Analysis

  • max time kernel
    3703954s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    01/01/2024, 05:40

General

  • Target
    3c084c39e9e61b1c9d13b073924019ca.apk
  • Size 5.0MB
  • Sample240101-gc3syacfbm
  • SHA256 e0ab4557fcead70a50cc7f879d4568174ceb20a4a86de86a30c5cfb0f6e5e637
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • SMSFactory

    SMSFactory is an Android SMS trojan malware first seen in Jun 2022.

  • Acquires the wake lock 2 IoCs
  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data) 2 IoCs

Processes

  • com.sgn.pandapop.gp.hack
    1⤵
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5064
  • com.sgn.pandapop.gp.hack:Metrica
    1⤵
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5146

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OneSignal.db

        • Path /data/data/com.sgn.pandapop.gp.hack/databases/OneSignal.db
        • Size 12KB
        • SHA256 885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 3493fe78162021553885486d61fda16f0d0e9b9077ec31fabd83e07381c50b02
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 8d16d0419c7e4b9424221cbecbd526994fe46afa352e98bfcb9bf222865b89eb
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 08eb6bba85eac9d58a7b93b2ec5cd6da0bbea09d8b076bde5085b1c193fef036
        • MD5 SHA1 SHA512 SSDEEP

        Mint-lastsavedfile

        • Path /data/data/com.sgn.pandapop.gp.hack/files/Mint-lastsavedfile
        • Size 34B
        • SHA256 2f5079cc2ebf4e17c4d69f17c1e4863a676f9dfe7f702659af8bf51e0e8df93f
        • MD5 SHA1 SHA512

        Mint-lastsavedfile

        • Path /data/data/com.sgn.pandapop.gp.hack/files/Mint-lastsavedfile
        • Size 12KB
        • SHA256 911fad89232d03b1b1473c39c258851849b6d383ad0edd86fb8858fb47f162d0
        • MD5 SHA1 SHA512 SSDEEP

        MintSavedData-1-1704510859808.json

        • Path /data/data/com.sgn.pandapop.gp.hack/files/MintSavedData-1-1704510859808.json
        • Size 666B
        • SHA256 9d50b537e57a0401881acb8ffd80d77448dd6a3b1705c3568dcb799acdebc5df
        • MD5 SHA1 SHA512

        MintSavedData-1-1704510859808.json

        • Path /data/data/com.sgn.pandapop.gp.hack/files/MintSavedData-1-1704510859808.json
        • Size 20KB
        • SHA256 ebc4cbd1024aba50875a9dca2f5b0e824b6a2f670721e62f67e107d32d1cfd9f
        • MD5 SHA1 SHA512 SSDEEP

        crashCounter

        • Path /data/data/com.sgn.pandapop.gp.hack/files/crashCounter
        • Size 12KB
        • SHA256 328f51fe991350c04a4ee2f86bbabc9357088b57d0887604eb80c358a8e93558
        • MD5 SHA1 SHA512 SSDEEP

        lastCrashID

        • Path /data/data/com.sgn.pandapop.gp.hack/files/lastCrashID
        • Size 12KB
        • SHA256 c08271d3e88cca1938ae1faf6040e865ad5fd7473a5c1efd698942b41b36fd1d
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 c9ab5be67b13dab92b609763ec07e441f5c30b3fcb173a67f5c2592b3dc840a4
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 6be9f231e3fce1cfaf8b018bdf0b4d72fbaa6511ce48767f41c4ee3f07221c8c
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/androidx.work.workdb-wal
        • Size 164KB
        • SHA256 efe7658f0544773b96e23d28f0a65f39ece49efe2d9a5302e26df523b9d09390
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/androidx.work.workdb-wal
        • Size 201KB
        • SHA256 9349a2dc98fae9baa8cae28f209016a140d3a6ec19bd2d395ee013cee2ff3639
        • MD5 SHA1 SHA512 SSDEEP

        com.google.InstanceId.properties

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/com.google.InstanceId.properties
        • Size 2KB
        • SHA256 08dba3c9697d154698ab4a4bda5d8845f0b3a031a117def3ae6a08205ef9dbbf
        • MD5 SHA1 SHA512

        credentials.dat

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/credentials.dat
        • Size 226B
        • SHA256 795b20b6d57f8e233b15a3826c41c6b442b7d240985ddd2530148d729981221a
        • MD5 SHA1 SHA512

        db_metrica_com.sgn.pandapop.gp.hack

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/db_metrica_com.sgn.pandapop.gp.hack
        • Size 16KB
        • SHA256 a57baf899f65f4ca6cbc75f68991df88c0c3ffb5c36768c5f268e71360490aa4
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.sgn.pandapop.gp.hack-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/db_metrica_com.sgn.pandapop.gp.hack-journal
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.sgn.pandapop.gp.hack-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/db_metrica_com.sgn.pandapop.gp.hack-journal
        • Size 8KB
        • SHA256 7a19469f6affeb28335d9f3f3a645cddb0695fe07a74f103cc53e8bbe2009d16
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.sgn.pandapop.gp.hack-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/db_metrica_com.sgn.pandapop.gp.hack-journal
        • Size 12KB
        • SHA256 cd4eeb4f6da8f08ada284eddb25b9a143fe490be895cd7ff1ffd3ab76314a714
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.sgn.pandapop.gp.hack-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/db_metrica_com.sgn.pandapop.gp.hack-journal
        • Size 12KB
        • SHA256 cdb5808f5e95ac1add08734d5f4e73a3d686add65ab99ef1824f387595d5791e
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.sgn.pandapop.gp.hack-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/db_metrica_com.sgn.pandapop.gp.hack-journal
        • Size 12KB
        • SHA256 635495359e3e3a5a63e41fdee4406fe9aeac3cdfc0b046f7b2274204549ad562
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.sgn.pandapop.gp.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/db_metrica_com.sgn.pandapop.gp.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 181KB
        • SHA256 00b90b172fe4caf9c90c2c73ad8c25ccedff24f31cb21ef3cde47f43f69b9ef9
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.sgn.pandapop.gp.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/db_metrica_com.sgn.pandapop.gp.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 8KB
        • SHA256 555e0079f611bcf83533ef5219bf2b50da7e2395db3001a9350985023c0f775a
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.sgn.pandapop.gp.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/db_metrica_com.sgn.pandapop.gp.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 e22af4616fe577e21cf5dfd0710287972813afb08d518f242785a0f9ba96e484
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.sgn.pandapop.gp.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/db_metrica_com.sgn.pandapop.gp.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 8KB
        • SHA256 8171d8afa123c265b1208e7d8c251698d15540a4c9abf46f6289d3dd797199cd
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.sgn.pandapop.gp.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/db_metrica_com.sgn.pandapop.gp.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 8KB
        • SHA256 043dfd0054fed504aa9db964812a8608c538e3ec60a2201ac5b3ef441d5778e9
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 bb326847edc2a488e989642238e3fbe3cf0f6a50a8dd75f20b3e91ba56824de8
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 90e229a321c30d910592158e6bcca1cb56d2835dc65378cab92e7a5c1bde452c
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 20bbd9c46866c044e4c3c12cc897d458e8c16cc945e35286107d6b04678420dc
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 12c2a464bc41644e6e9f68cfe7378693c2904e7b566b0aa1582d466e10cdb6b9
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 e749dc765b85667f5578129f8c8ab7fd522c40fff172d47da28e783cfe5ce645
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 e7679a4d19edf9e974eafdc36dadc4ba7eb655cdb0634d608d9ef00c4705a541
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 ed850955579f8360607a9ad5e4bb55abb8fff1a5d264bb2aa7453578b1b43525
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db-journal
        • Size 8KB
        • SHA256 5b2578523b62bba1e4cdba6396177e6d20a48fd87460580e1ed4b9751f83b3d2
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 6751e8f377db8243302b8581fcec46894376eb9b654d929fa403d2da4d0953eb
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db-journal
        • Size 512B
        • SHA256 a6b479b8c71834ee5a104b4a403378b7929fe5cbf78ca0adb771d08b8a1c5db4
        • MD5 SHA1 SHA512

        metrica_client_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db-journal
        • Size 4KB
        • SHA256 5a77f15d795d069c9996177c68d86bd65a50c1e24a18b916cb83039709faaf35
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 28cc09840d1495e8e307d730e9308ceaa453f3e41897cabfad89006830cab9fc
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db-journal
        • Size 8KB
        • SHA256 b0be3cf3ff72be45fe5c13fad8eb94dabfa37959f6347ba1e70180fd4b873ed3
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db-journal
        • Size 8KB
        • SHA256 f165df00a8eac0cafc2915a65220631829660f0fb76a57d000ef570230741713
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 de7bfe15511de5cefd82bd8dc84059951977c6601627b17f09ec628c564f56e3
        • MD5 SHA1 SHA512 SSDEEP

        metrica_data.db

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_data.db
        • Size 44KB
        • SHA256 a18c3fc27e4e7f0a9355386377626d41a6ad08a59836cb7d38d78a74f84d98f2
        • MD5 SHA1 SHA512 SSDEEP

        metrica_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_data.db-journal
        • Size 8KB
        • SHA256 52ab51d6e5821cafffbc8be81ff6259f440443ff5e7b17cb433e74587134db2e
        • MD5 SHA1 SHA512 SSDEEP

        metrica_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_data.db-journal
        • Size 20KB
        • SHA256 99d0e72934e8849dd99965753a230980e2312bbac2457e2863a1b03a9f7dd12b
        • MD5 SHA1 SHA512 SSDEEP

        metrica_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_data.db-journal
        • Size 12KB
        • SHA256 3e1fb348d96d5d74b50ce4f12334e0d55d6050619f734e27a6e640453aa37e60
        • MD5 SHA1 SHA512 SSDEEP

        metrica_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_data.db-journal
        • Size 20KB
        • SHA256 ee7c0e1be67217a5afbc9153450aca89e60426be4f4f3bd01e6b8cad2f713489
        • MD5 SHA1 SHA512 SSDEEP

        metrica_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_data.db-journal
        • Size 11KB
        • SHA256 e33b98dd2b6e945e9dfc8469566dfdd71d161ee3b6d9b69e0230d39a5887a59e
        • MD5 SHA1 SHA512 SSDEEP

        metrica_data.db-journal

        • Path /data/data/com.sgn.pandapop.gp.hack/no_backup/metrica_data.db-journal
        • Size 512B
        • SHA256 9dc372d4ba3e3a1a959453186735d939095d0f74705d036ff9104742912e2af2
        • MD5 SHA1 SHA512