cd91a13506b54461036bb964f6825489550ab9240c74abe9957d1bf45ba16739

Analysis

max time kernel
46s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
22/10/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rephco-Pharma.apk
Size 2.8MB
Sample261022-w448eaew7s
SHA256 cd91a13506b54461036bb964f6825489550ab9240c74abe9957d1bf45ba16739
MD5 7da8a8294434b59f6ad73b5cf31bae29
SHA1 d53b9e22a9d8a80888eebb2f47a54bed113f4a4e
SHA512 9082215f495c73491bf9a2ed8a9dd36317112215957267d11d4f75c7ff59667dab61f5c146e51ee36381373c0b73ac1925b850bb0af7c884d0a1802db4ddba97
SSDEEP 49152:xqSAATM9WDFdcytdsPY9/e2zCel6s8O2p7SxUYqn5EneZNriFHKKgexjfA1vS1Zg:ESAx9wdcJPyeICO6W2aq5p/okujm61m3
TLSH
T186D52353F676BE6FC8B1C1703545563165224D29CA83E71A78583BFA30BBAEC4BC42C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.repcopharma.app

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.repcopharma.app

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.repcopharma.app

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.repcopharma.app

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.repcopharma.app

com.repcopharma.app
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4770

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation500686168883408739tmp

Path /data/data/com.repcopharma.app/files/PersistedInstallation500686168883408739tmp
Size 90B
SHA256 2ebb89c3656657448ced6c7e5e221ecabe4f847fe66d31870d85cc2e53f0d81e
MD5 7514f12e51930ffbf99a3a2c02893314
SHA1 c80765087434ca97887907d99215cb953e93d41e
SHA512 7b0117e85923a8515ba759530c2bb3402c1bd8fa303418329698913107642d74b15311ff1270d510469e8195584373d23cf861f209d584ac43475c113489d152
TLSH
T11CB0120047314146C49AB20B2ECC96405DC05441054D8F440B0AD48091913D19223F98
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation7445272626924573650tmp

Path /data/data/com.repcopharma.app/files/PersistedInstallation7445272626924573650tmp
Size 567B
SHA256 836a3b3426609b286e5749d24113a7c2947701c7ab1c4ae4451faa9fe3bee681
MD5 f271f6b36cdbdef0f76b0da01c0380c0
SHA1 4900004351dd2359b922fa6ce2720955ef1a27d7
SHA512 54216d118cbd50f7e9721f7557d3c1ad4d57e4af348e27ca614bc3787715df2c4e7ec729145d29489a9b41ead7bf88bdbb8f505defda0069d6c9a87e008d292a
TLSH
T1BEF026C703600657CCDDA5863CAC7C005C844D8645095668FECB8C446FDCBD553FBC48
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo3MTY1MjcwMTIzNzc6YW5kcm9pZDpjMGI1MThhYTVkNzUzNzc5ZDYzODg4.preferences_pb.tmp

Path /data/data/com.repcopharma.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo3MTY1MjcwMTIzNzc6YW5kcm9pZDpjMGI1MThhYTVkNzUzNzc5ZDYzODg4.preferences_pb.tmp
Size 321B
SHA256 c3d8f4db5ce3c7b000caa0f5d81930b384f5bdb76566a38ee6d7527982753782
MD5 b1e060da1f1621b36f817d4b7cd4a1c9
SHA1 fa7c8e992c981ca434a92609e90d24bd684968bf
SHA512 5af20e9eb7891214b5f23812961f4281b7753902017004dcf58a00954dfc7c6889559a8f3835fd3126bf238dfda3d094c0ab31bb0bc62fd98ba0e07d2fe384e6
TLSH
T1C4E02610DAA18EF0293F62493F5801380F7FB3A16031109D62A80584B91E24092C7F0A
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo3MTY1MjcwMTIzNzc6YW5kcm9pZDpjMGI1MThhYTVkNzUzNzc5ZDYzODg4.preferences_pb.tmp

Path /data/data/com.repcopharma.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo3MTY1MjcwMTIzNzc6YW5kcm9pZDpjMGI1MThhYTVkNzUzNzc5ZDYzODg4.preferences_pb.tmp
Size 345B
SHA256 ceca0aad2a878a0a343e1e7a48c68c72b9dd2baf755db88f3e9deae301ddcd81
MD5 69974e6bac5a0ce03520f72ef37a5b98
SHA1 c01fbe4f2f01e4777a1d13f9a7e7938606dae730
SHA512 78046f35bb054783fc596cafac04f5491f90c4b4e6243d50ddcc1f4e345ba6843bdbba1fc213cfc47ab5c4c0841fb1fe19989fb35c61220b22700e29ea85c22f
TLSH
T10FE02610DAE18EF0297F664E3F9801384F7FB3E26076509E66B80584B91E240A6C7F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads