700646a0cdf33ce7fc45d944bf0e34aff1ed6eb86623c904b389f6df86231104

Analysis

max time kernel
35s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
01/11/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
syutaxi-1.5.1.apk
Size 5.4MB
Sample261101-wvml1ach84
SHA256 700646a0cdf33ce7fc45d944bf0e34aff1ed6eb86623c904b389f6df86231104
MD5 aaba723f9797fb0ec2426799c6f7d194
SHA1 9769d62d9c00b146cba63a7b14ea509015bd4ff9
SHA512 75f81ce1f4505b3c97a2d3cf4bbe6c9485dd999c5676ecee0d0f81db85d86952f368acb371c0b5fc3fc5ea083dbaff3879d93c797dfa3ed435e5a81b34e02e8f
SSDEEP 98304:WedxtO3L2NFWS1xKB0TAi2kyc2klWS3GgXpTLWJJ6Jsrobp37+Hx++:fdnO3uFWS1xc0Tc3cWSfLWfKaury
TLSH
T175461242FFA5D92FC87380331D8A137156169E1EC682A70BA5DC33296877AD80ED6FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	kr.syutaxi.app

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	kr.syutaxi.app

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	kr.syutaxi.app

Checks the presence of a debugger
defense_evasion

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	kr.syutaxi.app

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	kr.syutaxi.app

kr.syutaxi.app
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4703

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation1700969763330760819tmp

Path /data/data/kr.syutaxi.app/files/PersistedInstallation1700969763330760819tmp
Size 90B
SHA256 4bfbd4f99f2d437acc0e66156e9fb194d8a32bb74024546a927612ff0cac0d9a
MD5 33c47612e6a5d63535de51a56fd944d6
SHA1 72f6e3a21c32b4e678e618d326b457219c59435f
SHA512 9440b7160b72c5c0080d9bc01b5f71ffe07985e15fd642260e3bdc1b48d30c115a448efe94c51e8da42930bf916f8e39f1dbd0a07e6978a28964ae9fae6142b1
TLSH
T1FFB0124286304251CD86A6033C4C91006E841481594ECF150F08A04041D12D89163EA4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation2026316279068967040tmp

Path /data/data/kr.syutaxi.app/files/PersistedInstallation2026316279068967040tmp
Size 569B
SHA256 a90c87e343839a9edbf6944b1fc03cd977199d21cec9dde49529ce3e4a47f879
MD5 2bde2c530892ebbbaf985f7531694ed9
SHA1 55bf19d42ba4cadcf6112c89bc5eeb22c5173cab
SHA512 612490d2bd141d7d62cba1d5817e266c1cee4bb203533ab4e4ec29986a435ad5c079d2d0d9109edc26804c60a6ec8debe9e923bae2fda2f7bdccfdc5f5827e5f
TLSH
T1CFF096162031C905CDCB2AC3A47DFC207C0460F9750F05F8AF4F909462A879C530B344
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MToxMzE0MzQ2NDAyOTg6YW5kcm9pZDo2NDg1ZTdkNGFhMTkwYjM4NGE3MWQz.preferences_pb.tmp

Path /data/data/kr.syutaxi.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMzE0MzQ2NDAyOTg6YW5kcm9pZDo2NDg1ZTdkNGFhMTkwYjM4NGE3MWQz.preferences_pb.tmp
Size 321B
SHA256 0bfbaa1d432e9752ae525c334d2bbcf1d0bbe08957a93e3234787962c072c980
MD5 5a38368ca83aa4960f3737b5f2043f7f
SHA1 837fbd7e2400ec3e70c2e0616cdeb729fe78e17c
SHA512 df407c646de59123393bab027b05386887d755d584030605f7be873af9c6a67c3d53dc6ce1c7e8064cdd67f7f7033d5f66005ac0e703357d3e2774778e9008f8
TLSH
T1E0E02600D6A1AEE01A2F118D3FB802280F2FB3E26276049921F40080B50EA55D1C2F1A
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MToxMzE0MzQ2NDAyOTg6YW5kcm9pZDo2NDg1ZTdkNGFhMTkwYjM4NGE3MWQz.preferences_pb.tmp

Path /data/data/kr.syutaxi.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMzE0MzQ2NDAyOTg6YW5kcm9pZDo2NDg1ZTdkNGFhMTkwYjM4NGE3MWQz.preferences_pb.tmp
Size 345B
SHA256 bee087c2d80837eace692b3531cdb2f70992bedae119564365b69af567a93590
MD5 01bdca8be07852c792947705dd4fc50b
SHA1 439a8be40b61521b7df227dc2c6379f15a917be1
SHA512 9cec3ba804570a6d66922eabf743c33b5ca0d07c942f15b6b9f735cfeb8a00fc21e5762d926631041a17fbfece64e4b34f2d9a56ce1f1af0acbe61435f750c2d
TLSH
T137E02000DAA19EE1157F514D3FB8122C0F3FB3D2657A045925F84040B50EA55D6C2F1B
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/kr.syutaxi.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 f3a196d4fa78101c6582b15d5a54c6879879946c6e9fb815f297e42627c139fd
MD5 b8ebfa9fdd607851dea3253fb85121e1
SHA1 b8b827a37cde483122d66d9cb2e59176d3258d3b
SHA512 4e316f73ad8489cf155b576e3fa59d337a096ca61f1828e596d0245d4ad6756a7acc3b5e7c96fa34f7c07b9501237fa4de33717a60f1e6f4666ba913367cf843
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/kr.syutaxi.app/primary.prof
Size 2KB
SHA256 601684a5a8db9ee6ee2b8604de12d97f98ad3b1e2b9e50d75c42a0f8f2bc4962
MD5 f6da19a8a9c911842b6725cc15615f0d
SHA1 4c8612ab01741aa9ac05b42973e274df9c8efdd9
SHA512 6357d3d264bd7f6fbe7652524b9717c8b502fa5929073a1b071b5351771856af5cea3767eca507d578e18f861f71a9937a1d01b6a25c4428f157b44afc3c40f3
TLSH
T1C441E865B078051A49192BC7CDF6400353BFB9783342258A99DFADA257CF044A9CCBFB
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads