Analysis
- max time kernel
148s - max time network
154s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
05/08/2026, 04:18
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
PhoneFarm-Controller.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
PhoneFarm-Controller.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
PhoneFarm-Controller.apk
Resource
android-x64-arm64-20260325-en
6 signatures
150 seconds
General
- Target PhoneFarm-Controller.apk
- Size 3.9MB
- Sample260805-ew7j5avyb1
- SHA256 ba9967c9655c062b26ac1a4d14a43d297c7eab392ca7dfa0b5d6880f8ca7fd17
- MD5 4faa67ad7e0e662851e32a5f886c48b3
- SHA1 3b14528de25f7566f22d99e548b4467bd9420d1d
- SHA512 0155000f36136e6f9eeff7c95625158df0251a3c61a6181c1f47a7eaa921f72421f841510ef45a19ee5fc5dcc7d88511c10b0a2e99de6ef0ef5100a63e3c8473
- SSDEEP 98304:936vLq6J62eDJg/1xX7cEJjKwblHionmkvgy319sV9o0XCrpseqOd8b:9qPwK9xJjKIBuyc9gpxi
- TLSH T17B161241F3E8AD2FDC7381324BBB463A41868D56C642C7478969B22C5D7BAC44F86FC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.phonefarm.controller Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.phonefarm.controller - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.phonefarm.controller - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.phonefarm.controller - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.phonefarm.controller - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.phonefarm.controller
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.phonefarm.controller/files/profileInstalled
- Size 24B
- SHA256 ece2972ff9e1e2708bd2b4c63dbef1a6554c72db6115251c82be1663377dad78
- MD5 baab09c3e81e85c361769dc4ba6d8cf2
- SHA1 37c9d26085ec4078e39d4d778be21de3a34c7ecf
- SHA512 ffad29b232f83020e105f1879a88c68e250690f7a117c6c055f6453989c797ae632d64d2af3b7e999294a01bf449233c57d54c5b39bd849741eb9ea210d9b211
- MD5 SHA1 SHA512