Analysis
- max time kernel
97s - max time network
69s - platform
android-9_x86 - resource
android-x86-arm-20260306-en - resource tags
arch:armarch:x86image:android-x86-arm-20260306-enlocale:en-usos:android-9-x86system - submitted
09/03/2026, 18:10
Behavioral task
behavioral1
Sample
2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31.apk
Resource
android-x64-20260306-en
android-10-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31.apk
Resource
android-x64-arm64-20260306-en
android-11-x64
12 signatures
900 seconds
Behavioral task
behavioral3
Sample
2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31.apk
Resource
android-33-x64-arm64-20260306-en
android-13-x64
12 signatures
900 seconds
Behavioral task
behavioral4
Sample
2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31.apk
Resource
android-34-x64-arm64-20260306-en
android-14-x64
10 signatures
900 seconds
Behavioral task
behavioral5
Sample
2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31.apk
Resource
android-35-x64-arm64-20260306-en
android-15-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31.apk
Resource
android-x86-arm-20260306-en
android-9-x86
10 signatures
900 seconds
General
- Target 2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31.apk
- Size 8.2MB
- Sample260309-wsf2facs91
- SHA256 2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31
- MD5 00d9cf98baa6178949969d3471691dd4
- SHA1 f702f56ebcb68301508084a6045925b34c49c274
- SHA512 3f648b8f3c92e4015e9fdb8c034042b15e2522e130225ee5d3f0109385646e912dcd004f8b987ebcf8b23fd15709a6a927b24df27d949785ece6662fa3901b2e
- SSDEEP 196608:64jSh1dNhS9hLoukJaWL7+RkS4/UwzG2iNmKr:9M1dNhS9h8b777SiiEKr
- TLSH T181963396F729A52ED97B41710A8A473223669E09CEE7D307A1543B2C783B3C98F44FC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- FantasyHub
FantasyHub is an Android RAT first seen in November 2025.
- FantasyHub payload 3 IoCs
resource yara_rule behavioral6/files/fstream-3.dat family_fantasyhub behavioral6/files/fstream-4.dat family_fantasyhub behavioral6/files/fstream-6.dat family_fantasyhub - Fantasyhub family
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Declares services with permission to bind to the system 3 IoCs
description ioc Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.pc07b68963.ikk18 - Requests dangerous framework permissions 32 IoCs
description ioc Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Allows an application to receive WAP push messages. android.permission.RECEIVE_WAP_PUSH Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to read SMS messages. android.permission.READ_SMS Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Allows an application to receive WAP push messages. android.permission.RECEIVE_WAP_PUSH Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to read SMS messages. android.permission.READ_SMS Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Allows an application to receive WAP push messages. android.permission.RECEIVE_WAP_PUSH Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to read SMS messages. android.permission.READ_SMS Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to send SMS messages. android.permission.SEND_SMS - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.pc07b68963.ikk18 - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.pc07b68963.ikk18 - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.pc07b68963.ikk18
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.pc07b68963.ikk18/cache/chiken.apk
- Size 7.0MB
- SHA256 3a90670af15275d048191fe41bfcbe63939961364a16de93178eff69ff810834
- MD5 1351afbe7586db0c3a455d044531cf02
- SHA1 467c300b592546b2b373f1559be6b6e525510ac7
- SHA512 74cceb86e9c0a25238e1d4fd5b13b8f2104f5765abe3ed38a68dd03423561ca4b8706b7bf0f1580ddfd89247cf27895b18711f4c5cd3fef3d35984fed66257e1
- SSDEEP 196608:FAQlEJfbk00qJwQk6FWE9JIKXFtunVhDNbf:FAAUkNtQkhE9JIo8V/bf
- TLSH T117762386F728013FC5B644724AA6033167678D2A4ED7AB4B2988772C9D7760C0F6EFC5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.pc07b68963.ikk18/cache/chiken.apk
- Size 7.0MB
- SHA256 15cd5bbbdb9e5f980043bcc849a66c8fb77ba4af44dacfdc653e2488622b2408
- MD5 c2b8c31f78596501d1c08e2088ff0429
- SHA1 7337390ec0f9295188b447e405a28f6cf9604036
- SHA512 1cdd95520bf949bc334457b9a86fb6bd995df0793bdc0c956908aeb0f1c190c4125fea3100310ec92523336a98af8d7ec4faddc316c7f7944031e26d67ae4198
- SSDEEP 196608:UAQlEJfbk00qJNQk6FWE9JIKXFtunVhDNGC:UAAUkNQQkhE9JIo8V/GC
- TLSH T127762386F728013FC5B644724AA6033167678D2A4ED7AB4B2988772C9D7760C0F6EFC5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.pc07b68963.ikk18/cache/chiken.apk
- Size 15.5MB
- SHA256 88124fa447b804b2b10358a99f5f08d8450e0893106c99aada7f1fd845cec25f
- MD5 6c184c4d3a7c5632ef26a403d88459d9
- SHA1 1f38d836b2ecefc377df25709d6efd3472e8539c
- SHA512 a5047ccff9ff35b862dbfa8a4b504b29992d4de14b90a71286c2c5ab2b099d63bb3b6ad61807c8a55e1a46d2d00ee910ae1f4690ab56f798c31f9aac1b20e17b
- SSDEEP 98304:kptSYw5jF8zChrH/VxcrUod6D4YVQsQukgZBW6Di/5vRERSzEYmmmYu9ZswPZbo6:kpt4jF8eNYUnwupvW6G/YRcn1ZmN
- TLSH T164F68D0BE302DA26C8DC7B3C29B657C637316E4E9F8343635058FD6D9E726E59B24290
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.pc07b68963.ikk18/cache/chiken.apk.signed.tmp
- Size 15.6MB
- SHA256 9f012cfd2067f00e88038ad9e08160288b2b610810e8621807e1d323dbfe084b
- MD5 23be6dc7b49be370ea34dcf51464f324
- SHA1 04127eb7863da6b4c8edbc89e49b46e8459755e8
- SHA512 574b1a1e1ad520302fcc9880cd1bd202f4c3a67ac35c404db55aef24158ed63280229ab2337ed1ca1edeab3451e99d26b0324fc3aca53da5db2a0acb6a232068
- SSDEEP 98304:mptSYw5jF8zChrH/VxcrUoL6D4YVQkQukgZBW6Di/5vLERSzEYmmmYu9b66PjV+7:mpt4jF8eNYUJCupvW6G/eRcBvjoc
- TLSH T11AF68D0BE302DA26C8DC7B3C29B657C637316E4E9F8343635058FD6D9E726E59B24290
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.pc07b68963.ikk18/cache/chiken_patched.tmp
- Size 15.5MB
- SHA256 b1c163b6f91bfdea085a1a4f672f909fe7c3dccfd4f02fee4d060d828081df3e
- MD5 6e0f15e7ad389e5caf6b9d8b008a66ea
- SHA1 1c57157dc4ca4daa9b6718110823733a6bfa6c4c
- SHA512 27e794f65432f64a385caeb65e0f1c4020cfd0c72728e5a2360d8d919183a5d86ac28efeda55fe18421b25ded345be9b4597bfeffee14f623c2f87eb692ca38b
- SSDEEP 98304:hptSYw5jF8zChrH/VxcrUoQ6D4YVQsQukgZBW6Di/5vRERSzEYmmmYu9ZswPZbo2:hpt4jF8eNYUmwupvW6G/YRcn1Zmx
- TLSH T193F68D0BE302DA26C8DC7B3C29B657C637316E4E9F8343635058FD6D9E726E59B24290
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.pc07b68963.ikk18/cache/dogandcat.apk
- Size 439KB
- SHA256 b6c42dd2f522b2424e77443472d6ad4a0710d738ef664d69a0141bb71b1424c3
- MD5 b3b7ea263e6198c2821c0d3be77a83bc
- SHA1 f434b1528b307cf1609507beeeec221bff91a0f9
- SHA512 0058c5961be8c2af5256677a4cb0a683f4ff8f54b6092c68c7666b901a7755c34597ebf6fcdc7ae655582d05f4f973f08fd4a028f9e7d283c4c790c94af2df8e
- SSDEEP 6144:hodf9exi7x2lV5RMFs53cogD53Mpd39RCjBcMpzq3F:hoT7xsvMs5Mzmp+cMpm
- TLSH T159A46C06DE904D33C8AE227D05A31390373AA689A743834B260DD6B57F933EB5F876D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.pc07b68963.ikk18/cache/dogandcat.apk
- Size 439KB
- SHA256 cf9dea7dc62717e4b239f0595594ec4211252e3d8fad46b1b59061f698801993
- MD5 42a73d34ac66b8df192973a9edf9cfce
- SHA1 c2e1ab09d343fd13d1757087d17596e781b12504
- SHA512 49d5c35d50d2d7d87ea99fc1bddb5b5cb2b7c7222785b7b217c566e3249d9bbfa053decb5bf2082eb798c67269ab290bd0c8156d7751afb7aec062416e1afd39
- SSDEEP 6144:modf9exi7x2lV5RMFs53cogD53Mpd39RCjBcMpcq3n:moT7xsvMs5Mzmp+cMpr
- TLSH T1C5A46C06DE904D33C8AE227D05A31390373AA689A743834B260DD6B57F933EB5F876D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.pc07b68963.ikk18/files/profileInstalled
- Size 24B
- SHA256 98e21af5fe76321d7ffdf60fa7d7e2aa127f3ba9d80a669ce86722e065df5fc8
- MD5 ba4e00b5c600b741e2e745272b8dee07
- SHA1 ffc9f31fcf2414764d1adee7023a667501d3b41f
- SHA512 c6d815473b8e3441ef4af5f8f5ec361b8fad7979f2cd0db3c8c256655108c110d0c89de2b5a70ce357b5f031b707153f89f508d2b64c343bf04c1e1d93c3b33e
- MD5 SHA1 SHA512
- Path /data/data/com.pc07b68963.ikk18/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 75648c835269b46dbbcee63fa30861fa8333a939d182e948d7cb32eadc80e5c2
- MD5 17a50e833e90030d0bae129ebdca1505
- SHA1 2fedcdefaa9f0edb9946b3c8b215bbcee4da8dd1
- SHA512 a6d86179cd7d71fefd1da54738a9ab4123287fd2136b7b098a7870498c1c3597405885d2dc1028eabb3d6a7573c407d73b9bd97cbc9dc7bc89c3d3d50cf48fe3
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.pc07b68963.ikk18/primary.prof
- Size 2KB
- SHA256 f1ff549a9052698b24b592eb353bd197ba411cbe25131509cc18f982f71df221
- MD5 ea14ceb53d3500bed8acfc36cabed578
- SHA1 8dbdb3803766a4825d2663f78ee309a054f79027
- SHA512 906c203b11fddde91edb2e48e7827d63c423324606bcf471b58506b0cbcb0f404937053c0cbf9a5a5bac65cd9e21294dfe052059f8e85c59582cde67621ac4ed
- TLSH T14C514D97045DEAEA57456CB3B9DB17E58347B0C70C2A0C069B37FCD084912B5EC78976
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/com.pc07b68963.ikk18/primary.prof
- Size 1KB
- SHA256 3ab8df788482e94a8be55e4020d6512e96690348db75b62fcb20437ac4021e25
- MD5 e6b3e412e1c6373b8d40b61e38ec79bc
- SHA1 788b75bc99193082190b2e0fb048f68d3aa3912f
- SHA512 04573840a690eff0b1c9f211d6ec424e220dad2720beb4f572aa3be20bf27a15d977c2f748c79fc58665819c44079beb6ab5296e03a9844511dc4e6eb0d549de
- TLSH T16B31E980280819B0E89CBDD7C64026273D0F892133C91968FBEE3040948223F82B3794
- MD5 SHA1 SHA512 TLSH