Analysis
- max time kernel
25s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
07/11/2026, 12:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cunwutong-1.6.6.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
cunwutong-1.6.6.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
cunwutong-1.6.6.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target cunwutong-1.6.6.apk
- Size 3.2MB
- Sample261107-pjv1nsysdz
- SHA256 29f2f1bfb195aca71e9d9e5e81ceac00dc00d50a1e18ef079abde4ac673da794
- MD5 e434cdd4c2747d4731aba4a5645aed7a
- SHA1 f8569cb82e6efe8c0a805d9cd82040e4b796b518
- SHA512 465afe9a9ebc9fb50a375c0be4d014834bfa8490c0e40462ed451df6056751ac906e79d6ad6ebcbe72883b651dfbad89d718fdafa0122c770e18dc91671b710b
- SSDEEP 98304:XsJxA4uk9dq48rIoWu/AgA6X/2jhEnym/lFqpPX:8UkqrUovujhEJE
- TLSH T1CFF50182F7E66D2ECC3749360F9B626153568E13C683C70B9A98763C6C732D48E55BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener cn.cunwutong.village - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone cn.cunwutong.village - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver cn.cunwutong.village - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo cn.cunwutong.village - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo cn.cunwutong.village
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/cn.cunwutong.village/files/profileInstalled
- Size 24B
- SHA256 4be4db6f522d5505572fe25aeeb315f847d25f62fea2e6c8d7eeef805690f119
- MD5 18f8bc9f2ab7950589d37058a4718366
- SHA1 4b33da9b7b4b4a59614fccc3ff49ba064d0a596b
- SHA512 0f2507157448849ad04a12b7f870db5c253ab2aa56c3e31e4b2a813ed32062131b60191daeacecc074e704ff1da0bd985a7ceead571b9e3a70e1ea772e570d66
- MD5 SHA1 SHA512
- Path /data/data/cn.cunwutong.village/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 059a4b4dcb2a9ea1683999bb21271f166d0e8adcc21223d5fbdc39757fd37614
- MD5 1bd525d024f2ed2529840684d19cddfd
- SHA1 c39e79f577280148ad2233edc356391b1bcd27c6
- SHA512 38bb08e80ef1e75b0600be99dbbc558ce0251232362a93cce635a71ef2fa5c2371ddc58bae86790d3d88ec9a9ec82cf1e91b0d56e5136b01825d22bc299ceba2
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/cn.cunwutong.village/primary.prof
- Size 2KB
- SHA256 9a9d9beb84b198570c910e946a800e76ede040891caecb6682edd0dafc75258b
- MD5 3f60c4bf000ccea2543fdd7595eba2d6
- SHA1 dc04c3a3700c0db2551ab087a3f9e7ff2774cb0a
- SHA512 abafdc587d223fc4f52c201449a13ea41ab949c39d85b35e7f0451b3bfa10c42cc194170697cc1d7dfe49856f8f4820357cd6364f66a84f0f14d32cd610ef186
- TLSH T123411AD5CAC2C85698ACD334D201166AA99F5164090F3CB70DCE2D69A8F68FF7175853
- MD5 SHA1 SHA512 TLSH