Analysis
- user interaction
yes - max time kernel
9s - max time network
17s - platform
android-9_x86 - resource
android-x86-arm-20260325-en - resource tags
- submitted
30/09/2026, 16:24
General
- Target ForkClient.12.10.6.0.apk
- Size 43.3MB
- Sample260930-twmx2szhqe
- SHA256 d9122d348fb61291ba13d67a48dadd600509d65c529f381053dad23cdb07b42d
Malware Config
Signatures
- Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
- Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
- Reads the contacts stored on the device. 1 TTPs 1 IoCs
- Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
- Queries information about active data network 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Hides multimedia files using a .nomedia file 1 TTPs
Android's media scanner ignores any directory that contains a .nomedia file. This hides your photos, videos, and audio from the gallery and other apps.
- Checks CPU information 2 TTPs 1 IoCs
Processes
-
org.forkclient.messenger.beta1⤵
- Checks known Qemu pipes.
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
Network
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Conceal Multimedia Files
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
bluebubbles.attheme
cache4.db
cache4.db-journal
cache4.db-shm
cache4.db-wal
dc2conf.dat
profileInstalled
profileinstaller_profileWrittenFor_lastUpdateTime.dat
remote_en.xml
stats2.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
tgnet.dat
primary.prof
000000000_999999_temp.f