ec003b86c78095fd540267a1c682ac4258d943f0fd5c5557c97e6af6f395a032

Analysis

user interaction
yes
max time kernel
14s
max time network
48s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
30/10/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cihiro Cheat.apk
Size 4.5MB
Sample261030-ty5wmsfa29
SHA256 ec003b86c78095fd540267a1c682ac4258d943f0fd5c5557c97e6af6f395a032
MD5 9b81728522a9bba9618ebb38eadd0d17
SHA1 15d937da90245ada15466cc843c6dcd069c4d1c5
SHA512 7308d9b2642cc0f574db8d422c7e8f5e69090cc630a598d16bc8d9724ed525335d4f0c0d2ba5194ddac7a0231c0d692c181ee77c807fd57c81a0995404374fea
SSDEEP 98304:XjmwKTX+zM5qmMX/2h5mFfJWMCEjX2wVc6TI3BurPJBETFtt:xKTX9MqyfJWMJBVXTaAvy
TLSH
T1F1263332CA3B8E55F9533A3E167C18E1F87049D20773F2F76063601E79A99D22B27589
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

impact

Malware Config

Signatures

Attempts to obfuscate APK file format 1 TTPs
Applies obfuscation techniques to the APK format in order to hinder analysis

Obfuscated Files or Information
T1406

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read SMS messages.	android.permission.READ_SMS

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yeag.fbnts

com.yeag.fbnts
1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:3224

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1406

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

base.3224.tmp

Path /data/data/com.yeag.fbnts/cache/oat_primary/x86_64/base.3224.tmp
Size 16KB
SHA256 df8aded771f8483303c37fefddaff00a2c0a52df1a6e2b2dab5170b06eb08f7d
MD5 9b6b35dfae638f6fe1af024504e20ad7
SHA1 762e7d9ffab9253ac9fddd41703027dd929b1155
SHA512 8aab03633b88cec4800757dc813fdfa68afe417184306e595b7172713627dab94c9d60acdd65f85c63dded7fffea6bc9ec9ac29bcea34df4894861d2e1a56aaf
SSDEEP 192:ntSrr+sCCrX7uUulZICxwP+ptcQvGOD4zgcG:tS2sCC2UuleCvpWSlRc
TLSH
T18972452FA35510D1C0E779FDC6DA0A95CA7601B026AB3F09987A933FBD20758CF61798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_implant.apk

Path /data/data/com.yeag.fbnts/cache/temp_implant.apk
Size 4.3MB
SHA256 1a8c9dd929593938105d89162ac738d7dc69b0c384f84cfd86bb5bcafb85467a
MD5 9a84a0815a909f4fec131b645972bd84
SHA1 4404754c825851835f98fd05eb5e9131f218423e
SHA512 475bda8ed6e6eb5722f2234d4be651ab672530ca3df77eb83141b90d37ee45eb3d779639404a93b1e48a7e5982d9e8478cff044db576bbc50f0d3294b0e6d4e9
SSDEEP 98304:zwKTX+zM5qmMX/2h5mFfJWMCEjX2wVc6TI3BurPJBETFtw:0KTX9MqyfJWMJBVXTaAv7
TLSH
T17B263322CD778F64F5632A3D4A2C59F1B87009D64723F2F7A0A3711E75B49D22C6B286
MD5 SHA1 SHA512 SSDEEP TLSH