8e14be9063b3fb220c4ac416996bb2e207cf8aa9cd2aec65920e4844846697ec

Analysis

max time kernel
149s
max time network
152s
platform
android-13_x64
resource
android-33-x64-arm64-20260708-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
submitted
02/11/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Varmlen_0.3.2_arm64.apk
Size 21.2MB
Sample261102-ltp1masvcs
SHA256 8e14be9063b3fb220c4ac416996bb2e207cf8aa9cd2aec65920e4844846697ec
MD5 0796cddd39e3d52ce69bfa4be7fc3ed2
SHA1 54a2afe3f00d1c952d52f5a6da0e31f4427e148d
SHA512 4ba5fd95c2aea0a544cf0e12390161a12ef0f7feeccade0eac666a2326341811ff7f4669b3ff94a3505fcab0dc9349913979943c5bc4d38f55c660894a8420c3
SSDEEP 393216:Pb4EZSYTbJ7pb0g+jFCTBkFrPmGzYq6mqVQaeen6OuhKOyZl7LlcOew:Pb4EZSYnppH+RiqrS7Reen6OmKdZ/cO9
TLSH
T138272397FB995E2FC87710F2496E563162474D168A839B836C44371C29BB2D43F8EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	app.varmlen.client

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	app.varmlen.client

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	app.varmlen.client

app.varmlen.client
1⤵
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4191
- /system/bin/ndk_translation_program_runner_binfmt_misc_arm64 /data/app/~~BYQepqLy0a4HfiguSBW-Sw==/app.varmlen.client-dAwhguXJl7GelbJfuSRXMA==/lib/arm64/libxray.so /data/app/~~BYQepqLy0a4HfiguSBW-Sw==/app.varmlen.client-dAwhguXJl7GelbJfuSRXMA==/lib/arm64/libxray.so version
  2⤵
  PID:4345

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/app.varmlen.client/files/profileInstalled
Size 24B
SHA256 7d1ab1fe40cab95b5cfba226ad29f593de15808bc5df0582e8e77829dbc40446
MD5 8df65209160309d0e288fc8973a44e54
SHA1 d5da41d3a5f335516ad354dc612d1ed27a2374a5
SHA512 9042fd7fc3777f7342e7748b735ee0bf428abbee44353070c3155de2d77e7cb954014b8824bf53abcf3ff52ff442001ba75615791b2318080aba9fecabbfe080
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/app.varmlen.client/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 d4c21aef4e77060a45b1c7eea2aebe1a40fe077311426b7b35d30f93aa8750ed
MD5 f73a78d57b5a332b261941c49c01c476
SHA1 9284f125c971446d83a8bc7b0d8bdc8f4689ddce
SHA512 4efda761ad1a20c8191238b774a4b440bc04b3e3ba2cd77a13b7fa20807f5b794c56755ac5043587f465a11b6b85c1c81cfd79940fa956c816c67a51e6219ffa
MD5 SHA1 SHA512

Submit Download

subscription-refresh-schedules.json.tmp

Path /data/data/app.varmlen.client/files/subscription-refresh-schedules.json.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/app.varmlen.client/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
TLSH
T183810250534000E1D05446B354E113080F06D19496428B03550100428C415440C60E88
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/app.varmlen.client/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 72c636c1b5ffe971bb38e6d1a067d05da4db6c2c40b545866c51e3439adfdfdf
MD5 a75271f08c0072da314b01861ce7e264
SHA1 d073a650a43ef30fef2e80d96402024ae1b89cbd
SHA512 5881abf42f1d9f17cc163a9004c55ca3b3057c5c734a480220738f4a1cbb5965b3938c8ee192fc8b3d4c6cbeca7ef141839f60ce7908e8ba93d6ba2a1e6e761b
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/app.varmlen.client/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/app.varmlen.client/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 0c43e2006770a9f4725f6229428fecb4fe953f6875a950b68a3b65f02c53ab5b
MD5 98b3467a81e049a1d9fe9324a44c95ea
SHA1 8715336dd1ef37b5729d6a022cc81d8e9f783310
SHA512 fd10cfe3e3eb65a9249f02bc96ceacae516e0d65314cb910e8c012fc81cf06e4f4036ee37d05033ac51102be81d331ec5e698314b54080b6d8ed8cc42f3148e6
SSDEEP 12:KV5GllA5DRzdKBRmBEyPbP/P5f65J65p/LiOw2:KyizhGSP/UeD/Lw2
TLSH
T1D972C25972402AC2D5097B3BC6F4C3859D60EA389763C7CB1118CA326C02FC8A890D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/app.varmlen.client/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 f5cfd39e95a7e6ef6e6b05ad72b23a09465b6da392148e2c0c437fb7d4bcf53e
MD5 9f02003bd4d55b7786c5f80fca15a2a0
SHA1 c8e992fd872af2f50fe32d8eab1412f10d103fe4
SHA512 7cae1b399ae38aef1f6399195a05fb53e98cc08b00f751ce4626455197741605d38d054d817db85b3b9f1dcbab7f8d50a23ed54872a9bae8b9f2138850a3b9e9
SSDEEP 96:L4tooj6+etidjnZRWzzb8/KeKcK+zSLvtKz+eD86u0ExV:L4tooYtidjnfWzzb83zSLm+eD86u0ED
TLSH
T1C4C3528D1F592640C0A964B0E6F00FE1B93E853E9793E3E1659181B5ADD2C21DA29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/app.varmlen.client/primary.prof
Size 1KB
SHA256 cfeb9392e1efcfbaa65ce4c66a7f3e59ec72849edd19e5ad7e40ba402596345a
MD5 2097175e886b2749d1f958124f603a69
SHA1 8efcad77ab8730b542bb352c9f59930933f03190
SHA512 3a58bb5b14472ff88fe78d4256959d1b564470dfdf63ff0c1e1a5149fb8c5f7ea23f9839341e782b9a3a1a8d7b4c25913a4a9cc101093b6ec3b4c636d05ad0ea
TLSH
T1C921E96A6380B396E58452B139501D16CEF7CE65CC6B3C53A0D77A9803836D048608AE
MD5 SHA1 SHA512 TLSH

Submit Download

socket:[59447]

Path socket:[59447]
Size 39B
SHA256 277016ce3a1d2b651ea96f1e2b05bec5ea12f697c94d65b528d46e04f7fdd874
MD5 1c01b5201c892446e32df7da2bbc2de1
SHA1 1d717bea998f4f9fae4ed62ddc05e02c3a0f18d3
SHA512 204b04a0fbf3742c29efc87dfe4f9708385d1ea5255ce046ecf7cd760d3c9bb6fb4483c77df179ebde6d3f9cc21842c71e98fcf98bfc7f9e1dbdd3a50bfcf975
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads