Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    12/07/2026, 04:24

General

  • Target
    Forbidden+Playground_1.0.0_APKPure.apk
  • Size 53.5MB
  • Sample260712-e1kk6acy5k
  • SHA256 e68791c3ebcbef3a0f3b2b9093fb852085cf5d3eeff47f1a70722cef284a8123
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.fdptudio.forbiddenplayground
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Checks memory information
    PID:4776

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        5007da20d5a229da2e625722e49f369e.0.tmp

        • Path /data/data/com.fdptudio.forbiddenplayground/cache/http-cache/5007da20d5a229da2e625722e49f369e.0.tmp
        • Size 3KB
        • SHA256 5d136afb1124f918d6651e84324893097580ba079f29683599107f316912de16
        • MD5 SHA1 SHA512 TLSH

        5007da20d5a229da2e625722e49f369e.1.tmp

        • Path /data/data/com.fdptudio.forbiddenplayground/cache/http-cache/5007da20d5a229da2e625722e49f369e.1.tmp
        • Size 12B
        • SHA256 e6af7e89057711abb18a172fb5319dc86da6ddbb983389816f0f57cdf5153f4c
        • MD5 SHA1 SHA512

        c76c7395c40dfcf6d818a5049cb5e8a1.0.tmp

        • Path /data/data/com.fdptudio.forbiddenplayground/cache/http-cache/c76c7395c40dfcf6d818a5049cb5e8a1.0.tmp
        • Size 7KB
        • SHA256 3c2750c6037a1cd2c020d42441283949b777029a98d414db834b32cff86a503f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        c76c7395c40dfcf6d818a5049cb5e8a1.1.tmp

        • Path /data/data/com.fdptudio.forbiddenplayground/cache/http-cache/c76c7395c40dfcf6d818a5049cb5e8a1.1.tmp
        • Size 24KB
        • SHA256 ef643b5901c207dffbcdb516dcbb58d8827d7fdaeeaa9345278d6df27d09791f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        f30f989e4c40c5a664ce354ea7e9428e.0.tmp

        • Path /data/data/com.fdptudio.forbiddenplayground/cache/http-cache/f30f989e4c40c5a664ce354ea7e9428e.0.tmp
        • Size 5KB
        • SHA256 f35ea8fec1f22402c304b636ed6e4c053e728813d6ec9affce2d80dbeb89cce3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        f30f989e4c40c5a664ce354ea7e9428e.1.tmp

        • Path /data/data/com.fdptudio.forbiddenplayground/cache/http-cache/f30f989e4c40c5a664ce354ea7e9428e.1.tmp
        • Size 48B
        • SHA256 c1d1c1a9561b1728d0d3a556619b1d604346511c47bf1fa51c598633ea97b072
        • MD5 SHA1 SHA512

        journal

        • Path /data/data/com.fdptudio.forbiddenplayground/cache/http-cache/journal
        • Size 297B
        • SHA256 6cce1b23f8d4f394bcf70cf27e94e7f7d0951d0fca8f7c5dd6b8ff0152f63ab1
        • MD5 SHA1 SHA512 TLSH

        journal.tmp

        • Path /data/data/com.fdptudio.forbiddenplayground/cache/http-cache/journal.tmp
        • Size 36B
        • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
        • MD5 SHA1 SHA512

        zTisdgF_RCvy01tNT1N-0g-wckQ.6947721329941169927.tmp

        • Path /data/data/com.fdptudio.forbiddenplayground/cache/image_cache/v2.ols100.1/85/zTisdgF_RCvy01tNT1N-0g-wckQ.6947721329941169927.tmp
        • Size 172KB
        • SHA256 3115547156218882b178e0684f2f18f3b48c66ade796d27fb95d9ac533acb294
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1779952099063_300x300.png

        • Path /data/data/com.fdptudio.forbiddenplayground/files/al/1779952099063_300x300.png
        • Size 10KB
        • SHA256 83bea889d553f783eec52c8777a1363391351d518baba82374ce7e2e70c31e95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ad-templates_499_index-legacy.js

        • Path /data/data/com.fdptudio.forbiddenplayground/files/al/ad-templates_499_index-legacy.js
        • Size 1.7MB
        • SHA256 8460a4e8ae0124d71fd2539b0e2317db6994c674bacb72e9f064584647ec135a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ad-templates_499_polyfills-legacy.js

        • Path /data/data/com.fdptudio.forbiddenplayground/files/al/ad-templates_499_polyfills-legacy.js
        • Size 167KB
        • SHA256 6faa4aa1054648fe756e676353d14b80bc751d10ca481f62757a7d208e45b765
        • MD5 SHA1 SHA512 SSDEEP TLSH

        e1dd3e78-c19e-4249-ba06-bd10c13ab2c6as_web-source_os2_01wh2mgtDOrg.mp4

        • Path /data/data/com.fdptudio.forbiddenplayground/files/al/e1dd3e78-c19e-4249-ba06-bd10c13ab2c6as_web-source_os2_01wh2mgtDOrg.mp4
        • Size 7.4MB
        • SHA256 4b3898e0f2fc373204e8d84cc578a4792ca815bb84a0dfaf6bf0f2c1528fd142
        • MD5 SHA1 SHA512 SSDEEP TLSH

        e1dd3e78-c19e-4249-ba06-bd10c13ab2c6as_web-source_os2_21whONMVp8gT.jpeg

        • Path /data/data/com.fdptudio.forbiddenplayground/files/al/e1dd3e78-c19e-4249-ba06-bd10c13ab2c6as_web-source_os2_21whONMVp8gT.jpeg
        • Size 230KB
        • SHA256 9d4f74efe753157aaeebbddd52037dbae4312a27d7f4359afe451100814803c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        e1dd3e78-c19e-4249-ba06-bd10c13ab2c6jquery-2.1.1.min.js

        • Path /data/data/com.fdptudio.forbiddenplayground/files/al/e1dd3e78-c19e-4249-ba06-bd10c13ab2c6jquery-2.1.1.min.js
        • Size 82KB
        • SHA256 9451ed8fd4c4fd0d216a5f3e80409c0f8759a404fb1dda1f9b8b27aa39d74a6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        od957ced_9949c33fc983d9bd565f36d110ee385de2396f7d_v1_js_load.js

        • Path /data/data/com.fdptudio.forbiddenplayground/files/al/od957ced_9949c33fc983d9bd565f36d110ee385de2396f7d_v1_js_load.js
        • Size 1.8MB
        • SHA256 2066c8079fe39f597b21dc9df41d902e4b5b0ecfa0b91396c9a66aed5fb78f6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        persistent_postback_cache.json

        • Path /data/data/com.fdptudio.forbiddenplayground/files/al/persistent_postback_cache.json
        • Size 9B
        • SHA256 4e89c765f879a6052bf02aaed88823281bbeaf0e713f91faecc643d6d31326db
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.fdptudio.forbiddenplayground/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.fdptudio.forbiddenplayground/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 2c032c22422eda929c0355beb2a7f4acfe72ec6d556a04e7e677ceb752841721
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.fdptudio.forbiddenplayground/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.fdptudio.forbiddenplayground/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 49a0a20cb0a1919b37ca06fa56255ee5f0e835cd9dbc1a72a0e30901f0c092e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.fdptudio.forbiddenplayground/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 0ed94f255387ff7811c71a97604c1de760c61366aa1db1bd6292abff5ae96040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/data/com.fdptudio.forbiddenplayground/oat/x86_64/[email protected]
        • Size 623B
        • SHA256 05fff30ebd1e936afc0ac281972161649b9828b154b0dd81e1f548799966c501
        • MD5 SHA1 SHA512 TLSH
        • Path /data/user/0/com.fdptudio.forbiddenplayground/[email protected]
        • Size 3.2MB
        • SHA256 7aae06433cff5967ac254484d784c2c348380891d0914c56de64e7e006668cd4
        • MD5 SHA1 SHA512 SSDEEP TLSH