80ba8ee4a58e568ecd4954d9d688c02292090e6d0cddbf19dec2677f739d85d0

Analysis

max time kernel
13s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
21-01-2025 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

infinite-flight-simulator-22.7-mod.apk
Size

573.5MB
MD5

9b4f0c38a5e3300f384f26ad67c7006b
SHA1

a3f2a8050bd614cdb4c6220eb9686c7ff985b01a
SHA256

80ba8ee4a58e568ecd4954d9d688c02292090e6d0cddbf19dec2677f739d85d0
SHA512

2dd06b2a83d76f0288bbc4ba15e1af7d40bbdea040b3e457b8402213f6d4a46d0de775229fc9605696f9bbc23db0dcad7362e5670a511d8b37c42abfbb5f4f21
SSDEEP

12582912:dGnALlxVfjzpEvcGgTtUgNytbqbe2UEhwQPURFnRpTN/1iaK/SpXwcy/zCZJPJxV:oALPVf6HC6Mytbqq2UEh0RF/NcJ/SpXh

Score

7^/10

defense_evasion discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.fds.infiniteflight/files/953840A6/953840A6.dex	4680	com.fds.infiniteflight
/data/data/com.fds.infiniteflight/files/953840A6/953840A6.dex	4680	com.fds.infiniteflight

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.fds.infiniteflight

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.fds.infiniteflight

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.fds.infiniteflight

com.fds.infiniteflight
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
PID:4680

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.fds.infiniteflight/databases/com.microsoft.appcenter.persistence

Filesize
24KB

MD5
d17e366a8937bf763ff53c91989dd0af

SHA1
8f6319bfdbc577c061a2efbf2a507fc9454789c1

SHA256
f176cec8848b53e8fb9d8a255501186bc03983de0ab9db2abcbe6be787ec2655

SHA512
300987d5772a6b8a84631cbcd11b59ea61d442e66fe267e3ce06e32c3eefd95f54703159564a41ad1033f181b4c2ca7ede2a9cc1a7f1d140e076388484d7b0f2

Download Submit
/data/data/com.fds.infiniteflight/databases/com.microsoft.appcenter.persistence-journal

Filesize
512B

MD5
e6da03106f9ffa8b6eac1c48cf441a04

SHA1
cd5ee16553bfcebc3e1b206cbcf31f2fe257d02e

SHA256
27b3a13dd79b33e7ad11939a3d10b8dffe23b950abb89048025bf64d362e5e61

SHA512
e5f082bf3b342399fc3a64996e09993fb6e60b7ea5fe72181bad6d9a2fddefb0425ed41fcd59238ecf4666153d2040cd03ab0a8f627ccef8e797c73e1ce6eb6a

Download Submit
/data/data/com.fds.infiniteflight/databases/com.microsoft.appcenter.persistence-journal

Filesize
8KB

MD5
c9e02e76eb9c92c8e3c63a916b371333

SHA1
2292a1a3e7266783e0f79dd7abccbf9bbf5af470

SHA256
0d4e570e0fe6d051723724adb30795d52dac83d015240209de5f3278fa1eb9b3

SHA512
7e67a240470459fe63839482a8e954a1ea59b1c6ed44dcc808f916f252834a87d0ee4a0b8496114d707b576c01ad68ca53924784014d824707374f12d8c11220

Download Submit
/data/data/com.fds.infiniteflight/databases/com.microsoft.appcenter.persistence-journal

Filesize
8KB

MD5
db09ba23ea524c0b572f90fb825511d5

SHA1
68771b6ae56bfc643ec809d79c05b95fc521e22e

SHA256
c6bd32f720093636e20552b428facb34a39cc237e29f8de7213126ba61294f3b

SHA512
a06548133fdfe4d2dc8cf6e752f60afb5e59bdd4ab5fd4db72ad85f3f202dc1148776204dd370068fd6e01f41646e7d6a7f435af7dc20a89f4d74fbe54b34198

Download Submit
/data/data/com.fds.infiniteflight/databases/com.microsoft.appcenter.persistence-journal

Filesize
16KB

MD5
2db34ff0cb98e8b794b2f73b44a6a2b3

SHA1
7934ae3b1eee754639cf05af19cb30c11478ddc4

SHA256
a4cd56bac1f5c3bd47aebd538513bcf13cb191c5f683dcd41734bc2e7f62428c

SHA512
47ad924610bfa9eb3c57d826de29992afacff69abc0727aa60681c0a05758c55f3f087b66a967d01be8a4537826ac3d75fb2a87679cb862ba96ba53eae1afb9b

Download Submit
/data/data/com.fds.infiniteflight/files/953840A6/953840A6.dex

Filesize
207KB

MD5
52c4273dd102ddc2b7f38e17554da4ec

SHA1
f140d855f4ef14e0c0760bd5a17747ef022450ce

SHA256
7efd9c85bb833357a62d7c197bdfeaa85e463366af8d5709e55f29f0b88d57c0

SHA512
d9ba2fa53dfc413abb3ec9d77258449bf941d241bb1bc3249a38e0902ea84008bef887390b9c5c2dbe3e5375cd45ee8834894723d54b31ad203d85066f715153

Download Submit