General
- Target 2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31.zip
- Size 8.0MB
- Sample260309-wsf2facs91
- SHA256 74617f4eb58b636e65745c1cf3c21aafa828e24d72a000204cd443b8d3d45144
Score
10/10
Malware Config
Targets
-
- Target 2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31.apk
- Size 8.2MB
- SHA256 2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31
Score10/10-
FantasyHub
FantasyHub is an Android RAT first seen in November 2025.
-
FantasyHub payload
-
Fantasyhub family
-
Checks Android system properties for emulator presence.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
-
Checks the application is allowed to request package installs through the package installer
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
-
Declares services with permission to bind to the system
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC)
-
Requests allowing to install additional applications from unknown sources.
-
Requests dangerous framework permissions
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Subvert Trust Controls
2Code Signing Policy Modification
2Virtualization/Sandbox Evasion
3System Checks
3