Analysis Overview
SHA256
6e0d01c4c547d235c247a6d0719f2aca2d4996ae78df4b671275914a9e3fd2d3
Threat Level: Known bad
The file MarMuzik.mp3indir.apk was found to be: Known bad.
Malicious Activity Summary
Godfather family
Requests dangerous framework permissions
Acquires the wake lock.
Requests enabling of the accessibility settings.
Uses Crypto APIs (Might try to encrypt user data).
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2023-05-16 11:07
Signatures
Godfather family
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-05-16 11:07
Reported
2023-05-16 11:09
Platform
android-x86-arm-20220823-en
Max time kernel
608199s
Max time network
130s
Command Line
Signatures
Acquires the wake lock.
| Description | Indicator | Process | Target |
| Framework service call | android.os.IPowerManager.acquireWakeLock | N/A | N/A |
Requests enabling of the accessibility settings.
| Description | Indicator | Process | Target |
| Intent action | android.settings.ACCESSIBILITY_SETTINGS | N/A | N/A |
Uses Crypto APIs (Might try to encrypt user data).
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Processes
com.simplemobiletools.smsmessenger
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| US | 1.1.1.1:53 | infinitedata-pa.googleapis.com | udp |
| NL | 172.217.168.202:443 | infinitedata-pa.googleapis.com | tcp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| NL | 142.250.179.174:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:853 | tcp | |
| US | 1.1.1.1:853 | tcp |
Files
Analysis: behavioral2
Detonation Overview
Submitted
2023-05-16 11:07
Reported
2023-05-16 11:10
Platform
android-x64-20220823-en
Max time kernel
608217s
Max time network
146s
Command Line
Signatures
Uses Crypto APIs (Might try to encrypt user data).
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Processes
com.simplemobiletools.smsmessenger
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| NL | 142.251.39.104:443 | ssl.google-analytics.com | tcp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |