Analysis
- max time kernel
22s - max time network
152s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system - submitted
07/07/2026, 06:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Coconut.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Coconut.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Coconut.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target Coconut.apk
- Size 5.6MB
- Sample260707-g1dtqabv21
- SHA256 8f7b601a8bd29eb4871d3a7254484541fcef963c1703fe71fa146b3759bce2aa
- MD5 41d968ae9107a726f0c1e3ca8decb807
- SHA1 e8ae859f6ed13913907c7688eac480e257bae517
- SHA512 8f23f61ab5725fef4724cf9b86d8c9992eba4919b67389f697b54bb580298ae2fb431dc3e1a72cfa51d52dbe85f1ea9e4da739abb6ac4813111932584b6577b3
- SSDEEP 98304:de4ReH5LHS1sKBV5dhHaFOunWl8mVVwZjJkdluWT1Tdba/COnsXk6zibxVBjqIfM:de4RGisuVHhHYleVwZjJk75T15b6tUkM
- TLSH T19856E0C1AEDC782ACB76423BCB66F6FD46B3DD4D868292876534F508187358C1E70AB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.feefollow.teacher - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.feefollow.teacher - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.feefollow.teacher - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.feefollow.teacher
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.feefollow.teacher/files/profileInstalled
- Size 24B
- SHA256 e3d0706b95c5c4b0086b30539215a40a227651f74663b49e9036b51142d564ae
- MD5 8d0c3989976d362278831eef8de14202
- SHA1 4a24eee3c4632cfb7363c61666f8c8c9cf4b283f
- SHA512 a1c70274bb00a4d24fe4ac26c72ddd43df456f9eb0e413c0bdc5a64a54e910e45b09a6bb5a6302153e9705464dad7b43d99034b1ab90739feef8d1d8984460b9
- MD5 SHA1 SHA512