51baf4bc48db631e887ded88c0beb05b7a2f6f26ad2d122ee7c6cca6678752f5

Analysis

max time kernel
9s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
05-08-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FE_Invisible_Troll_Script.apk
Size

3.2MB
MD5

3ff43582aa468b8a8d0e063dcfea73bf
SHA1

5d1d34fcec8f715ce045a5bda04741d40f29001b
SHA256

a6f56581bb7ae7b242fcaab3d97d04ec2c5ac8aa5870e4e64ffbcf0d78899993
SHA512

6af7639bc336015161f3087519e1a365ece0d1e0f5f7f20fe1af3243d1e6c3a0f65e38b50dc70f15cd13a232989b22884ca36bf0151630223d37bdba4f250149
SSDEEP

49152:hrOpp2RqaP3KdsFeHcEKYC4KiJK5ncPjPuE/UpXSkdkIDk5sSEj6QiVterxzrK:hYgv6dsFt0FQnGD/UsrLEjS81PK

Score

7^/10

evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex	4344	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.herocraft.game.freemium.catchthecandy/files/oat/x86/f2f8f843.odex --compiler-filter=quicken --class-loader-context=&

com.herocraft.game.freemium.catchthecandy
1⤵
PID:4318
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.herocraft.game.freemium.catchthecandy/files/oat/x86/f2f8f843.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4344

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex

Filesize
2.3MB

MD5
d951efa7f0ca59781f3af35949338902

SHA1
ac853df2b6835dbac7c94eb008ab4657e68eda70

SHA256
5b0a0d3671f6ff3ea0001624a0c157d057965e60891c5335391880fe9b00e183

SHA512
8fbbc1c347ec03478b01ff321d159656abfcad1d9ac3b426382348567c57bbaf1cdb3cac77c38fbcf62e0e17063f170fc9f9bf200a982b940dcad47e30b05617

Download Submit
/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex

Filesize
6.4MB

MD5
767a8ce605249b314939882f824f989a

SHA1
7cb1e61d4fa739b92b25d13bcf33bbb00cff9baa

SHA256
26d8b34344e6e61c8a1380e9773109569accb467b36f954a1e5c729a4d701fa5

SHA512
baec83cf6d66fc0dbf13411043c8168acf38b0b66a9c20f9b1ec54d6f5ef21527d22b4c47dd54734dcd5bd85410dc3bb8fe786fb1702443beee9a42e869c4475

Download Submit