c15077c8ca59c878b119728f2e4614386cc56377c6087e5bb2b3cc7c1ae95367

Analysis

max time kernel
86s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
22/10/2026, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SQUAD_BETA.apk
Size 5.7MB
Sample261022-w63glaex9s
SHA256 c15077c8ca59c878b119728f2e4614386cc56377c6087e5bb2b3cc7c1ae95367
MD5 4340408ef58633f9cb669168b8adcdac
SHA1 a54510488ad299e46fc48665f4d83e59bf7d71aa
SHA512 37dca5f7a7b292fd2bc30aa79e47c8d7149f4062f2b84b104dfb8d4de5c02a4c6a8bb07b1c9a8fab6e056b8ac2b9a0eb4dd4c1641ea7f0e716516ea5bff2f0d1
SSDEEP 98304:LofhIxi844qQgaCZugjXhwISrwDpfH62yAFK2DbArajJGFlcN4odcHKhSt/MXvoy:QIbyxggjXhwRrwDx62yAFhArajJE/odX
TLSH
T1B8561242F3E8AD6FCC37D0322BAB137615828D12D646D7439918B76D2CB7AC84E95BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.seb.squad

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.seb.squad

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.seb.squad

Checks the presence of a debugger
defense_evasion

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.seb.squad

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.seb.squad

com.seb.squad
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4795

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation5502367226363532342tmp

Path /data/data/com.seb.squad/files/PersistedInstallation5502367226363532342tmp
Size 90B
SHA256 dba3d18c114b1e8adb8c0128e297fc2feefd7ef218d4d0a3c93b866526214c5a
MD5 52ce1b77b7a58b030f06ab7d6e279516
SHA1 47ae27112f40e75ed72bd2afcdaa433d2793b7ca
SHA512 8e5262541e9396ed47293d647ec3a0b931a85e0c53fd4c362cc5274bdbce11113f5da7fd266044f2efecf424ea8a8a1d057ed406ca3e1ece40d2a49590bf4472
TLSH
T1F2B01208DFB24141C4CDF2071D4D91007E401480184E8E480B08D54000C21E4E2539A4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation5972832206140028034tmp

Path /data/data/com.seb.squad/files/PersistedInstallation5972832206140028034tmp
Size 569B
SHA256 900b5e3344e3f17f2e47bc0eabba2543d18243c067efa444c82d2a0fe7e8b1e0
MD5 c9b7f33e055c1de4861641dfe88b6803
SHA1 4e85bb6ea68da3c67d74b5d793a43c708661ec93
SHA512 c9120a1cbb332174cec4a59e6bae684b5604e16e8eb8a6c5b6b55e859316f213c9b0a46fb77b46cea846d2e1a79b9d407fa19e72cb9841d50c8992cd7a7e4b7b
TLSH
T1B8F0261B267440C7C4D93D01150DEF5A4C0D1DF65B0F00FD5ED5C06497FA57950CB951
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo5ODczOTgzMjIxMTQ6YW5kcm9pZDo4NDA1NjI2N2I3ODBiYWY4ZjA0ODVi.preferences_pb.tmp

Path /data/data/com.seb.squad/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo5ODczOTgzMjIxMTQ6YW5kcm9pZDo4NDA1NjI2N2I3ODBiYWY4ZjA0ODVi.preferences_pb.tmp
Size 321B
SHA256 5ba8fb79e069b43e7b84009f2666036ffa31929badaab63a7b10a730c4e638eb
MD5 598697ec5c6241b5200e2d1e02d29f12
SHA1 c27373161dab79751f08a4806e4146d0966759f5
SHA512 afac07923af9345cc2b99c01adedcf50cd7f8263ce767f474e1a7abb39a5cdf52985b3dfc5546f2dd51a6ff01eb64fa8267a41dfa9cfb16f105272aab00762ad
TLSH
T118E02600DAA199F1192F110C3BA801280E3FB3E12176049962F80190F50E641D2C6F0B
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo5ODczOTgzMjIxMTQ6YW5kcm9pZDo4NDA1NjI2N2I3ODBiYWY4ZjA0ODVi.preferences_pb.tmp

Path /data/data/com.seb.squad/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo5ODczOTgzMjIxMTQ6YW5kcm9pZDo4NDA1NjI2N2I3ODBiYWY4ZjA0ODVi.preferences_pb.tmp
Size 345B
SHA256 6e9ce552fab471f4c645731accdee1f80b11e862bc83306607166b678bbd4e82
MD5 4f9692737517ecd2c59e47aa6eab1598
SHA1 be36248324a632fb9d93e25630190fecb3c641fa
SHA512 a1e1fae117b4c5d0a06372fe5bda812c2efe5a268ee43de7c58a47c94ac67ba791d3a7dfae7af55d5181ee92e758d4dafc61cb84c0d9e8bbdc7af7da4cc66d07
TLSH
T117E02000D6A199F1597F550D3FA8012C0F7FF3E1217A045965F80151F51E641D5C6F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads