d6c670c7a27105f082108d89c6d6b983bdeba6cef36d357b2c4c2bfbc4189aab

Analysis

max time kernel
1229s
max time network
1222s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
07-06-2024 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fnaf2 aptoide.apk
Size

549KB
MD5

dc98efd71997adb619bfc6e09b3df258
SHA1

50d0d722d4af4a863a19749dd7ef680c67662aa2
SHA256

d6c670c7a27105f082108d89c6d6b983bdeba6cef36d357b2c4c2bfbc4189aab
SHA512

1903987f5cd074bb672cf335442178a0820bce6e02dc5a04bbbd894c2048bcb068c85e6cefd3663bd0505a20c0651dcfcbb60760f2c5744e344af6f7a627ade7
SSDEEP

12288:pVH6+G//njU81lWGiZrqCx5cVS3EVqPlR6i0Ci3jM34D9I:pd6+GQ81lseCPOS3EW6i0C+M3SI

Score

8^/10

collection evasion impact privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.scott.fnaf2

pid process

4258 com.scott.fnaf2
Reads the contacts stored on the device. 1 TTPs 1 IoCs
collection

Contact List
T1636.003

Processes:

com.scott.fnaf2

description ioc process

URI accessed for read content://com.android.contacts/data/phones com.scott.fnaf2
Tries to add a device administrator. 2 TTPs 1 IoCs
privilege_escalation impact

Device Administrator Permissions
T1626.001

Account Access Removal
T1640

Processes:

com.scott.fnaf2

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN com.scott.fnaf2

pid	process
4258	com.scott.fnaf2

description	ioc	process
URI accessed for read	content://com.android.contacts/data/phones	com.scott.fnaf2

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.scott.fnaf2

com.scott.fnaf2
1⤵
- Removes its main activity from the application launcher
- Reads the contacts stored on the device.
- Tries to add a device administrator.
PID:4258

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads