Analysis
-
max time kernel
176s -
max time network
139s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
05-08-2024 01:22
General
-
Target
FE_Invisible_Troll_Script.apk
-
Size
3.2MB
-
MD5
3ff43582aa468b8a8d0e063dcfea73bf
-
SHA1
5d1d34fcec8f715ce045a5bda04741d40f29001b
-
SHA256
a6f56581bb7ae7b242fcaab3d97d04ec2c5ac8aa5870e4e64ffbcf0d78899993
-
SHA512
6af7639bc336015161f3087519e1a365ece0d1e0f5f7f20fe1af3243d1e6c3a0f65e38b50dc70f15cd13a232989b22884ca36bf0151630223d37bdba4f250149
-
SSDEEP
49152:hrOpp2RqaP3KdsFeHcEKYC4KiJK5ncPjPuE/UpXSkdkIDk5sSEj6QiVterxzrK:hYgv6dsFt0FQnGD/UsrLEjS81PK
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.herocraft.game.freemium.catchthecandy1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.herocraft.game.freemium.catchthecandy/files/IkscFilesize
697B
MD52ca6bda9f648c0dbf35b37a62e7de8b4
SHA18604a21d698bafd351bbfa785343e992b27001cd
SHA2567d2312c3ef64533beef6e8c06edb6afc584a7d11e7100c017967812f49316352
SHA5120a56599157c17ce43bf9bed1f175efa4453b32b52e2e43c2fd551e5e437202e7898a74925a74e786b39c66f88b4a46e2d8864eb9009227d9bba9814857ad2d40
-
/data/data/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dexFilesize
2.3MB
MD5d951efa7f0ca59781f3af35949338902
SHA1ac853df2b6835dbac7c94eb008ab4657e68eda70
SHA2565b0a0d3671f6ff3ea0001624a0c157d057965e60891c5335391880fe9b00e183
SHA5128fbbc1c347ec03478b01ff321d159656abfcad1d9ac3b426382348567c57bbaf1cdb3cac77c38fbcf62e0e17063f170fc9f9bf200a982b940dcad47e30b05617
-
/data/data/com.herocraft.game.freemium.catchthecandy/files/kNpFilesize
229B
MD57ce5d7cded3512aea50c6d450ea6f24f
SHA1a93b862e88d944dbf4745901e9639e23dab0f0ef
SHA2569702d9eb10977318202b643eb13f16f4f31fdc42f456fbc49cd71243e7f99643
SHA512dff68f564a25ae69918b41039faf02fa5a9268b1bc1ffda8f590a819347654520dbb930d1fdc9822ae56282007fa240605386510c89ce4e32b3a64aafae28bff
-
/data/data/com.herocraft.game.freemium.catchthecandy/files/kNpFilesize
229B
MD5acd829190074a21b9ab12e3cc9067b3a
SHA1f48ffe0c0eaf20fb949b13fd15d27f36eca16e2c
SHA25677e5fe94a86ace5241051aee3a9703d171b2591837b90681c3f7c9c9f25e6ff3
SHA5129df2c721338f38f66e1ff832d22a048061947e7b38af56b198eff49f529749c25a9c0a470ab08f527114a1dc85a569dc7ba27e459771f22c7b44aa62b4e958a0
-
/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dexFilesize
6.4MB
MD5767a8ce605249b314939882f824f989a
SHA17cb1e61d4fa739b92b25d13bcf33bbb00cff9baa
SHA25626d8b34344e6e61c8a1380e9773109569accb467b36f954a1e5c729a4d701fa5
SHA512baec83cf6d66fc0dbf13411043c8168acf38b0b66a9c20f9b1ec54d6f5ef21527d22b4c47dd54734dcd5bd85410dc3bb8fe786fb1702443beee9a42e869c4475