fantasyhub | 2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31

General

Target
2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31.apk
Size 8.2MB
Sample260309-wsf2facs91
SHA256 2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31
MD5 00d9cf98baa6178949969d3471691dd4
SHA1 f702f56ebcb68301508084a6045925b34c49c274
SHA512 3f648b8f3c92e4015e9fdb8c034042b15e2522e130225ee5d3f0109385646e912dcd004f8b987ebcf8b23fd15709a6a927b24df27d949785ece6662fa3901b2e
SSDEEP 196608:64jSh1dNhS9hLoukJaWL7+RkS4/UwzG2iNmKr:9M1dNhS9h8b777SiiEKr
TLSH
T181963396F729A52ED97B41710A8A473223669E09CEE7D307A1543B2C783B3C98F44FC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker collection credential_access defense_evasion discovery fantasyhub impact infostealer persistence rat trojan

Malware Config

Signatures

FantasyHub
FantasyHub is an Android RAT first seen in November 2025.
trojan infostealer rat fantasyhub

FantasyHub payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-4.dat	family_fantasyhub

Fantasyhub family
fantasyhub

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.pc07b68963.ikk18

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.pc07b68963.ikk18

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.pc07b68963.ikk18

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.pc07b68963.ikk18

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to send SMS messages.	android.permission.SEND_SMS

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.pc07b68963.ikk18

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pc07b68963.ikk18

com.pc07b68963.ikk18
1⤵
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Makes use of the framework's foreground persistence service
- Requests allowing to install additional applications from unknown sources.
- Checks CPU information
- Checks memory information
PID:4780

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Subvert Trust Controls

2

T1632

Code Signing Policy Modification

2

T1632.001

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

chiken.apk

Path /data/data/com.pc07b68963.ikk18/cache/chiken.apk
Size 7.0MB
SHA256 15cd5bbbdb9e5f980043bcc849a66c8fb77ba4af44dacfdc653e2488622b2408
MD5 c2b8c31f78596501d1c08e2088ff0429
SHA1 7337390ec0f9295188b447e405a28f6cf9604036
SHA512 1cdd95520bf949bc334457b9a86fb6bd995df0793bdc0c956908aeb0f1c190c4125fea3100310ec92523336a98af8d7ec4faddc316c7f7944031e26d67ae4198
SSDEEP 196608:UAQlEJfbk00qJNQk6FWE9JIKXFtunVhDNGC:UAAUkNQQkhE9JIo8V/GC
TLSH
T127762386F728013FC5B644724AA6033167678D2A4ED7AB4B2988772C9D7760C0F6EFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chiken_patched.tmp

Path /data/data/com.pc07b68963.ikk18/cache/chiken_patched.tmp
Size 15.5MB
SHA256 51638a7bf14d3c915ad771a93fe0eec8df138350ef616afd6e4630ddc5f1b1fd
MD5 3dcd9f88a45718b687260ff48ecb9e9b
SHA1 6c5104f0a0d638a98acfe8ddd0f5843bbf60a6fd
SHA512 cd6cd8eacd309a9ccb192aff25dace91d74b7549972ac375bd179b68db35778844e9b2178021131aec033ec4946195275bc8b184db822c5a3138814e4d0b3099
SSDEEP 98304:DptSYw5jF8zChrH/VxcrUoO6D4YVQWQukgZBW6Di/5vDERSzEYmmmYu9VEEPpZia:Dpt4jF8eNYUQ+upvW6G/aRcnBxtG
TLSH
T11AF68D0BE302DA2AC8DC7B3C29B557C637316E4E9F8343635058FD6D9E726E59B24290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dogandcat.apk

Path /data/data/com.pc07b68963.ikk18/cache/dogandcat.apk
Size 439KB
SHA256 cf9dea7dc62717e4b239f0595594ec4211252e3d8fad46b1b59061f698801993
MD5 42a73d34ac66b8df192973a9edf9cfce
SHA1 c2e1ab09d343fd13d1757087d17596e781b12504
SHA512 49d5c35d50d2d7d87ea99fc1bddb5b5cb2b7c7222785b7b217c566e3249d9bbfa053decb5bf2082eb798c67269ab290bd0c8156d7751afb7aec062416e1afd39
SSDEEP 6144:modf9exi7x2lV5RMFs53cogD53Mpd39RCjBcMpcq3n:moT7xsvMs5Mzmp+cMpr
TLSH
T1C5A46C06DE904D33C8AE227D05A31390373AA689A743834B260DD6B57F933EB5F876D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.pc07b68963.ikk18/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 61c47e44575918aed27ec8f8bec1d84d3da67cdc01af3fd300ff46e8fd453d89
MD5 00c5d9c7dc2b6522a09de790877f0b0a
SHA1 1cfb635e03da1020b00a2a2ab5b1ba0ec4772595
SHA512 1292c95ea23b07517283a0fba31dc22fa6f4d5accf403cdac048d67537fa5100464eb6d10074f4c8836ef2f96cbaa9b238bcf7e7d78ec80dd0aa0c8d187d8568
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.pc07b68963.ikk18/primary.prof
Size 1KB
SHA256 3ab8df788482e94a8be55e4020d6512e96690348db75b62fcb20437ac4021e25
MD5 e6b3e412e1c6373b8d40b61e38ec79bc
SHA1 788b75bc99193082190b2e0fb048f68d3aa3912f
SHA512 04573840a690eff0b1c9f211d6ec424e220dad2720beb4f572aa3be20bf27a15d977c2f748c79fc58665819c44079beb6ab5296e03a9844511dc4e6eb0d549de
TLSH
T16B31E980280819B0E89CBDD7C64026273D0F892133C91968FBEE3040948223F82B3794
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads