Overview

overview

10

Static

static

Edge light...9_.apk

android_x86

10

Edge light...9_.apk

android_x86_64

Analysis

  • max time kernel
    1986166s
  • max time network
    138s
  • platform
    android_x86
  • resource
    android-x86_arm
  • submitted
    06-02-2021 08:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Edge lighting For Galaxy S20 S10_v2.2.9_.apk

  • Size

    12.0MB

  • MD5

    26cce55e22354abbeff8bfd126b0e99b

  • SHA1

    546452f5a91ac2e1739af5d686439e440e68d57d

  • SHA256

    47e20cc73ae09500a27beda4295051bd5289d0d5b52b7db0e7fd34485ab4214c

  • SHA512

    c8b66d18b09cd25dc0f45cb23a8c2b1aeadb6854960f3616923dbb9059186cd93de19d13a14840a6ab3d4bd72a28ff2981b159c246b8cf9b38227678cd433ae4

Score
10/10
agent_smithadwareevasionobfuscationransomware

Malware Config

Extracted

AES_key

Signatures

  • Agent smith

    Agent smith is a modular adware that installs malicious ADs into legitimate applications.

    adwareagent_smith
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads name of network operator 2 IoCs

    Uses Android APIs to discover system information.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware
  • Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
    evasion
  • Suspicious use of android.app.ActivityManager.getRunningAppProcesses 20 IoCs
  • Suspicious use of android.app.ActivityManager.getRunningServices 1 IoCs
  • Suspicious use of android.telephony.TelephonyManager.getPhoneType 1 IoCs
  • Suspicious use of android.telephony.TelephonyManager.getSimOperatorName 1 IoCs
  • Uses reflection 66 IoCs
    obfuscation

Processes

  • com.strong.edgelighting10
    1⤵
    • Loads dropped Dex/Jar
    • Reads name of network operator
    • Uses Crypto APIs (Might try to encrypt user data).
    • Listens for changes in the sensor environment (might be used to detect emulation).
    • Suspicious use of android.app.ActivityManager.getRunningAppProcesses
    • Suspicious use of android.app.ActivityManager.getRunningServices
    • Suspicious use of android.telephony.TelephonyManager.getPhoneType
    • Suspicious use of android.telephony.TelephonyManager.getSimOperatorName
    • Uses reflection
    PID:4899

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads