Analysis
- max time kernel
43s - max time network
63s - platform
android-15_x64 - resource
android-35-x64-arm64-20260325-en - resource tags
arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system - submitted
27/10/2026, 05:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
TCOAAL.apk
Resource
android-35-x64-arm64-20260325-en
4 signatures
900 seconds
General
- Target TCOAAL.apk
- Size 490.8MB
- Sample261027-gn5rnsby2k
- SHA256 9e83323975b83860488c2feceeeec74af9bb355f114686bac94a236aeb5e04cc
- MD5 06e3f999640728f9b02376a72f8d1ee7
- SHA1 82f08343c961f561be583e04a2380bf00a6f0ebd
- SHA512 6d275b133d8a699bfcb34a4651426792cea411591e4672a2af6279859e0e68e3998161950b7e06c45ed000952a1fc924e08e76399ffb462253ad46943def1a5b
- SSDEEP 12582912:dejC4H4aVFlxych/L4PtJQ0fSd9BSNMSfmuq6kM:dejC4YIxychM1FSdrG7q6B
- TLSH T1EA39228AE3765073F4DE203431271A1B12662C377192CC5986E3B5AF2767F72AC71E26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
description ioc Process Accessed system property key: ro.product.model com.larpyzito.tcoaal - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.larpyzito.tcoaal - Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.larpyzito.tcoaal - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.larpyzito.tcoaal