b5c5a72af83c757834802f0082d2bf51ecabba24e201a1d63c978be75122b7ee

General

Target
pockeloan_fjifu7_N2.1.8-20260113.apk
Size 7.1MB
Sample261006-pkwctsys8k
SHA256 b5c5a72af83c757834802f0082d2bf51ecabba24e201a1d63c978be75122b7ee
MD5 930287e97fbce0b02e63a469b7690beb
SHA1 20b7092674b7a2087c2bda2cc5c45705f0f34a5b
SHA512 1dee23b17ffcdab5a6bb08b660cb46a0c9e93b5617f8c6ff19ccbdcdccbd42326318a4ebd6220faabe672b84562cf2bddbc246340de64575907ff2b99d2f6603
SSDEEP 98304:YePfFS0ovfkyoJhc3ONh/YGWH4G3yEaqH6uiQf658vauTC6SwEhrEjibRjkzfrRD:1FKn2JSeRa4G3yXu1bvLC68gGtsTuqx
TLSH
T17676019EFB5C7D2EC87F4132595AD231215A4D258A83D7C72958371CE9B36E80F88BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.pocketloan.android

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pocketloan.android

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.pocketloan.android

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.pocketloan.android

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pocketloan.android

com.pocketloan.android
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4935

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events
Size 56KB
SHA256 29643414e312a290e3fd384fc72c49b224733e677d3e9cf409106a604d15f615
MD5 d5bb70d5427d8bcc585bd15b4e41680c
SHA1 0abdb8210a282290b1d86b701a929b58c77675fb
SHA512 8aea03d6f57dc6cbc95726bf8bc113eb4a1b1d6af17c7f42868ac54cf5f883f6d4e9cfb75073e1df0ac34e8d075c4df7466bbd5e26d49f1414c6b2774e2bb31b
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSw:rAMEX0wIyNjaw
TLSH
T13043655D5F2C2221CA7E283ED7E243A35B7C93DF572392623D908CF98DC246974354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 7047fc75e7e5777e0233f57a08f309e180c699d13abcf46790aa8e7ac8b35921
MD5 7ab23bcbb70f8c07fde153985eb46886
SHA1 b1a09a7b7cf1081776c4d14997e9471b1d04fec4
SHA512 e7363746dc026f989997498ca58b37615f0783bd61369e25cd4a829ef3b80be6c60b57cf6cdbf2a2057ad17a19f26eaa5d6f827abc6b4067b17ec4fb5060b26e
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 328c9a3c80787aba4d37f4a906fcece8bac6d3a0195396073cb0050a7db831df
MD5 e8f26ab9191ffcce2449e7925edb557b
SHA1 fdc6085b4adf107d50efe889ba0e0be815f6dd81
SHA512 80ae4e280636490d64a9450068bcf3ec4fb12692dbbce6a1a6556a8fa17dd98373e77b36c4cbb00576afbe6936753ae3bf154a30876bfe1afdb36f098a2933c6
SSDEEP 6:7+/l9S0n1sg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKR:7+tYdqLiuWdYRmBEyPbO
TLSH
T15D02C08CA3800813C82E1A7794E683440D00EF28C771CB275ED008D53C074CCE8A0D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 0aa99adb421ef1035bf2c859164d3333cdba8b40d6ccca8fb06c95501ae10073
MD5 9c5b133872bb5da3c0430b54dd116e6e
SHA1 bb0ee1cefdc249d8dccf053352ad81c6c0629450
SHA512 551dc0bee116fac0c32c16368c13e8fe8b900f9cf31ebbb195ecc80db00b11aae429c828d78de90cea9b03f1848465418a850220d0065168863dabdd84b1f641
SSDEEP 6:7+/l9X3l4Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKSK//v:7+t1SqLJdeWRmBEyPbwXv
TLSH
T19E022288E3400903CA2A17B7A0C883401F20F7289263CB0716910865AD076CCE8A4D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation1731421545875188858tmp

Path /data/data/com.pocketloan.android/files/PersistedInstallation1731421545875188858tmp
Size 568B
SHA256 8872eed49c77844d0024f5065d4f621851d7d84e99b371c00d4b891d7e8468b4
MD5 57c554db1f5fb3bf48c414a28f4ad5b3
SHA1 2d610403b89d357b4c21b25d8de9e04a7200c012
SHA512 229f2b01306648236ad630c5b2caccd620916866deb3629dd9a63bcd506e8341e08aea08ce4071825512ca8581ce43bef836a10ff15d1d251d22f989c360226d
TLSH
T1FCF0419659F6A84AE48C61041C892D031E4C08613C0D02ADAAE988E095B9D1C930BE48
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation3177545041009027537tmp

Path /data/data/com.pocketloan.android/files/PersistedInstallation3177545041009027537tmp
Size 90B
SHA256 321cb6f3f221917a5652fb9111dc075f2b7d57362fd2ce7b1eba26ad0a598869
MD5 9b8d7029304ff18049eae0f28891e313
SHA1 730c02a2e9f0a8f13ca840ad2f1dc03a101c1391
SHA512 cf87af7f861d0278ad987258108e280d4f5ad5c51ed9c3515693fe0c351d840c2eb48024ccd24e083410f0e893a895f597abcf60546dd257a4f493578c0bb77d
TLSH
T130B012149E354262CE89B2079C8C91405D84184014499A9C0A08D09051911D4E7C3EA4
MD5 SHA1 SHA512 TLSH

Submit Download

behavior_log.txt

Path /data/data/com.pocketloan.android/files/behavior_log.txt
Size 68B
SHA256 f96a5038bab7857cf0b87b544f9f1d9f3f79c60a8516d81bea045797214039f0
MD5 fef49bad42a26e1dc325e52474b1ceb1
SHA1 4398b629b64770b9abbbb92c715e1a6291f2946f
SHA512 928247f3938649b4d3b2cf75bb1dc797e3d1cd4665485043ec79207828fe9e3abbfab997bb898626344f8f8197f0ed841a44438bb624c770ebff1b04790d243e
TLSH
T190A022C228BBC0300880AC0008C808388B08B0F2228E2AEC02B202C0C8C8E0E8A0ECC0
MD5 SHA1 SHA512 TLSH

Submit Download

behavior_log.txt

Path /data/data/com.pocketloan.android/files/behavior_log.txt
Size 55B
SHA256 98337f376a3d9eaf2e2fcb762ba9df3116932523594f767a3af5c4e785b16910
MD5 9abc30fd840582abb1c41304464ca689
SHA1 a382c7a873fa15367ff86836a60dda6806e536ec
SHA512 ac55feab45dd5e5798205517a926d574f6e2dd07d423a0779a659abf876a4de31e44182cbbf67cc99bdb121e940701cd9d5d0a2fd55e8357c4665036a7e5ef47
TLSH
T11B9002970637D46601412155719CA825D51DE4D8464908F44A05E2A22509B0C998356A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads