General
- Target ForkClient.12.10.6.0.apk
- Size 43.3MB
- Sample260930-twmx2szhqe
- SHA256 d9122d348fb61291ba13d67a48dadd600509d65c529f381053dad23cdb07b42d
- MD5 960b05b6139d2dda314a9ed0f047e9ad
- SHA1 49b731706f2cc667a234b1160152609cf2f0e344
- SHA512 953d3e02fc38684e8f389f9fac75f044dcc6ca1496958106c29a939d6dfae8ac09d2b32ff4c8b5b0b9709a867f968ab8db505410eab61641d8244dd25f46e30c
- SSDEEP 786432:jp2U9F8mgzX/+XXmXn6vmR+rODqm7H5bXI/gDfURQ3J7d9Y1rX2zXnW7vcWT45mO:V2UL8mg7+XXm36vAY4T7dfUK3r9Y1X2t
- TLSH T18EA723EBF3387D1EF83669714AAD4932A6204F644502EB1E14497B7D78333A62F44BC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
ForkClient.12.10.6.0.apk
Resource
android-x64-arm64-20260325-en
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
ForkClient.12.10.6.0.apk
Resource
android-x86-arm-20260325-en
9 signatures
300 seconds
Malware Config
Targets
-
- Target ForkClient.12.10.6.0.apk
- Size 43.3MB
- SHA256 d9122d348fb61291ba13d67a48dadd600509d65c529f381053dad23cdb07b42d
- MD5 960b05b6139d2dda314a9ed0f047e9ad
- SHA1 49b731706f2cc667a234b1160152609cf2f0e344
- SHA512 953d3e02fc38684e8f389f9fac75f044dcc6ca1496958106c29a939d6dfae8ac09d2b32ff4c8b5b0b9709a867f968ab8db505410eab61641d8244dd25f46e30c
- SSDEEP 786432:jp2U9F8mgzX/+XXmXn6vmR+rODqm7H5bXI/gDfURQ3J7d9Y1rX2zXnW7vcWT45mO:V2UL8mg7+XXm36vAY4T7dfUK3r9Y1X2t
- TLSH T18EA723EBF3387D1EF83669714AAD4932A6204F644502EB1E14497B7D78333A62F44BC9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks known Qemu pipes.
Checks for known pipes used by the Android emulator to communicate with the host.
-
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
-
Reads the contacts stored on the device.
-
Reads the content of photos stored on the user's device.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Conceal Multimedia Files
1Virtualization/Sandbox Evasion
2System Checks
2