51baf4bc48db631e887ded88c0beb05b7a2f6f26ad2d122ee7c6cca6678752f5

Resubmissions

04-08-2024 12:30

240804-ppf4psvfkq 10

Analysis

max time kernel
177s
max time network
176s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
04-08-2024 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FE_Invisible_Troll_Script.apk
Size

3.2MB
MD5

3ff43582aa468b8a8d0e063dcfea73bf
SHA1

5d1d34fcec8f715ce045a5bda04741d40f29001b
SHA256

a6f56581bb7ae7b242fcaab3d97d04ec2c5ac8aa5870e4e64ffbcf0d78899993
SHA512

6af7639bc336015161f3087519e1a365ece0d1e0f5f7f20fe1af3243d1e6c3a0f65e38b50dc70f15cd13a232989b22884ca36bf0151630223d37bdba4f250149
SSDEEP

49152:hrOpp2RqaP3KdsFeHcEKYC4KiJK5ncPjPuE/UpXSkdkIDk5sSEj6QiVterxzrK:hYgv6dsFt0FQnGD/UsrLEjS81PK

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

com.herocraft.game.freemium.catchthecandy

ioc pid process

/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex 5088 com.herocraft.game.freemium.catchthecandy
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

T1414

T1641.001

Processes:

com.herocraft.game.freemium.catchthecandy

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.herocraft.game.freemium.catchthecandy
Acquires the wake lock 1 IoCs

Processes:

com.herocraft.game.freemium.catchthecandy

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.herocraft.game.freemium.catchthecandy
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

com.herocraft.game.freemium.catchthecandy

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.herocraft.game.freemium.catchthecandy
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.herocraft.game.freemium.catchthecandy

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.herocraft.game.freemium.catchthecandy

ioc	pid	process
/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex	5088	com.herocraft.game.freemium.catchthecandy

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.herocraft.game.freemium.catchthecandy

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.herocraft.game.freemium.catchthecandy

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.herocraft.game.freemium.catchthecandy

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.herocraft.game.freemium.catchthecandy

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

T1422

Processes:

com.herocraft.game.freemium.catchthecandy

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.herocraft.game.freemium.catchthecandy

Reads information about phone network operator. 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.herocraft.game.freemium.catchthecandy

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.herocraft.game.freemium.catchthecandy
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.herocraft.game.freemium.catchthecandy

description ioc process

File opened for read /proc/meminfo com.herocraft.game.freemium.catchthecandy

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.herocraft.game.freemium.catchthecandy

description	ioc	process
File opened for read	/proc/meminfo	com.herocraft.game.freemium.catchthecandy

com.herocraft.game.freemium.catchthecandy
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.herocraft.game.freemium.catchthecandy/files/Iksc
Filesize
384B

MD5
2a360640f3c7f0591d34044f31d4d5a2

SHA1
bce3544325766541eebca2849affc392dbfe8e1c

SHA256
698e8f50d4b9eb2885726db4d1f480a9261258f70f0e50a382342b585b774ba1

SHA512
5a9e8519e96a8741d6327bdce80d86b7eab9f4ca895278d442735bab15274bdcd7760d6c1e22fc2a316d2a58e32e8834a919240cdb343148317c59b6e3f82cd6

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/Iksc
Filesize
681B

MD5
bea431cfa9db90ef1fe3a5ee1bedaedb

SHA1
7bfbf30feb16ab0839902e8f40f6ba874031d0ce

SHA256
6c176005b3321d27294ffd0a4d8e5fefce65778373973a78bede260502601087

SHA512
5f6f0b6842b25516b24d04202d8c0b0e37b9ba1dca0dbe26fe20ba729031784df3fded3472ee17a65fc40e4654c800aa14f9606f9943152453d05e235689e7fe

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/PersistedInstallation2766970602771739892tmp
Filesize
567B

MD5
0c1dd1d4d86517e75ff2d8aad3c7cdb5

SHA1
80284c3b3e07c9a6a16c0fe31f73b75b07e2ba25

SHA256
08787fd01e289901a509c684593ba0c7e51732206aab9df36bc075b3682de3bf

SHA512
ebe83e94f5310fd28ab60ab2432ae2649f5b6127a29178aa1dcf08899c515b0d4f42bb23fe0f03c932303972c9d8c07d73ec2761beb28386c98ab260259fdcf1

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex
Filesize
2.3MB

MD5
d951efa7f0ca59781f3af35949338902

SHA1
ac853df2b6835dbac7c94eb008ab4657e68eda70

SHA256
5b0a0d3671f6ff3ea0001624a0c157d057965e60891c5335391880fe9b00e183

SHA512
8fbbc1c347ec03478b01ff321d159656abfcad1d9ac3b426382348567c57bbaf1cdb3cac77c38fbcf62e0e17063f170fc9f9bf200a982b940dcad47e30b05617

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/kNp
Filesize
229B

MD5
fcf8595f3f97d84349798eb54f5e7046

SHA1
c18244aa40d5c75e361387e354a8018d385ff00c

SHA256
951011eb94c2b3acb4bc749b5ecbb0f843c2240daaa7cbfd5cae4726c3bf8d99

SHA512
4b2aa7ff10a60e07bc05c11352683f9b1c6bfd348e8e4cc9c86f2eeae6cee45325cd91ad43fef549e86db53d0b2cc2354314064bc1444aa3dd8ee95f8f6186ac

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/kNp
Filesize
229B

MD5
51c6726c6bf0f9c2d08e7a8691a44d7d

SHA1
6f73531d46b13412affe6224bd86472504cb88b6

SHA256
464ef4d427590b66d6ad89eeb886742efd3e483b3f33e0cb3a0568eb7b7fe50c

SHA512
b1274e7f7262a8a71e6a509d98d398359ec4246aacdc43ce35e43c8597d2d712eb5a411c857cae1663cab35a05e25804d66979fe779ab06682b169826370b9a7

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/kNp
Filesize
229B

MD5
4914273c193d912bdf2cf3c73ea11f7c

SHA1
c283ed99eb84f99e51f585dbe131e69de67588aa

SHA256
874b8ac230782247480dfd4c8c6703bd35923d7dbe8e0c8afbbd59ebe0220ee5

SHA512
e85db149bd93c03cc1d3b77c64d3945e89797c006dd1f4482836b16d53816f321a9296f43ff8317f167612988b3b01cacb519397ee58cedcb6d8626b5af1ae58

Download Submit
/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex
Filesize
6.4MB

MD5
767a8ce605249b314939882f824f989a

SHA1
7cb1e61d4fa739b92b25d13bcf33bbb00cff9baa

SHA256
26d8b34344e6e61c8a1380e9773109569accb467b36f954a1e5c729a4d701fa5

SHA512
baec83cf6d66fc0dbf13411043c8168acf38b0b66a9c20f9b1ec54d6f5ef21527d22b4c47dd54734dcd5bd85410dc3bb8fe786fb1702443beee9a42e869c4475

Download Submit