c0c7ed211069e5b9bfd5c7cddaaf4f3fef1e20ea0b91346866b2fbb6e961e17a

Analysis

user interaction
yes
max time kernel
302s
max time network
408s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
01/07/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Onlyfans-v6.6.6-MOD-GMA-(Getmodsapk.com).apk
Size 20.7MB
Sample260701-ntqchacy5k
SHA256 c0c7ed211069e5b9bfd5c7cddaaf4f3fef1e20ea0b91346866b2fbb6e961e17a
MD5 4106adeb56d751fb8f00d5e7b226db48
SHA1 7a85b6d003c4bcc2944a2e9a803a89b9257844fb
SHA512 fd679f52a5c091b828af05a74fc7b6d1e682e74a3df71fb33ea931f6f9a0eb8d5a8a73c20bc228000f0ecbb47c34556710a2bcafe3dce76de2ef15bfc1c7279e
SSDEEP 393216:KO8VbCUEvd4Dzae7OFFCvA/Ktb2EaKHYPEuGL1LroZjYXAmGigAtOhVB:ebCUE9pjCvA/Ktb2EaK4D814FnigAuVB
TLSH
T1FD271283F399E92AC977C0B24A6D0B27659B4C58DA83D3531E14B35C68F7ED06A81FC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.very.onlyfans

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.very.onlyfans/cache/1588462714860.jar	5020	com.very.onlyfans

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.very.onlyfans

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.very.onlyfans

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.very.onlyfans

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.very.onlyfans

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.very.onlyfans

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.very.onlyfans

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.very.onlyfans

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.very.onlyfans

com.very.onlyfans
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5020

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1588462714860.jar

Path /data/data/com.very.onlyfans/cache/1588462714860.jar
Size 9KB
SHA256 e4270ee2c7c624bde9dacf923066032fd734e12cd70c8c70c949aee553896ef2
MD5 86066e62936fea939b14bdc2a636ff1c
SHA1 c0faa2f4c6f206b92bd611323c8f81b02dc8f16c
SHA512 1c0dee21b55c6ee6d4cbfe8c7c13f03bd39fbe26c329e77b87d0b13505e91242f93d1dd541f08c66bb701c591ad75c3d0b5ca846a2498b1a28e38a365875ecaf
SSDEEP 192:+GJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHbZkX:7kMwTTNdlns/ombJZ
TLSH
T17A12AFB8BF770E3CD0DB0C78CB67E800905F25841AA3D514E0656066BFD47B5B1E315A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.very.onlyfans/databases/google_app_measurement_local.db
Size 16KB
SHA256 c4b349e3268c61d008bc1fa8f5806120d6ae2fe1bbd6ae158160d318999a758e
MD5 d213224d73e9a15099c459e6e097dbdf
SHA1 4cfa45938c630834c013891b6d11d5d841386ef7
SHA512 bc0c5ef19a6a0295a9e37b02e649cc84e5c740a9ca704728b6d52c23bf64ebb05c8f73fafa9babb70278f4a2b8a7cfb99ad42126a3c2e3b8a2f222b154147627
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl631U:TLiEy9zmzrfRmBEyPbP/P+/0Fl63O7
TLSH
T1D87268CDBB106703D1734776B0CBA3E21C30B2188323DA073B580468AC421846042F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.very.onlyfans/databases/google_app_measurement_local.db
Size 16KB
SHA256 9d0292d3b85ff5642d1974ca361febd6a26160a27da2ec272eea7a9767d6557e
MD5 652c468aff0cae5bff74640891269622
SHA1 dc8ea1a8c7b57c76ae0fa354f8403a5dafa84d00
SHA512 4aae12bb393aa90e36e3b274bf5b631e1f833c742ebe3ebd52ec31f58dbd90f8fcf73ffd8e5480e18a657ae7b43f52335277acf7ad5940ac1bae34e368a28bff
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFloL+/0Fl63O7:TLQpmzr0GSP/h1499FAlFX
TLSH
T18B725999BA109B03E2334B35B0CBE3D22C3472158723D50739091A2C6D823855012F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.very.onlyfans/databases/google_app_measurement_local.db
Size 16KB
SHA256 a4f2d98995b77c3178f491dade79772956e8a716956847f7aada11df6a4180dc
MD5 fd72575a05a41e63b09d2b7a7fba8f47
SHA1 87699aefec7acc6f228b86dd8b9490f645a47869
SHA512 15c8871eeca8ab53fa9ecf37b1f7cbd5a2ecda9e43eebc9e3cf6b3cd5fc8ea93fda8abec667ccedb20c7515154bfbc2ca486b45eb9c08bcf3d6373e5842cb937
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/JOLabCAUEWlCuUyWlP2e49blqYFloL+/0Fl63O7:TLEvpmzr0GSP/JKabCCbB499FAlFX
TLSH
T15A729E98B564D713F2734B39A1CBE3D63C3571664723D6033D0A1B1C6D423814022F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.very.onlyfans/databases/google_app_measurement_local.db
Size 16KB
SHA256 b6a35d9745654e0884eba799f6ae0d8dd9ae81b4964cce61345ae8212c9da1e1
MD5 444adcf3f89cac0c78e6edae3c7750c7
SHA1 3661a70ec6ce5582400661bf385e2ced6bf03c6d
SHA512 58c46a9fc6d12d482d571502591ea9464961be0eea1ef92ffc5f61587c433d070878520e5ff1aa5e988fad5f0aab575db4f3948470b115bd7f2adea5264366b9
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/uOLabCAUEWlCuUyWlP2e49blqYFloL+/0Fl63Ov:TL6Xpmzr0GSP/uKabCCbB499FAlFD
TLSH
T1F6727B88B664DA13F2734B39A1C7E2C2383531264323D613390A1B1C6D423814022B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.very.onlyfans/databases/google_app_measurement_local.db
Size 16KB
SHA256 458aa953a9e0adbf5b8765ebcf6b51bc5b5a48b7664e85d25c7a8ce9781a2d5c
MD5 2f1eeee3602c828b8e9f81f6fbd20d41
SHA1 d240b568bb6929702815b9a5edd05ad635671caa
SHA512 a8642cc12cb9af0cd9d3fdc4bb1fe3b246d02af6b36714d80cdd2809def699b0b93eb585187c17f0a8e19801879e2e9edef7963ee416ae9e8cc35fd9cede2859
SSDEEP 6:l9bNFlgls1qlvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WK:TLuEev9zmzrfRmBEyPbP/WK
TLSH
T1A8722BCD9F102603C5730777B4CEA3916E14A21D83379E472BA90574AE834499061F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.very.onlyfans/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
TLSH
T11F727DCEDF002202C1360733F4C9D3901D60921D8336DA0767940460AD02108A451F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download