Overview

overview

10

Static

static

com.strong...om.apk

android_x86

10

com.strong...om.apk

android_x86_64

Analysis

  • max time kernel
    1986333s
  • max time network
    165s
  • platform
    android_x86
  • resource
    android-x86_arm
  • submitted
    06-02-2021 08:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    com.strong.control_center_229_apps.evozi.com.apk

  • Size

    12.0MB

  • MD5

    5051b92f73e919f011967d055bb83f0f

  • SHA1

    5b03c332d9a5ced8e53d03e63ec2a5ace6609fa1

  • SHA256

    bcafc08ad3b267c5f9c0547353d4d5b833db680d65cac38c87bf9ef05b6d71ab

  • SHA512

    1d7dfe7b1e85f45fed8b231667bfad55f2111c2bbb82c0cd5ab0cf42da8f0d294b11414460e872f9150ccc6e9be654e1b1c335dd4a7bc9f0f244053bc997baf4

Score
10/10
agent_smithadwareevasionobfuscationransomware

Malware Config

Extracted

AES_key

Signatures

  • Agent smith

    Agent smith is a modular adware that installs malicious ADs into legitimate applications.

    adwareagent_smith
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads name of network operator 2 IoCs

    Uses Android APIs to discover system information.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware
  • Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
    evasion
  • Suspicious use of android.app.ActivityManager.getRunningAppProcesses 20 IoCs
  • Suspicious use of android.app.ActivityManager.getRunningServices 1 IoCs
  • Suspicious use of android.telephony.TelephonyManager.getPhoneType 1 IoCs
  • Suspicious use of android.telephony.TelephonyManager.getSimOperatorName 1 IoCs
  • Uses reflection 66 IoCs
    obfuscation

Processes

  • com.strong.control_center
    1⤵
    • Loads dropped Dex/Jar
    • Reads name of network operator
    • Uses Crypto APIs (Might try to encrypt user data).
    • Listens for changes in the sensor environment (might be used to detect emulation).
    • Suspicious use of android.app.ActivityManager.getRunningAppProcesses
    • Suspicious use of android.app.ActivityManager.getRunningServices
    • Suspicious use of android.telephony.TelephonyManager.getPhoneType
    • Suspicious use of android.telephony.TelephonyManager.getSimOperatorName
    • Uses reflection
    PID:4755

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads