff9caba869ab4a70a2f2069cdde55b8d01c46dda868d30780fff24ed
SSDEEP 96:gT8N26+etidjnZRWzzb8/KeKcK+zS8CddKz+ZD86u0ExV:dNrtidjnfWzzb83zS8Cde+ZD86u0ED
TLSH
T14BC3F08D0F1A2500C59A54B1E5D10BA2793F421EA7B3E3E277B10075BDE39619D2ECF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/io.ocean.life/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 14aca52ec55f89dca04bd95c975ece8d3dddd243cdeeec5ac5d3c6706921b87c
MD5 d36d36d308a980ed5fe627076c7914ef
SHA1 b806c08c08acb28806342140d4deee3f61d86d93
SHA512 d51f6a82924debbf9048056fadf689d6f6ac47d693e4960f578444e7049f2de8a0a1d36026e23aeb318d2d10480f945acecfa2e69b6bec3b8b56e21029e82127
SSDEEP 6:Ko8tknv1Vl9FZde/kPlOERX4PBX4ogLugMBX4suuK+/nkfDBd/jiOw2:Ko8tkv1hzdeWRmBEyPbP/MBd/jiOw2
TLSH
T14C728654A7420513E11B0233F0C7934A1A1317293332C75737F215356D232CCA568E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/io.ocean.life/primary.prof
Size 1KB
SHA256 72d90ce739c27c515140f2ed753ef61b441fddef2c782a19c0d2239152f8e3dd
MD5 c07c4fdd118a16082bbf4e3d0dcec2ad
SHA1 0f1b7935ef7a088b5bd65357fd3070534d48bc2e
SHA512 941b8286165a8b144c69272e7a8d261b74744e10bb242cba6c4764d612c6da438dd772783049b48e63f3f07bfb098ae6fe9257f9912b0afadadeb191912f6d61
TLSH
T1BC210D7B94771A3E0644416134F623CF5676AC34A53FCD7041DDF025190C9CF8A6D361
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads