Analysis
- max time kernel
72s - max time network
155s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
02/11/2026, 12:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
read-it-back.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
read-it-back.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
read-it-back.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target read-it-back.apk
- Size 3.8MB
- Sample261102-plq5hattgw
- SHA256 d688ccf4e3618d6a048215904e273b9db48b1e4994017aebbc608118f86aa3af
- MD5 6bb52fade1e86b56a3a0af6c120d9d31
- SHA1 65c0aaa6a1387fba7320c2598ed70a3a921ff6c6
- SHA512 a64641416717a9d8321ecd02f7c4cb5a52383631900e6b84d65d04b08edebf70b4021bf9390c79d4c34ad9b1a6d4fab9fadbc7fb8c0beac4dd28572bc3bb4ed4
- SSDEEP 49152:tnUTXUCruCS4lyHDVoh0xYLtdQVs/TekJT3QUSUuJpqW4Gc6+5yg55PgbJYIDAgJ:J+NruCS4ix7WVx3IKGp+YgzgFYuj+r4
- TLSH T1F3061283E7E6AC1FCC3784324F6B563106268E23D552D70B9AA4362C6C776D4AF84BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener dev.pages.readitback - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone dev.pages.readitback - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver dev.pages.readitback - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo dev.pages.readitback - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo dev.pages.readitback
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/dev.pages.readitback/files/profileInstalled
- Size 24B
- SHA256 7f6fe9f84d3f2a6a95ea88b39073eb1d0ea9849fb6d1b28d3e027ac22e9c90d3
- MD5 a4b6f2c72315caaef50592b4573abba8
- SHA1 6fab231d0f96003441fd96de6132f418f8bc9acc
- SHA512 6cd0939048bfd540665fd0a4dfcaedcd60e78e20c2e3cb33d6b553002c9e4e52ed6180965735f8f345daddb398a732011cb5c6329974876bf5e18bf59f6f1c0f
- MD5 SHA1 SHA512
- Path /data/data/dev.pages.readitback/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 b30363aed9dd7b39c5602e84df1753d5ccf3273b732170ed1432a674e8700736
- MD5 70d5cd27e74dfffc871809ea581c9d1a
- SHA1 5f372a9ac94a2ae3caac531d92c6f16d77f09d43
- SHA512 47685ddf9647e17d951abbcbf5ac8927bdedeba975c36e3a162afa33655ac901d946301b4561ba37f8ab6fd749cffd6fc68e23f9576bd61e8ed11a2a00314751
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/dev.pages.readitback/primary.prof
- Size 2KB
- SHA256 7b5d0237ac3922bbd185a3e5ceec8f83da09bcab0878e7f886003911bb4a3914
- MD5 7b51f6aa07ebbe5708b33ff7c2c278b0
- SHA1 04175e4bcd05edeaf5c14ea9ddd52ce9b877e452
- SHA512 c0dfb7465f2d63d4ac64760d97e2409a34ee8b983100829fba7a019d40f18ac55583ad4025986d8e985d7bc34adbfd9fc86f2de6f54fd794208b7fdd37adaa22
- TLSH T138513A0B8B0C62155736AF5DEB5B0943A818F4B426136677AE5B851D10ADE7A1EC0541
- MD5 SHA1 SHA512 TLSH