Overview

overview

10

Static

static

7

774c01fe72...80.apk

android_x86

10

774c01fe72...80.apk

android_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    774c01fe72c80800cb2acd33d36f4977d42c1ebf9d373bd63c217524b66e2f80

  • Size

    19.9MB

  • Sample

    220524-ver14sabe2

  • MD5

    5a4b594934bfb7adeae5806a976ec7c5

  • SHA1

    7148c4a08a6c4805dc2048d4d41ff00a6d134205

  • SHA256

    774c01fe72c80800cb2acd33d36f4977d42c1ebf9d373bd63c217524b66e2f80

  • SHA512

    b7048616eadd756805319989a99f42c6f9a422b859b122ad54e834a311eeea62af750b72ddde64ba4986088a392b3d5c4a661f1e972ceef0d58ab06715410792

Score
10/10
agent_smithadwareandroidevasionransomware

Malware Config

Targets

    • Target

      774c01fe72c80800cb2acd33d36f4977d42c1ebf9d373bd63c217524b66e2f80

    • Size

      19.9MB

    • MD5

      5a4b594934bfb7adeae5806a976ec7c5

    • SHA1

      7148c4a08a6c4805dc2048d4d41ff00a6d134205

    • SHA256

      774c01fe72c80800cb2acd33d36f4977d42c1ebf9d373bd63c217524b66e2f80

    • SHA512

      b7048616eadd756805319989a99f42c6f9a422b859b122ad54e834a311eeea62af750b72ddde64ba4986088a392b3d5c4a661f1e972ceef0d58ab06715410792

    Score
    10/10
    agent_smithadwareevasionransomware

    • Agent smith

      Agent smith is a modular adware that installs malicious ADs into legitimate applications.

      adwareagent_smith

    • Requests cell location

      Uses Android APIs to to get current cell information.

    • Checks Android system properties for emulator presence.

    • Checks known Qemu pipes.

      Checks for known pipes used by the Android emulator to communicate with the host.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Removes a system notification.

      evasion

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks