fantasyhub | 2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31

Resubmissions

09/03/2026, 18:10

260309-wsf2facs9110

09/03/2026, 18:10

260309-wr7srscs8w10

Analysis

user interaction
yes
max time kernel
67s
max time network
71s
platform
android-13_x64
resource
android-33-x64-arm64-20260306-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260306-enlocale:en-usos:android-13-x64system
submitted
09/03/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31.apk
Size 8.2MB
Sample260309-wsf2facs91
SHA256 2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31
MD5 00d9cf98baa6178949969d3471691dd4
SHA1 f702f56ebcb68301508084a6045925b34c49c274
SHA512 3f648b8f3c92e4015e9fdb8c034042b15e2522e130225ee5d3f0109385646e912dcd004f8b987ebcf8b23fd15709a6a927b24df27d949785ece6662fa3901b2e
SSDEEP 196608:64jSh1dNhS9hLoukJaWL7+RkS4/UwzG2iNmKr:9M1dNhS9h8b777SiiEKr
TLSH
T181963396F729A52ED97B41710A8A473223669E09CEE7D307A1543B2C783B3C98F44FC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker collection credential_access defense_evasion discovery fantasyhub impact infostealer persistence rat trojan

Malware Config

Signatures

FantasyHub
FantasyHub is an Android RAT first seen in November 2025.
trojan infostealer rat fantasyhub

FantasyHub payload 2 IoCs

resource	yara_rule
behavioral3/files/fstream-8.dat	family_fantasyhub
behavioral3/files/fstream-10.dat	family_fantasyhub

Fantasyhub family
fantasyhub

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.pc07b68963.ikk18

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.pc07b68963.ikk18

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.pc07b68963.ikk18

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.pc07b68963.ikk18

Requests dangerous framework permissions 22 IoCs

description	ioc
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to send SMS messages.	android.permission.SEND_SMS

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.pc07b68963.ikk18

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pc07b68963.ikk18

com.pc07b68963.ikk18
1⤵
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Makes use of the framework's foreground persistence service
- Requests allowing to install additional applications from unknown sources.
- Checks CPU information
- Checks memory information
PID:4418

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

chiken.apk

Path /data/data/com.pc07b68963.ikk18/cache/chiken.apk
Size 15.5MB
SHA256 0479e60e38446c5c261124fb3a1462df3daa1726beaf3e40f111ea120077125f
MD5 a4caf8edc1acc1bae6553c7906343288
SHA1 df88cf17a1d604f86e853e822cea427f01d90316
SHA512 e7f5aee0e68ab88b1f691e313c92d907f4a3667526674247297ab483923e5194c8b1ee6f48f119936817d1b6501b4f71e4779ae3fcf6c908f3e270a2f92bc54b
SSDEEP 98304:kptSYw5jF8zChrH/VxcrUod6D4YVQsQukgZBW6Di/5vRERSzEYmmmYu9ZswPZboo:kpt4jF8eNYUnwupvW6G/YRcn1ZRQ
TLSH
T109F68D0BE302DA26C8DC7B3C29B657C637316E4E9F8343635058FD6D9E726E59B24290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chiken.apk

Path /data/data/com.pc07b68963.ikk18/cache/chiken.apk
Size 7.0MB
SHA256 15cd5bbbdb9e5f980043bcc849a66c8fb77ba4af44dacfdc653e2488622b2408
MD5 c2b8c31f78596501d1c08e2088ff0429
SHA1 7337390ec0f9295188b447e405a28f6cf9604036
SHA512 1cdd95520bf949bc334457b9a86fb6bd995df0793bdc0c956908aeb0f1c190c4125fea3100310ec92523336a98af8d7ec4faddc316c7f7944031e26d67ae4198
SSDEEP 196608:UAQlEJfbk00qJNQk6FWE9JIKXFtunVhDNGC:UAAUkNQQkhE9JIo8V/GC
TLSH
T127762386F728013FC5B644724AA6033167678D2A4ED7AB4B2988772C9D7760C0F6EFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chiken.apk.signed.tmp

Path /data/data/com.pc07b68963.ikk18/cache/chiken.apk.signed.tmp
Size 15.6MB
SHA256 4c2c7e14a15cb961cc0490c17a326ed97dff3d6517b77e5563496334d65bbfef
MD5 14056dba406743195c4db0abfbc4aa6e
SHA1 6126cfbe17c164fcf55c4e7060be1eb150173ba4
SHA512 bc9f2f8581387407f0ce4c2d0735e99250b07080520899a81f41ad4ad342a90be3e2383d88d5d06734c8c796a4d4f2fc57ce3389282007145b1071a6c770cf4b
SSDEEP 98304:mptSYw5jF8zChrH/VxcrUoL6D4YVQkQukgZBW6Di/5vLERSzEYmmmYu9b66PjV+T:mpt4jF8eNYUJCupvW6G/eRcBvjTb
TLSH
T1EBF68D0BE302DA26C8DC7B3C29B657C637316E4E9F8343635058FD6D9E726E59B24290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chiken_patched.tmp

Path /data/data/com.pc07b68963.ikk18/cache/chiken_patched.tmp
Size 15.5MB
SHA256 4f9a714f22727cd6e4aac697cd29d25f8f447f2a361ec701f48fc4884ba91ab3
MD5 87533317850f496da5688b3b6cc71016
SHA1 01058a07225254f0c488e505f619f357465073bb
SHA512 549fc3591f1a3559f169e326802f61f3c8e6b00561b315913915a49adadad85e328862b5b91c9fe5f018f5e810dda053dda1b0f5db2224e487f1c3e489b1ef2d
SSDEEP 98304:hptSYw5jF8zChrH/VxcrUoQ6D4YVQsQukgZBW6Di/5vRERSzEYmmmYu9ZswPZboY:hpt4jF8eNYUmwupvW6G/YRcn1ZRg
TLSH
T1F4F68D0BE302DA26C8DC7B3C29B657C637316E4E9F8343635058FD6D9E726E59B24290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dog_patched.tmp

Path /data/data/com.pc07b68963.ikk18/cache/dog_patched.tmp
Size 470KB
SHA256 548f8aecc262e23dc5a8f6f9b6221d87c2579a2da87f888c8dcf2ec479dabdad
MD5 faa9924a2d4c150df286ecc5d69e9d8c
SHA1 c63cc965bbc608d63076431ab97cf8bf0a404cd5
SHA512 e782adef025adebb30dc7a1e2b8a5766594c2adae5c75ab838051c5e662e3429d84fa5eb2722500b6a6dcf834ac647fa133d64bda2125e05bee3aa8e69eb3192
SSDEEP 6144:aodf9exi7x2lV5RMFs53cogD53Mpd39RCjBD6R4T:aoT7xsvMs5Mzmp+D6Y
TLSH
T1A1A45D06EA904D33C4AE127D46A35780373AA949AB43834B320DEA787FB33D65F875D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dogandcat.apk

Path /data/data/com.pc07b68963.ikk18/cache/dogandcat.apk
Size 439KB
SHA256 cf9dea7dc62717e4b239f0595594ec4211252e3d8fad46b1b59061f698801993
MD5 42a73d34ac66b8df192973a9edf9cfce
SHA1 c2e1ab09d343fd13d1757087d17596e781b12504
SHA512 49d5c35d50d2d7d87ea99fc1bddb5b5cb2b7c7222785b7b217c566e3249d9bbfa053decb5bf2082eb798c67269ab290bd0c8156d7751afb7aec062416e1afd39
SSDEEP 6144:modf9exi7x2lV5RMFs53cogD53Mpd39RCjBcMpcq3n:moT7xsvMs5Mzmp+cMpr
TLSH
T1C5A46C06DE904D33C8AE227D05A31390373AA689A743834B260DD6B57F933EB5F876D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dogandcat.apk

Path /data/data/com.pc07b68963.ikk18/cache/dogandcat.apk
Size 470KB
SHA256 d24074ce0d48c5f05634f69a0b12cef702aa812475b78848ad9259378554b268
MD5 33b38e6e81b29ad89c7210a0c1b7ceec
SHA1 0c1bd919a9b58ef52629a215e3c4eb607a0dc2c0
SHA512 0ab52ff935afd675499640e476afffa3a904dad77736a5197c6956dca51979364e10de683754129331f9b90024b2fd2bcef59358bed718e46b8d1ab29438e04d
SSDEEP 6144:Zodf9exi7x2lV5RMFs53cogD53Mpd39RCjBn16Xh:ZoT7xsvMs5Mzmp+n1c
TLSH
T114A45D06EA904E33C4AF127D46A35780373AA9499B43834B320DEA787FB33D65B875D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dogandcat.apk.signed.tmp

Path /data/data/com.pc07b68963.ikk18/cache/dogandcat.apk.signed.tmp
Size 483KB
SHA256 8dbf7ed4707b578483eda42b74c28dddd24d408e3df6578d590b4221a7a3463b
MD5 8063df2085c6fccb8faa49a5aeb736c5
SHA1 c38e841659ca6a55adfa782d2e6137e2761a41a4
SHA512 fb47d293b6e5ce51e1e1b487a381a87fc67070e6b9b7af04a1e4d2ce4f4e8b368d90e9cdb4d9a8e21549be6ca447815839f011584da93b213cc39b2ea0a89e09
SSDEEP 6144:zodf9exi7x2lV5RMFs53cogD53Mpd39RCjBN3qxZ:zoT7xsvMs5Mzmp+N3u
TLSH
T140B45D06EA904E33C4AE127D45A31780373AA949AB43834B360DEA787FB33D65B875D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/com.pc07b68963.ikk18/files/profileInstalled
Size 24B
SHA256 693a56645035a24a1a0cbab2387943e11954e390956dfb63828387577fb1d254
MD5 8d8778f16d4518ed443e24bb0d532d14
SHA1 7b7bf2f0ce0666bf2da362376914a6a3190d47b9
SHA512 37d7dc35e7bc6b1e2e4225540f51092738f23769249bd249b8af622794bdd80eac18b00c9779e464984f0cdbf420dcc8bfd346a411562af6a1a36e560b5fa644
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.pc07b68963.ikk18/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 00579ac280f4a00e08e4d94aaec936697bb8424d2b755ab0292813804389055b
MD5 3602f016625e1c84efb8bffcc4810fe4
SHA1 2a3ff1cb118189efe84c51108ce05df1da2d9132
SHA512 f5b1c64d8d9544950994fb0c7b6ded9f51f0e2e4a80ba18ceabc57c8708324a912e546071383f0dbc0ea90cc6354122981e5344e6df284adc7d41d415cd64003
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.pc07b68963.ikk18/primary.prof
Size 1KB
SHA256 47dd0c2d2fa68ff79daec9327eab0d871ba01d401daf009cd6a9eebdde3ac64a
MD5 b736960a663670a9fe93bd1a83e34f4a
SHA1 c6c2f3e7d8d19f14e5e69fd4cfaa8ef3fe21594d
SHA512 c4bcefb697801c400ca7c297b67f1b88ce130b0e1a2129724c4e65df30dbc2fd19bfc16281a3b91d936a558c8c6be135d9be80953c94515c7fba0b0e9994047f
TLSH
T11731DAC915F43652D825AD7115C490D3497D508AF496B850FBEC76F2485490CFDFB60E
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads