51baf4bc48db631e887ded88c0beb05b7a2f6f26ad2d122ee7c6cca6678752f5

Resubmissions

04-08-2024 12:30

240804-ppf4psvfkq 10

Analysis

max time kernel
177s
max time network
176s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
04-08-2024 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FE_Invisible_Troll_Script.apk
Size

3.2MB
MD5

3ff43582aa468b8a8d0e063dcfea73bf
SHA1

5d1d34fcec8f715ce045a5bda04741d40f29001b
SHA256

a6f56581bb7ae7b242fcaab3d97d04ec2c5ac8aa5870e4e64ffbcf0d78899993
SHA512

6af7639bc336015161f3087519e1a365ece0d1e0f5f7f20fe1af3243d1e6c3a0f65e38b50dc70f15cd13a232989b22884ca36bf0151630223d37bdba4f250149
SSDEEP

49152:hrOpp2RqaP3KdsFeHcEKYC4KiJK5ncPjPuE/UpXSkdkIDk5sSEj6QiVterxzrK:hYgv6dsFt0FQnGD/UsrLEjS81PK

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex	5088	com.herocraft.game.freemium.catchthecandy

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.herocraft.game.freemium.catchthecandy

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.herocraft.game.freemium.catchthecandy

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.herocraft.game.freemium.catchthecandy

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.herocraft.game.freemium.catchthecandy

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.herocraft.game.freemium.catchthecandy

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.herocraft.game.freemium.catchthecandy

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.herocraft.game.freemium.catchthecandy

com.herocraft.game.freemium.catchthecandy
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5088

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.herocraft.game.freemium.catchthecandy/files/Iksc

Filesize
384B

MD5
2a360640f3c7f0591d34044f31d4d5a2

SHA1
bce3544325766541eebca2849affc392dbfe8e1c

SHA256
698e8f50d4b9eb2885726db4d1f480a9261258f70f0e50a382342b585b774ba1

SHA512
5a9e8519e96a8741d6327bdce80d86b7eab9f4ca895278d442735bab15274bdcd7760d6c1e22fc2a316d2a58e32e8834a919240cdb343148317c59b6e3f82cd6

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/Iksc

Filesize
681B

MD5
bea431cfa9db90ef1fe3a5ee1bedaedb

SHA1
7bfbf30feb16ab0839902e8f40f6ba874031d0ce

SHA256
6c176005b3321d27294ffd0a4d8e5fefce65778373973a78bede260502601087

SHA512
5f6f0b6842b25516b24d04202d8c0b0e37b9ba1dca0dbe26fe20ba729031784df3fded3472ee17a65fc40e4654c800aa14f9606f9943152453d05e235689e7fe

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/PersistedInstallation2766970602771739892tmp

Filesize
567B

MD5
0c1dd1d4d86517e75ff2d8aad3c7cdb5

SHA1
80284c3b3e07c9a6a16c0fe31f73b75b07e2ba25

SHA256
08787fd01e289901a509c684593ba0c7e51732206aab9df36bc075b3682de3bf

SHA512
ebe83e94f5310fd28ab60ab2432ae2649f5b6127a29178aa1dcf08899c515b0d4f42bb23fe0f03c932303972c9d8c07d73ec2761beb28386c98ab260259fdcf1

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex

Filesize
2.3MB

MD5
d951efa7f0ca59781f3af35949338902

SHA1
ac853df2b6835dbac7c94eb008ab4657e68eda70

SHA256
5b0a0d3671f6ff3ea0001624a0c157d057965e60891c5335391880fe9b00e183

SHA512
8fbbc1c347ec03478b01ff321d159656abfcad1d9ac3b426382348567c57bbaf1cdb3cac77c38fbcf62e0e17063f170fc9f9bf200a982b940dcad47e30b05617

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/kNp

Filesize
229B

MD5
fcf8595f3f97d84349798eb54f5e7046

SHA1
c18244aa40d5c75e361387e354a8018d385ff00c

SHA256
951011eb94c2b3acb4bc749b5ecbb0f843c2240daaa7cbfd5cae4726c3bf8d99

SHA512
4b2aa7ff10a60e07bc05c11352683f9b1c6bfd348e8e4cc9c86f2eeae6cee45325cd91ad43fef549e86db53d0b2cc2354314064bc1444aa3dd8ee95f8f6186ac

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/kNp

Filesize
229B

MD5
51c6726c6bf0f9c2d08e7a8691a44d7d

SHA1
6f73531d46b13412affe6224bd86472504cb88b6

SHA256
464ef4d427590b66d6ad89eeb886742efd3e483b3f33e0cb3a0568eb7b7fe50c

SHA512
b1274e7f7262a8a71e6a509d98d398359ec4246aacdc43ce35e43c8597d2d712eb5a411c857cae1663cab35a05e25804d66979fe779ab06682b169826370b9a7

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/kNp

Filesize
229B

MD5
4914273c193d912bdf2cf3c73ea11f7c

SHA1
c283ed99eb84f99e51f585dbe131e69de67588aa

SHA256
874b8ac230782247480dfd4c8c6703bd35923d7dbe8e0c8afbbd59ebe0220ee5

SHA512
e85db149bd93c03cc1d3b77c64d3945e89797c006dd1f4482836b16d53816f321a9296f43ff8317f167612988b3b01cacb519397ee58cedcb6d8626b5af1ae58

Download Submit
/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex

Filesize
6.4MB

MD5
767a8ce605249b314939882f824f989a

SHA1
7cb1e61d4fa739b92b25d13bcf33bbb00cff9baa

SHA256
26d8b34344e6e61c8a1380e9773109569accb467b36f954a1e5c729a4d701fa5

SHA512
baec83cf6d66fc0dbf13411043c8168acf38b0b66a9c20f9b1ec54d6f5ef21527d22b4c47dd54734dcd5bd85410dc3bb8fe786fb1702443beee9a42e869c4475

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads