Analysis
- max time kernel
137s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260721-en - resource tags
arch:x64arch:x86image:android-x64-20260721-enlocale:en-usos:android-10-x64system - submitted
13/11/2026, 18:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
t200.apk
Resource
android-x86-arm-20260721-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
t200.apk
Resource
android-x64-20260721-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
t200.apk
Resource
android-x64-arm64-20260721-en
3 signatures
150 seconds
General
- Target t200.apk
- Size 348KB
- Sample261113-wytjqaex2m
- SHA256 9f4bbafca9a1aa36be219c8bd04da04c1606f8ab4c244a05c5c5de713c6869e5
- MD5 cc349de3aa7f0d2d826d130853cb2bed
- SHA1 20a9b4d560f1a946d0532875dc177a44ad8eea64
- SHA512 fbcb92a8080201b727de676b88434d7c395b86155b00b13eecab0d335a901ecffdbcd1b63732b9889964f14d2b4fc422799fd27bb364c362896e4198cfdc81db
- SSDEEP 6144:jlcrX8SX+lcrX8SX1lcrX8SXFlcrX8SXOlcrX8SXhi:x47XQ47Xz47XD47Xg47Xhi
- TLSH T1F27402DAE265D0A0E093CDBC471AA803EF40F5487691294F1476D11DFCAAEF39C18E6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.t200.t200 - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.t200.t200 - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.t200.t200 - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.t200.t200 - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.t200.t200