Analysis
-
max time kernel
148s -
max time network
128s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
14-01-2025 05:17
General
-
Target
Roblox Keyless Bloxfruits Script HoHo Hub V3.apk
-
Size
3.2MB
-
MD5
35b6944128c7cb11594bfc93e4ad0d7c
-
SHA1
1dd7c14f0d05c7560764a5bd2e9693cddc049a21
-
SHA256
1879320e3bc42bcec7ee18e7e36e8cd579b8711f313d561ab502bcf1d1a559ae
-
SHA512
5a53b65492cc7756c5a014c812cc620458462b7fcde15251068f964adebd98d61756fd340fc51a68392f8ef58d2debbb8b53fb34ccea3b68cf65cfd34dff42ba
-
SSDEEP
98304:fU5DjBYQQ/2Kp7d5QDJCqVuc6TjEj/K8h+5:iDjel/jp7d5+kqN6TY+L5
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.herocraft.game.treasuresofthedeep1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5767ef40815362c541a89c4c50650c022
SHA146079e6da37683dce34f1d965f68b56deeeccff0
SHA256045e58a267b61428e9b68a2b7f84eccb9335617ed119227acd35c9be5b2f48e1
SHA512d1406c8299796a0c0d10ab6fe36c85c543bf91333e6bd6a8675e79b740e7325d45c66222b74737de320eedfce4ff1ba0f79517076e2ccb176aeae5c244be406f
-
Filesize
227B
MD54dc7aaf7289aeab118b7b050c67364bd
SHA10684363c924ac99985a4bddad27e270d07b51aa5
SHA2566074957867706b161fdc1483437006b8123fb0aa4277a8fadc568cbcaef4806c
SHA512ea3e82f69d4b19cd5734656bfc69a8b810915e19ab8f6778bc1ae24562db90737ffb0e100f6c779982a6c010fe6ce5e95a5b641c102e16a786293e8d8cc7efdd
-
Filesize
227B
MD5b9aa4a22934add4e7b74baed98d1a19e
SHA10c95da62dfeaa1824ea7e641ac60f2d65b0c5b7c
SHA2566224dd3165aba73ebcec2006a753590c39f11be6e7979a53c6a3b6f10e6d784c
SHA51239cfbe5dcf1b75f9a8a62082696a403c99f1a3b6aeac941f8da163030a9c5a1d27865478ee27aeac27bef688004d366a4c2300387513b1f86f62fae967d5a29a
-
Filesize
478B
MD54a30785128af22edaed99e56ff859507
SHA1cbac80501c8f28dc48005ae0d429338d16711ce3
SHA2568e96420b5be6798bbe6e6b8eef6d5a336902db4ec7e657782d387ae19477fce2
SHA5125225652e4bb016f006346e9a6795e230548b065cc7db3c3ef7894cd9992e0747310840d4dcc2434f6225f4db464b5328a4b82ff4d3b75e119ed1f406ac2bf634
-
Filesize
6.4MB
MD538c2fd6b3426f301739dd658c91c462b
SHA198464a62414b23440ebecacdcf3097c8e9f1eff4
SHA25651e662b019aea637e0be77e0bfd8d06eab2ebc3b4d2b07a3b81595ee63f8eefe
SHA512ca7acf337f0069ce63a91da6aa36c4529b7968cc38cd6ffd9559ee37498075eab13331b68866f617a338279df6955ff32d8f7dea2941664da654fa855f4bfa1a