smsagent | 32140d662d1fea8485d34bcd42ed3f56c410c0a3160d6bdb36a517b1863da821

Analysis

max time kernel
1491852s
max time network
158s
platform
android_x64
resource
android-x64-arm64-20231211-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231211-enlocale:en-usos:android-11-x64system
submitted
11-12-2023 12:46

Target

32140d662d1fea8485d34bcd42ed3f56c410c0a3160d6bdb36a517b1863da821.apk
Size

6.4MB
MD5

79d560dcc8f5862b745478e10d311da6
SHA1

df4d9cd0baeb02beb8d910c4222b877d74e05c8e
SHA256

32140d662d1fea8485d34bcd42ed3f56c410c0a3160d6bdb36a517b1863da821
SHA512

3249532a249636b23cb4e232ac8118d18cd8ac8f0c4b0fd0ba4383216650d18ed04e4d6f0f10a5d14443d3698dd7ab45d6e81530b3a595b6d2027365940412c0
SSDEEP

196608:XiwTQLxeffSTHbdNTluzn21mZkJ5AYylzj8/s2Eh:XiwTQVQuVuz2EYAYgzjVh

Score

10^/10

Family

smsagent

https://cc17-172-233-49-172.ngrok-free.app

smsagent
SmsAgent is an Android malware that targets victim SMS messages using Telegram as its C2.
trojan infostealer spyware smsagent
Reads the content of SMS inbox messages. 1 IoCs
infostealer

Processes:

com.android.app

description ioc process

URI accessed for read content://sms/inbox com.android.app
Acquires the wake lock 1 IoCs

Processes:

com.android.app

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.android.app
Queries the unique device ID (IMEI, MEID, IMSI)

description	ioc	process
URI accessed for read	content://sms/inbox	com.android.app

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.android.app

com.android.app
1⤵
- Reads the content of SMS inbox messages.
- Acquires the wake lock
PID:4442