Analysis
-
max time kernel
148s -
max time network
161s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
14-01-2025 05:17
General
-
Target
FE_Invisible_Troll_Script.apk
-
Size
3.2MB
-
MD5
3ff43582aa468b8a8d0e063dcfea73bf
-
SHA1
5d1d34fcec8f715ce045a5bda04741d40f29001b
-
SHA256
a6f56581bb7ae7b242fcaab3d97d04ec2c5ac8aa5870e4e64ffbcf0d78899993
-
SHA512
6af7639bc336015161f3087519e1a365ece0d1e0f5f7f20fe1af3243d1e6c3a0f65e38b50dc70f15cd13a232989b22884ca36bf0151630223d37bdba4f250149
-
SSDEEP
49152:hrOpp2RqaP3KdsFeHcEKYC4KiJK5ncPjPuE/UpXSkdkIDk5sSEj6QiVterxzrK:hYgv6dsFt0FQnGD/UsrLEjS81PK
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.herocraft.game.freemium.catchthecandy1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
480B
MD5454d182a8f7f0c824cab9ff4ced959a1
SHA15a0a9c2f8b0ec6a1a8dff5f062cf249c68445a08
SHA256287375e1b59c6d6969301c9211cb9f18febc174d85f72bbfe98fd1a453cbb20c
SHA512fa6b8c194dd196916df78fae829ace1572695483150ae32a58f35eca0b55f7fca12d2975e4b8e5fa2b71f6b7458211d1db341f753de13fe8e0d6daabe8d73973
-
Filesize
569B
MD55cfa8aaaa5788ca9fffeecdf2a1b1a0c
SHA1195f79ceea3805aa844e2384eb7e47a122e9ed74
SHA256cbb13e0dc5a39676f0599b5884a86393541e71367b26cc3a946bba23254923b1
SHA512f4f4a97f7d572cebac5393d83671b67836f69561bdc46ec6be58635eab0431e7e5b9305193e93b72e0f66e16713fe222c09ef4fda635949a7147ae5fcbbbebfb
-
Filesize
2.3MB
MD5d951efa7f0ca59781f3af35949338902
SHA1ac853df2b6835dbac7c94eb008ab4657e68eda70
SHA2565b0a0d3671f6ff3ea0001624a0c157d057965e60891c5335391880fe9b00e183
SHA5128fbbc1c347ec03478b01ff321d159656abfcad1d9ac3b426382348567c57bbaf1cdb3cac77c38fbcf62e0e17063f170fc9f9bf200a982b940dcad47e30b05617
-
Filesize
229B
MD5df8ae1444f982f97c9b6566c23ec413e
SHA113b07c87d28eb565f4da2c63bd6ffa4c54c222be
SHA256da92d8f0eb5881fb04ec566e255ffe7844de72c8a25b0fb45a3cc772fff34473
SHA512b27a920e0be706729464d321a80fa11c1493d6cd5e023c6027ec520fd354defc0fe8e02896f300ecd1d02b76dc667f01211f1a57920a1760edbf0c26ffabe298
-
Filesize
229B
MD51ec7d5cf06dc32a674b5b43620205894
SHA15b92b66cee66d540cf3e3357a9a870ee12b4b2d1
SHA256ea4a5bb280b00894034bf4656a51781b91b6628937ffbfb5c87c24341ec7a965
SHA512625fcc1f1e407c6f4d2c419a495557aafc1a63c4c521ea43c906c3c66e9a9e8662e7bbe849c9cc918fec3e6226a137639203f7fef7a695b5ead88528779e5457
-
Filesize
6.4MB
MD5767a8ce605249b314939882f824f989a
SHA17cb1e61d4fa739b92b25d13bcf33bbb00cff9baa
SHA25626d8b34344e6e61c8a1380e9773109569accb467b36f954a1e5c729a4d701fa5
SHA512baec83cf6d66fc0dbf13411043c8168acf38b0b66a9c20f9b1ec54d6f5ef21527d22b4c47dd54734dcd5bd85410dc3bb8fe786fb1702443beee9a42e869c4475