Analysis
- max time kernel
70s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
22/10/2026, 18:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
sagar-club-1.0.0.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
sagar-club-1.0.0.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
sagar-club-1.0.0.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target sagar-club-1.0.0.apk
- Size 6.9MB
- Sample261022-w6l5lsbc64
- SHA256 6d2df295ffac842c3b1a53baf40a568773f1587d932354a25c1e9ffed5c6103c
- MD5 7c76f844eb72b66a96acede5d14e6bd0
- SHA1 38e555ed24fb160991de52bfff439678f10dbfb3
- SHA512 1e691136f70d28c71d1c64b93a14059873fbb3acc5a8a1e4e3a46f8346e511a55dd8156f6937edefb9b3f4e303ceff45908d18a3d9e6035c422f0c95ff10f018
- SSDEEP 98304:peId7TLh9hY57A/lSp9Mqs9c1PgxcsrRBQn/l2O2A8rt192L0MZ5eFg/dqwbsOHM:pv7ZaXp9Sqgxc22nNsX2J5yWqIsMXpa
- TLSH T1A5762282F7A95E5FC87781360ACB6732225A5E16C393D30789187B6E3C776E80E447C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener app.sagar.colors - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone app.sagar.colors - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver app.sagar.colors - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo app.sagar.colors - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo app.sagar.colors
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/app.sagar.colors/files/profileInstalled
- Size 24B
- SHA256 cf4a00fca44296fab946fde49c4a61da1a53b1fcdf959feddf942a0377883987
- MD5 2cb280ae64e196b56b809e909dc5d6a2
- SHA1 02780f0fa4177aa4697b9201cdcfde6cff7ae085
- SHA512 15ee37b868b4105d92cfccc9b911c8764e7c8a9f3a23c0a583eeffb0d24dff0fcd007cb8c9460e69cd47e37b528c165fdb02f6d7b7880c5c90da941647f43412
- MD5 SHA1 SHA512
- Path /data/data/app.sagar.colors/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 b909238c4c890ef37226a14693704d5ba93f1019cdfd382901e77e27fefddb5b
- MD5 c1ad646e2dfe3daeb7e160a53c34a144
- SHA1 b1f53fa93278fa2471cd2e8b6f957e95aeb195e8
- SHA512 994913c234f4174526d0c4620fcb7fe7b73ce92adfce57fc70f521438be20ed1d2464defec92b75dee47656564864a01f4a990e5f3c12a864b6b56288a74fa3f
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/app.sagar.colors/primary.prof
- Size 2KB
- SHA256 0ff8cda996dff5bb32b3b02e887c6fb87efff637a3e2204c8d52e56fba45c5fc
- MD5 644d6e16082317c185db6f299de6cfca
- SHA1 fab13ab3b9acde578352342c55d24589d923aa9b
- SHA512 0e0e538ab6a55e6a46232bc7b291f5cbe2c16add0954819a25278e9c959c20d99871452cb0bddc72f9294a0fb638e10a5762446442f949f912bc2add3cc46d1b
- TLSH T1D5514D6467D62236465CFFC6C022707F832BEF947A8A6C084361F50FB6C08E10599E7E
- MD5 SHA1 SHA512 TLSH