Analysis
- max time kernel
47s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
07/07/2026, 06:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Coconut.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Coconut.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Coconut.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target Coconut.apk
- Size 5.6MB
- Sample260707-g1dtqabv21
- SHA256 8f7b601a8bd29eb4871d3a7254484541fcef963c1703fe71fa146b3759bce2aa
- MD5 41d968ae9107a726f0c1e3ca8decb807
- SHA1 e8ae859f6ed13913907c7688eac480e257bae517
- SHA512 8f23f61ab5725fef4724cf9b86d8c9992eba4919b67389f697b54bb580298ae2fb431dc3e1a72cfa51d52dbe85f1ea9e4da739abb6ac4813111932584b6577b3
- SSDEEP 98304:de4ReH5LHS1sKBV5dhHaFOunWl8mVVwZjJkdluWT1Tdba/COnsXk6zibxVBjqIfM:de4RGisuVHhHYleVwZjJk75T15b6tUkM
- TLSH T19856E0C1AEDC782ACB76423BCB66F6FD46B3DD4D868292876534F508187358C1E70AB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.feefollow.teacher - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.feefollow.teacher - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.feefollow.teacher - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.feefollow.teacher - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.feefollow.teacher
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.feefollow.teacher/files/profileInstalled
- Size 24B
- SHA256 39be039b838ade5e854a69c045adaeb80d404bbe0b130a1224f021d6c8e4f1a3
- MD5 5114e82f612e6607e2a95babe375c716
- SHA1 5fca40aaa3a94593cdca3a78242038fbfd00f58a
- SHA512 75f791008d7dccf236e9c1b066e57cd75d2dabc475500ce20c5b369ddf2d26a8771de0bc60dc58bb4688094df5888fecf674cebce2b4a2238a30bf245636161d
- MD5 SHA1 SHA512