Analysis

  • max time kernel
    1199s
  • max time network
    1194s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    27-10-2024 18:46

General

  • Target

    OnlyFans_1.04_APKPure.apk

  • Size

    2.9MB

  • MD5

    14e42693d58c00c1d693b12debbb2e9e

  • SHA1

    610dec649bd9e4c8fae2944fcdea9902098c85da

  • SHA256

    dcebcbe8587be01d79687b4ebe07a449da2506ae187e1aa150a9da17a752907a

  • SHA512

    ce7ef51758568efd1ca7ce9da8bb55f862a1ffbddc496abd34de4697b9aba0d076df17ca359cacbb90e4a67e8c990bbbd30254f20be433d9a3cf4b60c44c2060

  • SSDEEP

    49152:pNB3o9WWAI7vfJ7Q7H7fZWuBhcRua2X8GfhhAUHFRe5RCVtAPd/x+ciFlvMztxh:R3KX7VQ7H4uBhYEhyUH7ee8P1x+q1

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 13 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.very.onlyfans
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4336

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.very.onlyfans/cache/1664557424545.jar

    Filesize

    10KB

    MD5

    dfb68e70e8eb84d844c9ce623ee069c1

    SHA1

    369e761858a904fe9fb89efcfc9bd3e6e56ee44f

    SHA256

    8ba015cb192f34326e6a46f765c6712d87c3797661541275c84b9a30ee449eec

    SHA512

    0d5f8ff91d3cd5c976cadf774b8d5cd6f276793b9eb9f3d8e7168eae122b0bfcffd833be9762de441d4b52f7bb3eb3850479aea37ac327be9b71910c6fdc566a

  • /data/user/0/com.very.onlyfans/cache/1664557424545.jar

    Filesize

    21KB

    MD5

    722310b17c81cc3d780d23e1a63eb450

    SHA1

    0a0c1a939f923570e5da88aa5c7b105052f056e3

    SHA256

    9f2d7ff525ca785553557c351812252c0beface31440517e2f19929fe76472b1

    SHA512

    1a48e9383a0befb0c6b4755a8b56f352fba317910308f701e13ce8189c465cade6b0af510165d586745f1913a61cc68f91395949202394336a59c34596691a91

  • /data/user/0/com.very.onlyfans/cache/oat/x86_64/1664557424545.vdex

    Filesize

    948B

    MD5

    480d07e0214aeb0d51a0d29f6f0a6a22

    SHA1

    bb1a0580bf436ffe93d91756a9e2e646e449be9f

    SHA256

    e9e16898bfb89b40c3e9972f977730473d9b45ed0fdc5cbf868ff0e71f064290

    SHA512

    31c58c4bbeb49cc1ca7c705b829c55b50d980e9248277f9c96f1602fb1e6be8e7e3d3add5d3b002d28015822dc277e21905eec9dcc5685567c36e5ab97444171

  • /data/user/0/com.very.onlyfans/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    f220e6acbe4e2c185b96b37069ef71d2

    SHA1

    befa4a10270001773a9e14163fe6c564d330dc3b

    SHA256

    32adfcea333ffed3364151aa16b837483e10eed51bd1447bc7e15306905fc687

    SHA512

    4866b7420ff7cdec1437f299bd4f3d14e5f726f6270305ba88b75163c8fa8beeb8ba82655764d9d227f6fe55128622ba26501e4c797a3d637cb74a782bc31ba5

  • /data/user/0/com.very.onlyfans/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    ef4f50867eb84fe33daa4b66774aed48

    SHA1

    eacc4b85b4ff7821dcad4c0400f5f0462f4e557a

    SHA256

    ddc63cebe1b3bedd558521070a3ff4dec770507b50b806219f9f7562ba839917

    SHA512

    0db43cc1ab46a0886796d03e9cc71930622e4fdaf711ec79fd96033ee2c0b9dd43a093682639b1204faf299608f57eed0e988d64ded49e5eaee63e0be056d3c0

  • /data/user/0/com.very.onlyfans/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    6ed071b3eba69408959a265c6ae7eef7

    SHA1

    3690862c875e1a7096427ce2802e1697e5524e5b

    SHA256

    ab9ab51ec9b42c7cafa55389f469ff0870af40dd291eb9893dd3c8b06f6d43c0

    SHA512

    3733d16003c0cf66e2e22a63f5bfa4ead7436847e7d7fcd868cb7cbeb4910f45f6feae106699a0a8bc85200bdba8778ca8fded7afd51655ce166bf416fae143e

  • /data/user/0/com.very.onlyfans/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    7563a5a9e4f83dd781d41967c63c3ef0

    SHA1

    42f0102ae441c9bc4b393761c0d5c944920328e3

    SHA256

    7c4fc21481c3af33f9c7632a2ee98d91f093a1ee2dfb6bb2278e80cabbb27dda

    SHA512

    ae904feddc6040d8b0ba0650bb36fc63676a14f174956236a5b71ef43b928b9be62c543f14b1d8fb52555e69c96033ed6ea55639e11ad1c58c4c158d8931dac2

  • /data/user/0/com.very.onlyfans/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    b0b3df372bb6ddce6f500b4345c95751

    SHA1

    eba759c83b9f78e6b6e5e5f4de317b7418339042

    SHA256

    17f63a4f135a8368e51af25f31fc3ca5881b9f701452e251a98e246e3e506d62

    SHA512

    5caa0c9e7bf30a6f6573e341c952ceacb5a6bd35d240d2d2cc58c7ee41ecf130eef49a7516049366871391ec3c0e3ddd6d1cb1f4025034d2673bf2a5afc134a1

  • /data/user/0/com.very.onlyfans/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    62ad4a05cbdca7f47b3206b7dbda487f

    SHA1

    4f4044cef7b7b1e5c6184ed9025267fc92bf0cd3

    SHA256

    18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6

    SHA512

    0936531ed1b2b356a247123200739a43cfc765469ab47a424dcd6e3d1176092a212b0a28591d07f8c2d0cc9d2e0eeddfcea8dde314c2f9343783c61075b071a6

  • /data/user/0/com.very.onlyfans/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    866c3e8b330a4cc8a49fb2aaa3c4ecd7

    SHA1

    57978abb01586e5eee8bcc839a257fe16c900787

    SHA256

    3d048ab38b4e2c15c4de739cbaf822aa4e1056e8f6cfba19bdc9ab5531e2bdc1

    SHA512

    92853e00af45cc5daea34864f892419f7b609e7fa3580b098b0f1045bee45dc33d5112b022d2fadc9823b9d8f637ccf532b17c684d70bb5dd47f39ea9cf84b78

  • /data/user/0/com.very.onlyfans/databases/google_app_measurement_local.db-journal

    Filesize

    512B

    MD5

    ebc35b54f6c4423f2256e25ea197f11b

    SHA1

    bdfb4fcf883137713aaae12aef80518955367084

    SHA256

    5d10d551e8454c27cf727ca256fcbcca2aea3a7c51f935f7e4666aff15ec5892

    SHA512

    009288e132069a056cfb61fb59feea415c9c1d55d0c6249a1619ce9ec5cfaf8c1c35478a3866fc6da24a2fb2f1c5631c92ead5e04c1bf8b64378acaea66f7133

  • /data/user/0/com.very.onlyfans/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    4dd70b9322f6b8b86909153a6d7c0ff9

    SHA1

    65be9980e7518c71c3f9c9f892d23cb79bf46521

    SHA256

    b43e1ddd811bc7f5d7f902130986cd37b1f30586917b46e8c777be6d03a6a591

    SHA512

    dcb404ad5e616d1d2925b56f4baec7fd29f274891ab680e0582a222ff8a38d47b1ab361929511bf168bf644c7cedd9ef0dfb6e8eca959f994275ecc6a84da247

  • /data/user/0/com.very.onlyfans/databases/google_app_measurement_local.db-journal

    Filesize

    4KB

    MD5

    01ba6b80a78d83bda16e00b57de0d3cb

    SHA1

    dcb598e1c3e20d08264a1482ae9beec864e0cb2c

    SHA256

    79e00835c9f3529e454b39ff01f892588f7009d62905b76de3e9f79b8f2b3b74

    SHA512

    7eb78f38c8037591c3a14fa21a25f7d8fda9425b5e5e12a113829ea310959119d4c89632c54ade721a4110698b486eeef4d95639e414c3a48aa5f1ca1bcf0521

  • /data/user/0/com.very.onlyfans/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    13a0560965f42b209ef1373d63f7dfc9

    SHA1

    6481c2c9a6e81d46514c0f36679ba4719b3006d4

    SHA256

    5383c64d53f311e6515dfbe942fe72a66f25bddace470389efcf3ae958205d12

    SHA512

    8e7e34d3adc58c128e19edda8ab45044b4e70351ece66e113d3f189f2408db588f29b744b9e4ff9fb773e6aca2e47e174a98706592b5af818a3c679b368e12d7

  • /data/user/0/com.very.onlyfans/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    d74aa1dd50f655cfc6034a0212c25817

    SHA1

    f3324106463d52c25af4636e5b0b50eb161091a2

    SHA256

    518dd9b809c4abcb8e8856352b2f119fdb9aa644cefbbec12a3863c41e8d33b7

    SHA512

    02a40eba9887c7e30b55c5fe8cebc2d616104383f783b8b5ba822fec8490214198c2a38f627c8cd38ee4356d548b6939666610763ef1c3018e3d617a2ec2fe22

  • /data/user/0/com.very.onlyfans/files/PersistedInstallation5468789725819366464tmp

    Filesize

    90B

    MD5

    672db13987b74b90c1ea9d2dbc311e45

    SHA1

    f1321894750c5a4bf7e71ac4935cf37e97e1f10b

    SHA256

    b46a35f488e406b653ea040426007417c17da3cfba0872aa4a40b8430190ca2e

    SHA512

    56e0368eba0d6dbe13a1e28197ace06ec39bb92a497bd775ef0fa601cf4ab83ec5bc1c1b7eb3a189e3198cd0af6dcdcbce32ccc486739c8731c18c5290035607

  • /data/user/0/com.very.onlyfans/files/PersistedInstallation6589278396420639183tmp

    Filesize

    569B

    MD5

    b9fe5a1eb8294b701123a38fa276f5cd

    SHA1

    4469ded07e77df81d75a2faed3ebc23738074f93

    SHA256

    f2feccf6184405d3ae9964af67d3940b73c167da5c0b86bed00a4f8f24805330

    SHA512

    ec358480ed789522c99810de281165453b9eaf3c49c184d12a11b11a8184c10ab813f0ae42d124c0b2935de6eeb77d41742e8c475cf461f737e003d432f710f6

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-27.txt

    Filesize

    24B

    MD5

    98cc7a38820379829f91084ebf1c86af

    SHA1

    3ff3c9eafd660d3c34281ad0974830cc7517fcdd

    SHA256

    54ae1b74b158cfca7bfd72cf4ac84a60deab1ab509425d9cfc3fce3ce0e6bc60

    SHA512

    589ade02075b0579092ac4fcfd4b60491958cf14c4c3f9dce79fbf8edc9aab8080b04b5d30fe8b2d98173a4d73ff16a5911ea5f5bbbd948d9ab990f32d0fa646

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-27.txt

    Filesize

    24B

    MD5

    f17fb183fd6ed9565a13d1e422baf7f2

    SHA1

    9cb4977b446cf936bcd6ebe4cd9c785345ac3c4a

    SHA256

    59f74a59c808b82ce00fc95e1e9dc9be0f87836f631a94efc8b00954712883b6

    SHA512

    32d26a1a4273bc3629ca2484b56731208cd4697106020ef31af461195a1cd81c71d254bdd35c219eafbedb2e71cdc8cfedb17311b68f79d19001854858959163

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-27.txt

    Filesize

    32B

    MD5

    4b8f61d0c41d6399d642e8e40a049ff5

    SHA1

    8fd9edc04038758da94bc3412d10b00387ba9021

    SHA256

    be62b4a46bcb854fe2a04ffb130ed91c5fdd0c8c5c43f7fbe2f0063a74a285fc

    SHA512

    88cef12dbe4f170c8c49fdc3ab4c67be458772d456de6734b6105f2184dba7ea4469304d238fa4c0534602440aedeaa9dabde56fc7f79382527942b1b278e5d0

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-27.txt

    Filesize

    24B

    MD5

    b1635a3f70e4894997c4e4db31445139

    SHA1

    302de2c3d1ccbbbf9886480d3784b46b7b2f0567

    SHA256

    184ef6939baaf6623b9755c9368b08b5ddaf3ea36129c1f64bdb60d5ffc52d5c

    SHA512

    2caa5d03ac7402c64036e11cb7ae891c4492269868e650d6f48a81d00c2ca2c27940bf6590e470f3b1a9e28726ece1934e398ea649ff37745ae68f2ed1f4c8eb

  • /storage/emulated/0/sysdata/sysinfo0

    Filesize

    7KB

    MD5

    effbc10b41f027e5c2130835d524c99d

    SHA1

    affb65361d7a36d00e402ad869696578b5ac3259

    SHA256

    566fb91b6bf186c05c4ec051aa2e2802961cbb158df24a8fecaa0678febece84

    SHA512

    b2ddd0142a80663097e9b71d8d654d88382ef8f765c92f0c8fbf600f1174cb1b1e9e61088f954e609e6d2402fd4750b88945af7c1080018b991f2e6e6d9ad52a

  • /storage/emulated/0/sysdata/sysinfo1

    Filesize

    4KB

    MD5

    3748dfbaeae0d43d38471f14e4321dcd

    SHA1

    a5a6dcb2e325479cb25a44cb66216e09a843666c

    SHA256

    4830f1d48d41c7725686901a2d4f93a8ea722f6160dfecc6815ac85598e361db

    SHA512

    bde4b86489abafb3a5aff955ce232367044b6fdf106ea02847c3dbd78e49a02dd7c63bf82c26a3b630962aad16a877ece85af74608909a37a89b0591e012625c

  • /storage/emulated/0/sysdata/sysinfo1

    Filesize

    3KB

    MD5

    514d884ca8bb12d1b8f440f3e64c3f9f

    SHA1

    6242b72c85ce2a287e95fb2522afe1f559b277aa

    SHA256

    5a9b87d66daf4ad4791d980d9c3270c7806bc18c89e323472a500fb8ebfefc5e

    SHA512

    c18018ecb5742753f72dbe369c6f21b391b514a3d0dda2ef404cd53be299c42f3c774c7bec085d7c5713d42cf0fdb2f9e629d6cf5d635d3ca9271147e8420ac2

  • /storage/emulated/0/sysdata/sysinfo2

    Filesize

    5KB

    MD5

    a6fcd52b6b66cecf6862b4f36341bc04

    SHA1

    8b21ceb4d264f40cf7da42ce630c991a0eea4090

    SHA256

    47bb8e56ea3c98e4a3a8b1e557e8b8d7683683e6657df223907b7c1ef085018f

    SHA512

    90ed714810ad62ef12e861506814f595db1c407aa5d2ee659e0bf5fb67cc1d8bcfc5bd776c82ea7fc0e6cdb21e25e4fc0399e90bfdf666a2296769bdfb0efce9

  • /storage/emulated/0/sysdata/sysinfo2

    Filesize

    4KB

    MD5

    6b2bac966edac0048bac4336dd7ffdab

    SHA1

    4fa290b1ae3d09a70f29e05ac33701a937307a29

    SHA256

    9a0285c31c82617f5d5823210791ab57fa29c92ca8107b0fa0e7a7a35be96af8

    SHA512

    758a90200d4f08c263d52c931a2cdc9ce066d87c89f786e04b56cc90bdfce7918001db0349e7a037c5e79a7eeb9d3f6e43c661d37c0cdda43f7bf2853d63f4e2

  • /storage/emulated/0/sysdata/sysinfo3

    Filesize

    28KB

    MD5

    9506c5cbfc8e3e59fe9b9d52bea1ddd9

    SHA1

    b7ff5d775666cd07120ea14569dc00527cc53d1f

    SHA256

    725cce101997a2608c3a1b51de805caa6cfd7f9c8c84420d4b68135227b49edc

    SHA512

    44445051d25ab0188ec7233c97680a279c2d717a436966d8cd90153747a7dfafb7d39c5bda72acfafdef9f674e2de500723134c08cde76d885cbeab69bca89e0

  • /storage/emulated/0/sysdata/sysinfo4

    Filesize

    7KB

    MD5

    1a26c5544e9f9f82b3c020c49162764a

    SHA1

    3689b5b26e85472785082c3f879da9bcbba22655

    SHA256

    d365285ec8822cc96ffa79d9596e03bb0fef3bcff4d2cf9b890340fec6458459

    SHA512

    d240e89ce386672b339d8c72b64bc41106b326b4d592ad2dd4aa3ac449a8e5d4930fb705d104f0ee8831ce188e54a644fbde0d3e2da1d788f83781bbb02a5f0f

  • /storage/emulated/0/sysdata/sysinfo4

    Filesize

    9KB

    MD5

    29b80b15673d46bfda32d7beaf2457b6

    SHA1

    cda13c92638243b9116d3ddeb49c792a6b5369bd

    SHA256

    2b111730487405bef3ad063f3bad8bcbe409fac4ee00c08ce6122b27c6298254

    SHA512

    1810eeb08a7fc3be4ea0648aae082cea2bca5987972d65f82bd427025fe055c4c1942f2c045a9a95cbfaa60f64d436d6528337f34602c63362ed895c0d92210c

  • /storage/emulated/0/sysdata/sysinfo5

    Filesize

    22KB

    MD5

    60c5153ac9209d93ec6f5dad798b520e

    SHA1

    9405c5f69f3038fc22724d611a0cedafbd0865b4

    SHA256

    30770d032694d585243cf2c108ddb515a11cce020953b3a8d1304d7704101c0a

    SHA512

    dbbd90a413c223f96be511409e82cfb3436df588ff58e4f21e5ae0610541bce191b8468179be6dee57b25438d7f1266b93b5639a7249c63050030c9ead36a093

  • /storage/emulated/0/sysdata/sysinfo6

    Filesize

    5KB

    MD5

    42602d32a96f59366c36ca9dac5ce28d

    SHA1

    9690c0c6510cb5c7be9182d41dad381a1262065b

    SHA256

    e15552b3ab0824370ff36e1ee461251d72fef39ab75722a56064259049370b3e

    SHA512

    ded18e20f4b4353ee5e65f96a0d8297dc1f7f5802a18332de7fa3aaf6f4cb9b81982cb266c6779e9b1c4791aaa4eb8e04e3214b792c0a98b69a41654158684bb

  • /storage/emulated/0/sysdata/sysinfo6

    Filesize

    3KB

    MD5

    b0fb4b4b85453c7413ce34f558dde399

    SHA1

    e64d0e87b0baf84cc2c7e4c4dc1cfe8adcf9376f

    SHA256

    ad712097c583f970a7490dcd56f6c85fb3398dc6a5922b8477617fb741385eb0

    SHA512

    a02ddb7cccd7a820f059c9aa0869d1258d6cd4e1772dbda41d50c967f0da934223d304c4d4ec914b2dfc6b3fb0edbc40b45b2bce68915a312dc0140358dfd036

  • /storage/emulated/0/sysdata/sysinfo7

    Filesize

    4KB

    MD5

    24187c8d4a921022947272a9803b3f41

    SHA1

    1620aadbdbcd4adebe67316e89e8c65d1f61b8c4

    SHA256

    5468034e8a0355df93f6b070a8025304900219588f6c946f4ad37ba5750a53c0

    SHA512

    aa1ecef797d063e091c0e149747f331b90051c007cedaee72407f0c533e25086f2a6bdcc3ea4a6686ca595ab9ef577ef11bcd14c0fc26daa5f8f76ab513a3978

  • /storage/emulated/0/sysdata/sysinfo7

    Filesize

    3KB

    MD5

    36d7729b8cc8ace6afcc472b3f1220db

    SHA1

    3f1d7cb1dd721cad2cf955303872e3bec883968e

    SHA256

    58d71a9c91d09e4a5e3cbf4c543daf97e8f2ce31295efb6547d3eb535bd9a148

    SHA512

    e98135aee684654d62bccac9014d8d15b6d1cddcf303aef10c31d9352ed3fde35c922341ce5d7245e38d8d53c022ecb7953a59632873915af211df90784fa621

  • /system_ext/framework/androidx.window.extensions.jar

    Filesize

    123KB

    MD5

    3056e1bdb7d4e19789d0319eff484bd0

    SHA1

    6791ae47aa9466fe0bca27ad6643f846853bbee4

    SHA256

    8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0

    SHA512

    c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658

  • /system_ext/framework/androidx.window.sidecar.jar

    Filesize

    25KB

    MD5

    29469324e59dfcc052f24b5af4e7b2c4

    SHA1

    10c1e17ac6f598037bb51baa07945663645de4eb

    SHA256

    9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a

    SHA512

    5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2