ae20f0d6ba5c1501bf1f3132bd88dee196f7aeac707320a84237469827010c7e

Resubmissions

07/10/2026, 19:17

261007-xzl2psvt5m7

07/10/2026, 18:23

261007-w1h6rss1bw7

Analysis

max time kernel
81s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
07/10/2026, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app-release.apk
Size 6.9MB
Sample261007-w1h6rss1bw
SHA256 ae20f0d6ba5c1501bf1f3132bd88dee196f7aeac707320a84237469827010c7e
MD5 b5856917b8a639f13a89d1af17babf2e
SHA1 286899701cdfc2d262c9689e29b79e7f7630a66e
SHA512 70f8e922f935a85661372eeee1be981d0b9157719f1a5d860c6fa09601656221a232abd66e79f081e4141cdea8b0faf11c1d9c34533cbd9c3cfe324c70d90320
SSDEEP 196608:zgXHYNd7DKRo/7usBbchuGK0WRwTP64ay:qHYNkRo/nBwuf0WSTT
TLSH
T19A7602DAF7D85E2FC47710B18C7652B2164A4C22CA879F476548371C78BB6E80F89BD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4722	co.median.android.abqzxlz
/system_ext/framework/androidx.window.sidecar.jar	4722	co.median.android.abqzxlz

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	co.median.android.abqzxlz

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	co.median.android.abqzxlz

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	co.median.android.abqzxlz

co.median.android.abqzxlz
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4722

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

INSTALLATION

Path /data/data/co.median.android.abqzxlz/files/INSTALLATION
Size 36B
SHA256 d53e41556bcc1f7a1b92be1db440b77c289ddc50f9b8cbb8810710d8f5fb60d3
MD5 2a3228734c3399751349fc8069bfb9d9
SHA1 2822ce7094abbab7698d98829a02d061bf6646b4
SHA512 ac7ba1d97ddd67a0845b6eec38cfd960c9e74e32e366407425614ec68cc7c9a3acfa5b8fff94077062010758c3eb51a08e1a5f3d7f499207ea3af2c219bc7bcd
MD5 SHA1 SHA512

Submit Download

regexintext.json

Path /data/data/co.median.android.abqzxlz/files/gonative-config/regexintext.json
Size 1KB
SHA256 bf219ef8df72da3c3ccf1b3284f40430c1dcfe629e695557dbb620b6f7d91c8d
MD5 4e722e39b5e97a4938ef1a586b10bd97
SHA1 ea4baef6d9ec5edf5e09cb92cd54fa273d00e38b
SHA512 7f71436433539292b2e88dec9344ae88bda324a58cee9767f32376397ac18421acd5bb5bc9d35ab003fd2d6a7e6f01035c02fe598438516cec0be61815353772
TLSH
T14041F674CC790DB399C82864B2AE521F7A72225F1F96392DBB8C561C1F4C57F59B820C
MD5 SHA1 SHA512 TLSH

Submit Download

splashpage.json

Path /data/data/co.median.android.abqzxlz/files/gonative-config/splashpage.json
Size 3KB
SHA256 28fc1a102ad4d1cbdbe8fa507a5efc6c450ebef2f34c125a18780bd63bddfb4a
MD5 0e245400d2b8226482b0f16214f88841
SHA1 f9e95be6866ae2e2bf380998246d054218c22ec1
SHA512 a7c307cfe74a8e5be8e6ff1cb4f8702c06913977c9a649e5d0549ec533be226c335c8ff8b1343b2727a0d42abb893b34c057deb38d6c0de60f87f4df98434232
TLSH
T1CD811A1C095093031E2B3775361DF91E82773B1BFDF42A962C25744DE0E1076C889D6A
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/co.median.android.abqzxlz/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 7bb72196f5823fcb3f53cec123a2927e9a8bfd9a7da33e6242cbaebec86f083e
MD5 46c25ea226fb17240a68fa60bb997a18
SHA1 1d4850b180b58f2a0e4536bfedd77ff21b863484
SHA512 c532adce6d97ae43ca445c8560c020a95b71c8b6fc5ddd396fc53c5f39b535e05f39ecfe601ab7f40d14fb9b2a171b8c1838806d28808de2670cac2967d3badd
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/co.median.android.abqzxlz/primary.prof
Size 2KB
SHA256 996d5a337c0d2642dea77c8f1d9b737744f369b5faf9c27e69428e082229a190
MD5 32f4d602f3517f2f90f8e2bac7f3c00a
SHA1 d578307273b3dcd775d059312d687cfa0c4f2bda
SHA512 e28e5f01bf3bb16d07a3d9542b1edb453a74619e27374d59a6069e5fd18e356d5985867a9de223afa670b99402531a6a59d2c326f0d482ce03c222df07d30f0a
TLSH
T1D5411A8CC8181F6FA85E4713EAFBBC5C8156FB2AAA776A050CEA01093D41D770C5EE57
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads