ec003b86c78095fd540267a1c682ac4258d943f0fd5c5557c97e6af6f395a032

Analysis

user interaction
yes
max time kernel
11s
max time network
78s
platform
android-14_x64
resource
android-34-x64-arm64-20260325.1-en
resource tags

arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
submitted
30/10/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cihiro Cheat.apk
Size 4.5MB
Sample261030-ty5wmsfa29
SHA256 ec003b86c78095fd540267a1c682ac4258d943f0fd5c5557c97e6af6f395a032
MD5 9b81728522a9bba9618ebb38eadd0d17
SHA1 15d937da90245ada15466cc843c6dcd069c4d1c5
SHA512 7308d9b2642cc0f574db8d422c7e8f5e69090cc630a598d16bc8d9724ed525335d4f0c0d2ba5194ddac7a0231c0d692c181ee77c807fd57c81a0995404374fea
SSDEEP 98304:XjmwKTX+zM5qmMX/2h5mFfJWMCEjX2wVc6TI3BurPJBETFtt:xKTX9MqyfJWMJBVXTaAvy
TLSH
T1F1263332CA3B8E55F9533A3E167C18E1F87049D20773F2F76063601E79A99D22B27589
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

impact

Malware Config

Signatures

Attempts to obfuscate APK file format 1 TTPs
Applies obfuscation techniques to the APK format in order to hinder analysis

Obfuscated Files or Information
T1406

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read SMS messages.	android.permission.READ_SMS

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yeag.fbnts

com.yeag.fbnts
1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:4361

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1406

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

base.4361.tmp

Path /data/data/com.yeag.fbnts/cache/oat_primary/x86_64/base.4361.tmp
Size 20KB
SHA256 aea2d6a3c112175f141a1c57cfafab19d4b4f227fc24ad34cfc43ba3aa725ce7
MD5 d8de176997b25339c61181d8fe8a4471
SHA1 ad07286b1fe6aa2d79a15a3a486c229b87e06225
SHA512 388115a94228ee1693a966c963bf2746385d07766188691cc6dc87812d810f1b6cd6c03c55a74ff8166647d399e78285cebef645f14a4064c07ee9b64cba5daa
SSDEEP 384:zJmV4inlT51r8stI7HOuSl4fXc/Oo/SZ:N+7izc28dqZ
TLSH
T10992E89BD6621150D0A3BEF7DBCB47DCE61F9074135A1F99A061BBBF9400705EB10BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_implant.apk

Path /data/data/com.yeag.fbnts/cache/temp_implant.apk
Size 4.3MB
SHA256 1a8c9dd929593938105d89162ac738d7dc69b0c384f84cfd86bb5bcafb85467a
MD5 9a84a0815a909f4fec131b645972bd84
SHA1 4404754c825851835f98fd05eb5e9131f218423e
SHA512 475bda8ed6e6eb5722f2234d4be651ab672530ca3df77eb83141b90d37ee45eb3d779639404a93b1e48a7e5982d9e8478cff044db576bbc50f0d3294b0e6d4e9
SSDEEP 98304:zwKTX+zM5qmMX/2h5mFfJWMCEjX2wVc6TI3BurPJBETFtw:0KTX9MqyfJWMJBVXTaAv7
TLSH
T17B263322CD778F64F5632A3D4A2C59F1B87009D64723F2F7A0A3711E75B49D22C6B286
MD5 SHA1 SHA512 SSDEEP TLSH