8ac584c5aa19078d11530bb020b90c5e252c47481fceaf33a5cee06edc707466

Analysis

max time kernel
11s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
30/10/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FF_VIP_Mod_Menu.apk
Size 28KB
Sample261030-vr78vsfa68
SHA256 8ac584c5aa19078d11530bb020b90c5e252c47481fceaf33a5cee06edc707466
MD5 dcfd8a3113546fd553dd354c8a03cd47
SHA1 9b0330b21fb4ac172352f7707381750fbd01c272
SHA512 bb582bc6b2a2af1def1a36e16504850403cad81f432163c63842d2b0ed6f06fd6c3dbfdec1099c038a077b45f67f761b392a077d7b5187a56f7c7aa7ea237edd
SSDEEP 768:z5W8Rzwh2FRnPDFYonYwgTjICB0gXiOOFy:NZNwC9DxnYwejrB0winy
TLSH
T1C5D2CF7BEBC46C17DD5AB0B5386157E3DC54E3DC53B8331A004C8111EA1B3EAAB646A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection defense_evasion discovery persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	com.ff.vipmod

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/data/phones	com.ff.vipmod

Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://media/external/images/media	com.ff.vipmod

Reads the content of the call log. 1 TTPs 1 IoCs

collection

Call Log

T1636.002

description	ioc	Process
URI accessed for read	content://call_log/calls	com.ff.vipmod

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ff.vipmod

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
9	api.ipify.org
8	api.ipify.org

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.ff.vipmod

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ff.vipmod

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.ff.vipmod
1⤵
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Reads the content of the call log.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
PID:5084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Protected User Data

T1636

Call Log

T1636.002

Contact List

T1636.003

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apps.json

Path /data/data/com.ff.vipmod/cache/ratman_1793380481666/apps-instaladas/apps.json
Size 18KB
SHA256 53df1fa82a3f030d9ab104e3c51c549803377683f25cccc9847ad52d14889a06
MD5 e2ae7516f290f87e1ef5f109a3a3260d
SHA1 8bd4d9d11572bdfa73152a1fb00a9a30d6db6a67
SHA512 d05ac4e949068629813037ec750c53930406f29afca35ac2d286dc83833b31868d364f4438dc3db51e04b636ff01dd069fa5cd1e24bf15d917161766ad28c497
SSDEEP 96:1NIE9htSHHLI/5UnLsdwT50V07iEfNAD5mMHlQkKGXPyxaiWYD0yfwh9X8ZU1hgY:1KAmrW5/wd0V2ANIGYs2fA
TLSH
T14F9231B6CB700E231DEC4861202E1943387465D31A693DE673CE1CAD7F9DD0A5672EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

device-info.json

Path /data/data/com.ff.vipmod/cache/ratman_1793380481666/dispositivo/device-info.json
Size 489B
SHA256 99ab11e47a5c4522da0b9437171492a07b77c61bc41ed0ea2be58aba90ee5423
MD5 990fdaeb5480807e845620ec60f933c4
SHA1 1befd5ec06c008cc4f0e449f5c07c9577a804746
SHA512 807ebfb4bb5a55c3c20f7ba33508738a9ba85a988d4296c70cc45faa67b0496783497bd87fa5831c0a3d16931e2624d0dc6654b4349eb25fec50a89a34db015a
TLSH
T1DAF02718F214206301C887A57CA30BA3A981DF17519572B513E79989144EA7BB6B4C7D
MD5 SHA1 SHA512 TLSH

Submit Download

camera-error.txt

Path /data/data/com.ff.vipmod/cache/ratman_1793380481666/fotos/camera-error.txt
Size 87B
SHA256 60dc6c8c0bedae9d185bc9ba9652b1fcd0ff6bbe3da4d1eb95c44b9bf2c374ac
MD5 f99169e1c76e5903aa7ef03ce9424458
SHA1 05a93a57a9dfe0ec7d8a3304c21201018f346580
SHA512 39354006cd76a4a396cc3124a1d50562d1d34282ec7c55e1530c26fa48a8726f0a36b9c6fb6e778df212f1fd8ae5aebc3127c7aa0e14fd97a435a1bbba9e6d20
TLSH
T149B0120F902802D3EB82449802F44138103316A438013691C649325E1054810C1621C2
MD5 SHA1 SHA512 TLSH

Submit Download

browsers-present.json

Path /data/data/com.ff.vipmod/cache/ratman_1793380481666/historial/browsers-present.json
Size 26B
SHA256 f797e286e1794bcee4498d92319574485a8f19c86f5c4c9c576ac241125553f2
MD5 baa6d981e92430791548808c9cdf84ab
SHA1 1334b06f555e28b4023abe81e1e8b88409d0a221
SHA512 821a0d026923de256985cb6820589b53503b37fe8c67166886f7f923738b2d1f57e481bc35860b2da39a9f197044766e75c305d69070373c7b211bfcd3760d98
MD5 SHA1 SHA512

Submit Download

sms.json

Path /data/data/com.ff.vipmod/cache/ratman_1793380481666/sms/sms.json
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ratman_20261030_171442.zip

Path /data/data/com.ff.vipmod/cache/ratman_20261030_171442.zip
Size 4KB
SHA256 537ed9996fd6fe4e9e3dc77acd96d33917458db71815812aca0880d0a04876b7
MD5 bf8127bab81d96f13dd4f6b9190468a0
SHA1 cc829ca68c56caaa67b6841d64a8697db4f8b03d
SHA512 dd536bf96053355c5841eac0af434665c8fe22b84a5d39cf8a29b77e3ed3e1c9314f69842ad71bca180a88c1cb5ac909ac92b41ad59ca9c4dad8847fbec036a8
SSDEEP 96:66e3z9Lurzr5XyiIjxa1lXQaHtY8/o+4sCgMXsKmxPt6CFVm/l:699SN9IsLXtHT/Oi+sKktxFV+
TLSH
T105A1FA384F5CB83FD617267C71D180499AAD5A0E0146C49F777C36EB9D639942A4ECC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads