fantasyhub | 51863351193ab67148e3e47255cad4927eb13939292c7854121ebedb4de28590

Resubmissions

01/07/2026, 22:29

260701-2edbaafv6l10

13/02/2026, 12:11

260213-pcltesdw9g10

Analysis

max time kernel
25s
max time network
22s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
01/07/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TikTok18.apk
Size 8.9MB
Sample260701-2edbaafv6l
SHA256 51863351193ab67148e3e47255cad4927eb13939292c7854121ebedb4de28590
MD5 3a7e645b8cd31fd1574cb10ff6900804
SHA1 4784df9fbcf7d29ee06b5330a609d6306949773d
SHA512 660dbc0283b05bdc8920c1d0a8fabde6abc4d5dd4e416ac0719be2bb6623a0ed2d7b4ee36e6372355dcd948283f5b95bb1a5d66f402fd3935a9b81aabf024320
SSDEEP 196608:6modgsWGzNUtfC3uHlUSUPptWscbWqrDn0elqTM:poCsWGzNUlCgSSUuscyq8ef
TLSH
T1F89633A2F328992FE8B614B64D6A0A711397DE6B8EC543035088372D7D3B2C45F69FC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker collection credential_access defense_evasion discovery fantasyhub impact infostealer rat trojan

Malware Config

Signatures

Family: FantasyHub
FantasyHub is an Android RAT first seen in November 2025.
trojan infostealer rat fantasyhub

FantasyHub payload 2 IoCs

resource	yara_rule
behavioral2/files/fstream-8.dat	family_fantasyhub
behavioral2/files/fstream-11.dat	family_fantasyhub

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.pabd414518.app0474d769

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.pabd414518.app0474d769

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 22 IoCs

description	ioc
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pabd414518.app0474d769

com.pabd414518.app0474d769
1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Checks memory information
PID:3252

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

chiken.apk

Path /data/data/com.pabd414518.app0474d769/cache/chiken.apk
Size 16.3MB
SHA256 c7fa36defaa3be8ffc4c2a9341fe66a22435a6d6f0f664a9fdfd1d8c217d0525
MD5 9cf443632492a67d44a7662c435dbcd3
SHA1 c63eb30f0ae3dc50f6dc1fbfd1f17d0b82ce2d7f
SHA512 a47d992d2327b00c54bb909e4fe36932ae62b546cd4f596099e4faa573e8a3eda15e688833c5b5b99457c62cdadef0f0ece5c7f176acbe42595b9d4e94d6bcc0
SSDEEP 98304:Rxd0yY0X5tR2p/wNrVuoZQukgZBW6Di/5vrERSzEYmmmYu93Tej/UokDhfSEIkW9:7dZY0JtR2YuhupvW6G/6RcLUok6kW1a6
TLSH
T11E077C06E3069867C5DC973819B647C2F335AE4A6B8783171349F16CEEB3AE6DF54280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chiken.apk

Path /data/data/com.pabd414518.app0474d769/cache/chiken.apk
Size 7.7MB
SHA256 1c6e2a40498927104042e739da3c7d0f6de2497376ce01bf39d94173fb368a36
MD5 73faf2df92e88c03f4a79ef42a9de36b
SHA1 50238ce23dbba44b8a5f0a4ed94abbef83994d85
SHA512 3dab3a065423250ab5908992f79dcf8b22186fcbd4ee6d2b44eb94a174025f4f8e0ac57c0c5e134e7af4509a9c36d71ab956559c7833f6e51024f04dfb4e97d5
SSDEEP 196608:9MgRVhFNpXMy1P+TgHe8uz8GOTeo9JIKStunA1X1L9IUj/+D:9MgnhF38y1PQ87z9JIsMX1L5/s
TLSH
T1DC862385E728043FC5B9097249F707312B678E1A49D2B7572988362C9C7B24C5FAEFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chiken.apk.signed.tmp

Path /data/data/com.pabd414518.app0474d769/cache/chiken.apk.signed.tmp
Size 16.4MB
SHA256 fabb76c9d0df6d712745755c162e5b533b0a898afed44a2cf10d39822d5d4106
MD5 fd7232b35a77b9710cb19395547bdf0f
SHA1 e3f2f755335617cd9786110f44f202cee4d641a9
SHA512 5494ee88b2e911029bb23ebd5f122a1e2fc153676895a36d9c0168d21c916543855a8d234ec957a8e1426aed24715e9fe8c2f8f482de80200c3d583619bc2427
SSDEEP 98304:vxd0yY0X5tR2p/wNrVoodQukgZBW6Di/5vfERSzEYmmmYu9RTqF/UgOdhfaEWyuU:pdZY0JtR2Yo3upvW6G/uRcBUgQ4yu3mJ
TLSH
T15D078C06E3069867C5DC973819B647C2F335AE4A6B8783171349F16CEEB3AE6DF54280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chiken_patched.tmp

Path /data/data/com.pabd414518.app0474d769/cache/chiken_patched.tmp
Size 16.3MB
SHA256 55426492f381b775c3fa0c592435bbe47b26febe27c9988d91ef2c026ecd4927
MD5 cf7573127e54db3ca93a5706050ad2bf
SHA1 efadbceed5d27a1f29099a15f34d32c5ae95b25a
SHA512 23ec6d93ebdc5248f0585d513c5e68e09ebb7093dcd5962135c9120d0cee76a11189c98ceb942cc52f04da8328baf917435a9b9443d3eef86dc7aa66f2f74bc4
SSDEEP 98304:Gxd0yY0X5tR2p/wNrVHoZQukgZBW6Di/5vrERSzEYmmmYu93Tej/UokDhfSEIkWV:2dZY0JtR2YHhupvW6G/6RcLUok6kW1aq
TLSH
T155077C06E3069867C5DC973819B647C2F335AE4A6B8783171349F16CEEB3AE6DF54280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dog_patched.tmp

Path /data/data/com.pabd414518.app0474d769/cache/dog_patched.tmp
Size 470KB
SHA256 d0ac31d3d1554f8f6563df056b83cd23cb7ceb6d1dfd88b40f6001be9c665c49
MD5 62e5c62d0439f6657f8eb14dbdbba342
SHA1 df19404de1e51a00198dad61f65b1f4b91032e22
SHA512 1c5c41328e39ee74e91bc66c23dc6f3b78a5548c6db7a96f9fbe45a1f308e57f90d3b61428303a7d21684417d93c0cf98305a20a8156eed7ef837157fa5c9708
SSDEEP 6144:Zodf9exi7x2lV5RMFs53cogD53Mpd39RCjBbxmOg:ZoT7xsvMs5Mzmp+bx6
TLSH
T1EEA45C06EA904E33C4AF127D45A31780373AA949AB43834B320DEA787FB33D65B975D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dogandcat.apk

Path /data/data/com.pabd414518.app0474d769/cache/dogandcat.apk
Size 439KB
SHA256 481aeb107b7e44c109ab0aa25ae8f75a41658736f7a6be61f928596da7bdec4a
MD5 16d83376f88f9c020e59636b0fddc536
SHA1 6085910bafe57e7a1e9532abbb86be2e35dd26c6
SHA512 998d060b61ccdb348adb38b95ac8ba0a80f4489f2497d1faf934a39d32b8c3faaa72acba5cfb5d003b54e7d6b516452d4cc003855a2d3b21488ad90ca3a072a5
SSDEEP 6144:modf9exi7x2lV5RMFs53cogD53Mpd39RCjBcMpcq3H:moT7xsvMs5Mzmp+cMpT
TLSH
T1EAA46C06DE904D33C8AE227D45A30390373AA689A743834B260DD6B57F933EB5F876D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dogandcat.apk

Path /data/data/com.pabd414518.app0474d769/cache/dogandcat.apk
Size 470KB
SHA256 759a471d829cf0bcd6c0481e0bf63b7030fb9abdb6e974c385f1bf4dcf188211
MD5 7cdee9278cc3325a8169ce898c1b7c25
SHA1 5455df55693fbc13245caca1314bfa2fa0c91a29
SHA512 f866c8b7b32b21782f0ccb39a6a22ccfc3c4c25f48a806cd2bedeff8e0126d7c34ef54697045ac6b30c12d0154a18dcd95a6d4952d4bfc6eaf2af2222c2391fb
SSDEEP 6144:Oodf9exi7x2lV5RMFs53cogD53Mpd39RCjBH6l1q:OoT7xsvMs5Mzmp+H6m
TLSH
T136A45D06EA904E33C4AF127D45A31780373AA949AB43834B320DEA787FB33D65B975D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dogandcat.apk.signed.tmp

Path /data/data/com.pabd414518.app0474d769/cache/dogandcat.apk.signed.tmp
Size 483KB
SHA256 c72d1f2b115b7b08b92549589d2f628df42cfa3bd398333cde88ac0f7da18c7c
MD5 96b84b0fb56abf0d1dbdb2dfadfb117e
SHA1 28b4b30375524abb9e2d3b2533d0f0984b3eb69e
SHA512 73e43648d7b48a27fecd82781877a4f7b3869c8efe9e0aea9293485ccfb22462554007be63facc2d9d4a2b0f8834e7e179f706e3c4ccea9876ff18cf786c8305
SSDEEP 6144:qodf9exi7x2lV5RMFs53cogD53Mpd39RCjB3a5jn74:qoT7xsvMs5Mzmp+3aJ74
TLSH
T109B45D06EA904E33C4AF127D45A31780373AA949AB43834B360DEA787FB33D65B875D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.3252.tmp

Path /data/data/com.pabd414518.app0474d769/cache/oat_primary/x86_64/base.3252.tmp
Size 148KB
SHA256 01dac0fd5dff4b330d5e81392740457e779c61c2efcf670d665d1da7107e2e21
MD5 bec09890f32e93aeaad68531d9f292da
SHA1 a76d12eb3c684f13eebadb330a8a609e1d1487a6
SHA512 e0e270cfacae931a9219345a1c643cc6a1d737af301b937ac3d9a61bc2346061c34b95b51aedd1e827d3352656907de1a195b5938abf9d3eb6a1e4bf7e8f52bf
SSDEEP 3072:pYzb1oy3WtqwKGD5zIAQyEwzYWj6P6SbyEM7f9f:yzbWslG9tQyEwzYWjO6SeEM7h
TLSH
T1EAE3295FEA639011C1FBAEF3AB8B16E8F92E8024131A1D019471777FA416E15FB64F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/com.pabd414518.app0474d769/files/profileInstalled
Size 24B
SHA256 c58ac17b7157b9cd6e1a1e63025bb0a15a38a0f2d54d02648ef0186a09d6af99
MD5 0dfc6ec32ba2cbf2d69c56d29730fb80
SHA1 45887508d3aef492af2c520cd584a5c5f680ec71
SHA512 915b7ce618bfb57d49723f1facf26360d0345209d6e9b48694d23c9d2166b95943883ccb94fa307b2550d6be5aa1bbfabe7f68e0801a5255f07fdb9a38f26195
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.pabd414518.app0474d769/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 3beb580310cb8394132cb0a1c7d41d2848ce1847c31b43ff2e157569740c53f5
MD5 020e0bb098ccf3a8eee7257540ea12f1
SHA1 301aa9a8e2b513dc1c6f0e2ad0f25276dd74410f
SHA512 24d6d7379902318a94907fee0dc1050fa09b1b24a1ddb8652f124d8f8dbc8011b322d02bd65dad4d717d2a6a85030a7b0c3a27bb844e6ad9c50c9200ef56ef70
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.pabd414518.app0474d769/primary.prof
Size 1KB
SHA256 47dd0c2d2fa68ff79daec9327eab0d871ba01d401daf009cd6a9eebdde3ac64a
MD5 b736960a663670a9fe93bd1a83e34f4a
SHA1 c6c2f3e7d8d19f14e5e69fd4cfaa8ef3fe21594d
SHA512 c4bcefb697801c400ca7c297b67f1b88ce130b0e1a2129724c4e65df30dbc2fd19bfc16281a3b91d936a558c8c6be135d9be80953c94515c7fba0b0e9994047f
TLSH
T11731DAC915F43652D825AD7115C490D3497D508AF496B850FBEC76F2485490CFDFB60E
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads