Analysis
- max time kernel
47s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
15/10/2026, 12:10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Backdoor.AndroidOS.Maxit.a.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_HEUR.Backdoor.AndroidOS.Maxit.a.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
jaffacakes118_HEUR.Backdoor.AndroidOS.Maxit.a.apk
Resource
android-x64-arm64-20260325-en
3 signatures
150 seconds
General
- Target jaffacakes118_HEUR.Backdoor.AndroidOS.Maxit.a.apk
- Size 2.0MB
- Sample261015-pcb9zsat3j
- SHA256 a9aa4a5afe8bd8864b91ed39eed63282d9b052fd436cd8606135be7078355ada
- MD5 2607dab47168e280a934b0916444afe4
- SHA1 886ea5b408424ed1dec3cae3eab02efd0d98a8d4
- SHA512 ca48efcf25409cd27a6775a9d7107e6c04039e2ff22ce3c0d72fbdf0f04841ac3e4335ddd8b6b01801b1ef33226cc3962355d012a98eb0bccdf23a682b8bc6ca
- SSDEEP 49152:V2g37xWpR5uRli9/hyv5LA60PTATIPZRKZwLXXINXL1+NS8fW:v3W5u/3uPTDZTINbeSV
- TLSH T107A53363FF49A105C96B8C35965B4147E83ADEE89951E17600247FE90FABDA0CBC4CF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.mxmobile.mx20120315 - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.mxmobile.mx20120315 - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.mxmobile.mx20120315 - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.mxmobile.mx20120315 - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.mxmobile.mx20120315
Processes
-
com.mxmobile.mx201203151⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5119
-
com.mxmobile.mx20120315:remote1⤵PID:5288