Analysis
- max time kernel
102s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
12/10/2026, 06:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
kre.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
kre.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
kre.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target kre.apk
- Size 5.4MB
- Sample261012-g17rsswy2n
- SHA256 8d3479fdbce254ec0e68bbda0e65051fc616af6e16e3787a0fc32f0482c0da16
- MD5 0eb356e1a761d12cac2539049b12fb28
- SHA1 43cd3dedebb0465c49297df80301962937c79a3a
- SHA512 ef50004f6dc3f3360ac88b2e1dbab4a9456e6ae9ce81b947388242dffa3bb8511630ab3b4f35aef66406ec4bcc641a982efa2be08a5a33aaec94d053f43991ac
- SSDEEP 98304:8klzd9v3mlhgaOdLqpNa7DCfAtaIF0robT7usDt0uchsbpLm/Kr5B2/U:5z2oamh7DKRo/7usBbchsbpD2/U
- TLSH T1D446F19AFB18DE2FC87720B24D6A523216574C13CB438753AA58371C78776E80F99BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener co.median.android.akxnln - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo co.median.android.akxnln - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone co.median.android.akxnln - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver co.median.android.akxnln - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo co.median.android.akxnln - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo co.median.android.akxnln
Processes
-
co.median.android.akxnln1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5116
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/co.median.android.akxnln/files/INSTALLATION
- Size 36B
- SHA256 7ac1f349b7dbc14aa310782657cb989eea4e68c2fb73cba0336476c97af0094c
- MD5 3fa1d01f1b82506477e065dc9fd28d1b
- SHA1 4b5122f29a4ba5a7751d78efd0372c71b18a5483
- SHA512 f243c3cc2643fc664584c1861dc953842f8340ad417e415482eaf7df3480f944b1e939f0931f31c3da4cb9bd040ebfb6ce6118319747d30da975112711cf8901
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.akxnln/files/gonative-config/regexintext.json
- Size 1KB
- SHA256 d6f8195993690fbbec3b884dc0ee43e7b0cffd47f4a5104885b10ce32454124e
- MD5 08abd15a77a18587a068ef4ff153d55a
- SHA1 b5ad0256634a3f29823b158887682c9941385ced
- SHA512 a33f3d749ba01cc6c5b3dad7ae91f04b20e7246dec2c607b631baa2e156dffa8d903dfc9e478fd1a23097dc55c9ad76a6a8e3bc1d07617d1ed50ae8cff2da464
- TLSH T1E441F474CC780DB399C82864B29E421F3A76225B1F96392DBB8C551C1F4C5BF69B820C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.akxnln/files/gonative-config/splashpage.json
- Size 3KB
- SHA256 341fe980468645c099c62b9a846190e742ac5325386b1e34a8630b45219580e5
- MD5 70ef195e2701e69121a18bb72a3e1580
- SHA1 9d5fe46a5160c5287a768e5a59d363550cfa0c4c
- SHA512 9ef75a3d0f01bc697d7c0401ec49069aae92f4ec27ff641554be6059b503b764b69f8f99d0af5041ed620b913e63a51141922eebca1646e5250ae6eb2d837d77
- TLSH T17581D86C855072B3A2CD33653C2D769EA237B6A239E849055D3B3186F0C7175F592C2B
- MD5 SHA1 SHA512 TLSH
- Path /data/data/co.median.android.akxnln/files/profileInstalled
- Size 24B
- SHA256 760ae43167e7a66bfe4ed7d153be08182c4087f2022531a60cc1270aeb25af2d
- MD5 4f4e4e6d5b982daba98cb3cfbbfbacce
- SHA1 18f5b9efaea7ba282e08135b08540a9fe6d9809b
- SHA512 dbcd067fcfa98126be8284fc48a4aae27f159215ba37a9110dfaa64c9546048f94862ef30602489ddd9f1fd195314fa8ad68800ff3eab5a4f3c437e8f1154ab4
- MD5 SHA1 SHA512
- Path /data/data/co.median.android.akxnln/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 1aec280aa0b0c079b63a73ce918e6510454a36a27740e30294bc27af638e6151
- MD5 49e9e31aef30eaea019c2bb19f5ddbba
- SHA1 8cdfaefec3dccf7e9fc7326a0144a80c99e7d031
- SHA512 94496b805edccdbd56d28ead732be3915086df68392c697362655859b5761590b9dab1dd3b49350947be5f78b34587ba0706b66a5a2bb59cf167d7d569a4c4db
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/co.median.android.akxnln/primary.prof
- Size 4KB
- SHA256 eaddd28aa1ea0b017a4eefb1515b6b480c4e370a53adbd9f5ad7000bbf92db1a
- MD5 477f40f56f167cff13d08fbfffed84cd
- SHA1 fedd3f381726d62382c2b359fa466488713c255d
- SHA512 3b359c6f289c559432122d69d3cc9e0c73fed05251f17f6af6718a756591ed31ce3c633421552bda7bdf915cbdc4983bdbc51bd36cb33f2fdc818bf181c08924
- SSDEEP 96:tnPCL2CzQwfSwFOT1aDH8R0Lx2iMkF8wnpzu6hdu1BbiD4oH3M:tP42aq5eIiMkNn8adSFe4y3M
- TLSH T138918DB5E25CE906A29C7097D110E5CDB955C0B9E8CE06E9460ADA2019CCA7FBC37183
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/misc/profiles/cur/0/co.median.android.akxnln/primary.prof
- Size 7KB
- SHA256 b097fb7f2aa032b9fdd84b481c2ed72bf67d0160ecb1878c3350f3f6120c8106
- MD5 bb5b271c493b4fb8d92564bf2d2363d6
- SHA1 fc56fbd02ca87243d63fa57ac165feee6861437b
- SHA512 65dfb5eaf629a2b6c2c794cab49a869814f8d6326ceea21a00313a4f8cce4cd3c9fe20b7081fe8fe724d278e65300209b4b66df2b0c846df470a4187976067b1
- SSDEEP 192:Sf1tgiUG7IYDffaYzrCwJo8/BUqUYo+Qpk9D:SiG0EffvRJoMKGDQpi
- TLSH T11BF1AE07312ABD90A589F0514CDD854BBB5F8BD4ED0619D6BA37D2CA07C284D0AC973A
- MD5 SHA1 SHA512 SSDEEP TLSH