51baf4bc48db631e887ded88c0beb05b7a2f6f26ad2d122ee7c6cca6678752f5

Analysis

max time kernel
149s
max time network
164s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
14-01-2025 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FE_Invisible_Troll_Script.apk
Size

3.2MB
MD5

3ff43582aa468b8a8d0e063dcfea73bf
SHA1

5d1d34fcec8f715ce045a5bda04741d40f29001b
SHA256

a6f56581bb7ae7b242fcaab3d97d04ec2c5ac8aa5870e4e64ffbcf0d78899993
SHA512

6af7639bc336015161f3087519e1a365ece0d1e0f5f7f20fe1af3243d1e6c3a0f65e38b50dc70f15cd13a232989b22884ca36bf0151630223d37bdba4f250149
SSDEEP

49152:hrOpp2RqaP3KdsFeHcEKYC4KiJK5ncPjPuE/UpXSkdkIDk5sSEj6QiVterxzrK:hYgv6dsFt0FQnGD/UsrLEjS81PK

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex	4925	com.herocraft.game.freemium.catchthecandy

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.herocraft.game.freemium.catchthecandy

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.herocraft.game.freemium.catchthecandy

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.herocraft.game.freemium.catchthecandy

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.herocraft.game.freemium.catchthecandy

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.herocraft.game.freemium.catchthecandy

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.herocraft.game.freemium.catchthecandy

com.herocraft.game.freemium.catchthecandy
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Checks memory information
PID:4925

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.herocraft.game.freemium.catchthecandy/files/Iksc

Filesize
475B

MD5
df1e98301f16b7b248dab871b824e027

SHA1
93cd46613afd3d636f5c149754956b5e7d29711f

SHA256
b53e299ab66e498fd8e013397bb30cca4c0afa51d553cbe0506fc83fa88a9b5f

SHA512
d78187a9c33ba1c320dd26c6e06c212d76ca5a2c6dd39348fd90bb4e364b58d809a9090c7920d86918912af591edd36f66225c68d40713504bb9b44d7c53f730

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex

Filesize
2.3MB

MD5
d951efa7f0ca59781f3af35949338902

SHA1
ac853df2b6835dbac7c94eb008ab4657e68eda70

SHA256
5b0a0d3671f6ff3ea0001624a0c157d057965e60891c5335391880fe9b00e183

SHA512
8fbbc1c347ec03478b01ff321d159656abfcad1d9ac3b426382348567c57bbaf1cdb3cac77c38fbcf62e0e17063f170fc9f9bf200a982b940dcad47e30b05617

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/kNp

Filesize
229B

MD5
639b16ec0906b235a55378c0106737ad

SHA1
02d45a548071c20480c96416c63995e589098c28

SHA256
be0e76bd9011bb9f6775c9ada8655fbc42f062705732f50e405d5fb540038be2

SHA512
030fd92902a745d5b88bfb10a7cd095fdcaf0927810ce59c87b8f1fede7fe661f94886021e09a1a096a00d9bb43df9cef5106c71fc1867d70d992550cc171c44

Download Submit
/data/data/com.herocraft.game.freemium.catchthecandy/files/kNp

Filesize
229B

MD5
e61420690bbf7eb077823be85cefbab6

SHA1
3fcbc680c5b1aa976746c9ec215acd60513b9188

SHA256
03286f51531559f0b34221ffd8b50bc056143f415de541674efaf05675c5559a

SHA512
2327f58eaef368387921678c63adefeba3877f5b3e8c3ad426a0109b504a0842e49cc16730d3c0a8201049f04623acf94bb14905a9dd814bd0d56e33e251b51f

Download Submit
/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex

Filesize
6.4MB

MD5
767a8ce605249b314939882f824f989a

SHA1
7cb1e61d4fa739b92b25d13bcf33bbb00cff9baa

SHA256
26d8b34344e6e61c8a1380e9773109569accb467b36f954a1e5c729a4d701fa5

SHA512
baec83cf6d66fc0dbf13411043c8168acf38b0b66a9c20f9b1ec54d6f5ef21527d22b4c47dd54734dcd5bd85410dc3bb8fe786fb1702443beee9a42e869c4475

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads