smsfactory | a992acfef6275e996d60b4dd286379aee70d7d97f13ddd0575493dc2233559eb

Analysis

max time kernel
150s
max time network
160s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
14/03/2024, 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7c251982c619646f0751af43a8affb4.apk
Size

4.9MB
MD5

c7c251982c619646f0751af43a8affb4
SHA1

215af2aba7ae9caad4c15d6297ea043f6cf2bec8
SHA256

a992acfef6275e996d60b4dd286379aee70d7d97f13ddd0575493dc2233559eb
SHA512

cf93f0298907ef9fb1bcb7fddb2361148b39add2276bcee1e34ff3aa853a3abe2213249e62abcc6f6a534b98defefe8571ea7e637a7cc3197555ef967292eb8a
SSDEEP

98304:qHh/xyO9YqJcgJNeZmuVHcide2V0d6N8temewyr4rwSqfHfNT4c4:QhZySYqJcWJuB21Ryc0x54c4

Score

10^/10

smsfactory discovery infostealer trojan

Malware Config

Signatures

SMSFactory
SMSFactory is an Android SMS trojan malware first seen in Jun 2022.
trojan infostealer smsfactory

Acquires the wake lock 2 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.enflick.android.TextNow.hack:Metrica
Framework service call	android.os.IPowerManager.acquireWakeLock	com.enflick.android.TextNow.hack

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 2 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.enflick.android.TextNow.hack
Framework API call	javax.crypto.Cipher.doFinal	com.enflick.android.TextNow.hack:Metrica

com.enflick.android.TextNow.hack
1⤵
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4466

com.enflick.android.TextNow.hack:Metrica
1⤵
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4502

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.enflick.android.TextNow.hack/databases/OneSignal.db-journal

Filesize
512B

MD5
19d86b514a897255e7908c0c43dd762a

SHA1
d89cfc48907ec7312359c08efc18ae67ed647d9b

SHA256
dc44bc4021e30499e888fff46abdc2924d2dcd3094093882605f531712f62143

SHA512
0fdc6cd7394f891ad5401948ef0d9112abac615396ff463d2ae622eed0cbabd22dfbe12b4a7a26d55c5d2d0521ae264ab9f878b622bab12958f0bd6234254181

Download Submit
/data/data/com.enflick.android.TextNow.hack/databases/OneSignal.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.enflick.android.TextNow.hack/databases/OneSignal.db-wal

Filesize
64KB

MD5
07f2c7eb6d64f2606798082e84d88fdb

SHA1
f49f8a07fb71164b26bf5c2b394540a68fae9d02

SHA256
1f00434d5abeeba4ff8b35be600e466dd6c0114a8d85f806ac00edbbff3c6ace

SHA512
97fd6957adac9f139e51bfa1dda64b5ba1feff9eb3e921f1671c3f3a803a11495bef6faddb64e1c6a5bfe563f0c44cc9326b68797858b6871918703bf22bce88

Download Submit
/data/data/com.enflick.android.TextNow.hack/files/Mint-lastsavedfile

Filesize
34B

MD5
286e95f06f90476046dec1afae466da8

SHA1
53483c27e6f409889acebf9c7c05fb7d0cf058c3

SHA256
93764247c64d6d4c8f9c0b9c6214d522cb38bdc54b8d336e659c2ab30d75641d

SHA512
a0f55c7d2fc92d87892dc200712ac870c60ccd8a895efc1fb35cf17a2c9b910473963a307cb3497da83cba77be68976895350d91e25b8ac89aecd0f7aa902a0f

Download Submit
/data/data/com.enflick.android.TextNow.hack/files/MintSavedData-1-1710392698285.json

Filesize
674B

MD5
3d33b82b10904c5398f7f77b47dfa75b

SHA1
e17d3dbf24928a24a694e93e742565412160fe19

SHA256
4f5ce3685a71426b4c8cf05fcde068261ca0c2f19086553169e0a300c766f676

SHA512
4e8b7eec95a637fe1cc7068c91d7f5587a56a7bf2647baa4958edd77a2a7c95d6b24acb3703928f4bd022e05f38fa8f5bb4616a458f764a65e41facc3684429a

Download Submit
/data/data/com.enflick.android.TextNow.hack/files/credentials.dat

Filesize
227B

MD5
0a80db732c044eac3d91aa1f72c21b7f

SHA1
cd8326887796d994470b60577a4320246a77516b

SHA256
efcb8f04fd7996c346a11bbec0cc5dbe31fb39117623f22e6c26752ce2fafcc0

SHA512
224c6e4a160a33f68229f1b4194ed96ca2a6e02d732c6ac515be56764e3241b46c730250d321c6844d8bd7a7e9f7e7511d9ee7c2c50e4d0028e007b71f566cc7

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/androidx.work.workdb

Filesize
4KB

MD5
d010da4f0f6393cb8c7383920588419a

SHA1
c87ad9516a552ea560f23118de89e0067466a84b

SHA256
6b255423f52faa65352e6cf042c336fc447cbee9d39b47defa884a833b54b15c

SHA512
f1641256a83e0df42af7a9f20a6e7c77f2aa788973696f035da7a30394b88f25f7cf50a467ca1cfc63861ce2ed64ba88634617844c4bfc47c3b79ff5bdc1ee63

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/androidx.work.workdb-journal

Filesize
16KB

MD5
8a403761ae27d714dfe7cb410a356d8c

SHA1
6bd9a7504cdf1262389c797647f59f0f577eb1d1

SHA256
b84a8b42b4eedd2133bf135280fa94a69bbcce8179cdca3bee47c43ee11cd535

SHA512
ec23aea16958d30f190ac46b6a3964b975d86ea7bc73f20370596fda2cf65f8714d5492740c0550f15e002a14c0e5781e3952ac024f7966f2fdf0ce04c77e2d1

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
0c8fd41f175207e347a80228684d95f2

SHA1
e6547c1ef65fe776fc9d29706d230e1db320d390

SHA256
2249fcfde002c78b61800763e338834e436fedc07a3e23a8ff2d081ca2659187

SHA512
36e733183aefe392babd069b8b70e4c446bf9d7856a2a9f69dfae24c1d9f6d4449e54fbf64bdd2742c771884d30da20a5f7de5901b983c0ae7a28b94caea091f

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
86c7bbab9fff5110bb2d2b07521d7b9a

SHA1
40ca07f6fb1045f4abb1b27db2513a91b8554576

SHA256
aa520c2bd791b4751d1a110378f2dc850adc3bfce57d69b949748cecc7144c3b

SHA512
cf0169f8056c40aad9b22f7f5810ceb834685c5caa5df9a3d000c69ddc7b72f7d98c90a86911e258eb0ba84581403adf1ce97f9e8c820f940a820c432ab59752

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/androidx.work.workdb-wal

Filesize
164KB

MD5
73f474a0d6b45af9232ea703a04726f7

SHA1
65a736cb406c43bf8231afa8e6759e4d0631521d

SHA256
c4540ce3f1ae1cbd75ad73ee49972ee98d9b6f6954298547db19cc2f7d613a91

SHA512
e9defcce3e9d6ab0324ca047abe2f331e82b024d08eec72eaf6bd6da55ed9b572d5d45f87803360d840a317e0133c728161e3824a0f2dfd7645f228784601366

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/com.google.InstanceId.properties

Filesize
2KB

MD5
da267ed53af2816f78ffdbb70e8c57ed

SHA1
1127aae1d114204babe9543eb3cd001139754617

SHA256
ee038a0b795094efc5722b22bb75e4b83a8c75a59b83d96d729abadcfc96db26

SHA512
4f9264288803d07c879a7be3379851def55d347feaa873be853ae8d286250357ab2f3487bd0c4984efd408be1c165672591e9e94d8ff45bb1665be8c04253570

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/db_metrica_com.enflick.android.TextNow.hack-journal

Filesize
674B

MD5
1b64c4860277abc0a47c18c590a758a3

SHA1
58a8589174d97d5f79cae103d5194376ee971363

SHA256
39299ed25ad7283127459352eaae2e67ba0776b69b1b91b3d14b5379541ea9a0

SHA512
d09492ccefc22bacd6d1acc29fabbab3d922a2f02d8b4547c9281573fc80399da65991cc0ff49ce3152bbb421892c850e6f6ea6f286e37c44daf743963ab4d13

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/db_metrica_com.enflick.android.TextNow.hack-shm

Filesize
28KB

MD5
8b0d07a80e5f44a8450903728275ec90

SHA1
8e957cfbeb001b424515c6a996dfcd0444445610

SHA256
8acf5728476047b7d0019e67fec0ccd452cd251e6b58531840ef71d2cfa9dcb1

SHA512
0a0d62c092fb68020406ba5ab2a7578771b9a892a69ede1e40157066421adcf9767383bcf79b145f3bc3afd5261db4e81a279ffaf4abd9a67926fab77de091a1

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/db_metrica_com.enflick.android.TextNow.hack-wal

Filesize
16KB

MD5
21d28886be3e151637bc317b492932bf

SHA1
9bf63585bacca407614209026ae1c704c4d6730f

SHA256
9769bc25e72cf9e3a34f5e71d28aa41c0d2d69043ee37c20d00623f4ad6cf998

SHA512
ac5777c2b4f45a322312d728c767a4173bb3c34de1a7682652cd719e30e45aa7cfb393ef57326b2e3e4d85fb5dd55e29b6e7ff7c42881d806c31971bec6bfce9

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/db_metrica_com.enflick.android.TextNow.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

Filesize
512B

MD5
a5c22bb94d77c5544873f4fc091239e7

SHA1
786814eafed44b532646ab657419370c29c5b28f

SHA256
48d17f1256617dbadf5d9cffff1be8a261fb8e3e65dab75eb1ca653e193aeae9

SHA512
9701c59345c6e6c19961b38d3c3630aca4360dbec61433a2428fb4d8d3a9c72d985c6a6c43e3e4cb3276f9bc40edd2c85f3515281ba88c3d0e46a29d78c276a0

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/db_metrica_com.enflick.android.TextNow.hack_20799a27-fa80-4b36-b2db-0f8141f24180-wal

Filesize
48KB

MD5
06a0a980d11ca2c937dd2e84b4122b95

SHA1
67e70434e1d386a85adaa7fae4144b4b96048f2f

SHA256
3f034e7c6a6cb2353d1ab041077a7dd289f3362cfad839ec218b658c22e40030

SHA512
909629e001fa836d96f9afdc7fa69e8107dfaf96e9457703f9f715eaad60ba1ec74a7dab9ee8ab11eeb999f6f2c8e325b8290a5830dfa075517806a00048a26f

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db

Filesize
20KB

MD5
adb7b33eac8f43c27d36c8d9a939a3b6

SHA1
73ff5abeffbb10c20260081292432bfdfe608dbf

SHA256
62137d440010fde40907dba3bd095a5ae4a731369963e4acb5891ad826da3ee8

SHA512
e878b502cadf41df3a5c106a79a94d4d1d1a8d044abf3ac425a5142ca3eb5ad7f306ae25c32fc87443c0723a7e114d2930e3d3ae62f89c5972dd9d7984b20149

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db

Filesize
32KB

MD5
edcd08bd34d32c1f966a43f1b39c2dc5

SHA1
85899397e50c48865a6ffc00dcbc415e8e530553

SHA256
d4d032544ec5d81d81b36e59376243274fd2443efff654d2a546470fe475785d

SHA512
ab6b89fb8a41f1650d5875bb6506bbddd38bd0d2c84c165b198a6f38fd8a31b51dc952edbd49d5e643fd5f6bdb36967527aa894d9968d8be4dcae638a64e84b8

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db

Filesize
20KB

MD5
8a08ecd1e40dbd105e8c2d342104fb96

SHA1
4f4ccae30ff60418b098a5736666e20e09a2c67c

SHA256
7582cc18611f6c4331363d36ddc210a33f975c55b104d463ba997d22f50540c8

SHA512
061a8c08ec39388687103374de1fecf86a742e377dab7c191b831efd868218ca23d50eb8d4550545b6f336a99d071990ec35e31949cf6fab719628246ec3bb7e

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db

Filesize
20KB

MD5
5ae1dae9eb36649faeb07a94ca96e7f8

SHA1
9056cb35b999726d6576ef6ced55ca9228cb97c3

SHA256
62eafa0fe191047857cbfdbd6909930487f2216d260b4be27fd52e3cff6086d3

SHA512
e33d2cec8122673da3c8ffc788bf2984eac878f7dada265485d960a886ebfb00e17b12a30b546c959bc04c62a31d5646fda748df693e0bdafbb974abbbe77c1a

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db

Filesize
20KB

MD5
15569b33ac3a023ebf389e9ad8ac3667

SHA1
c560d97ee1b27ff094002bc1a2936cdd5995f65f

SHA256
6e069f6edeafff612c47953366fcec8fb0d3e4115872e3e267aea364d0f58da0

SHA512
f3b4fb99d323a6e22e31def261a7a3c65cfd897a02129560241dec5d0324d95ffd26b288bf729a6d8d4cb94cb4133794152cb8470742b639a63e3e400dbef55c

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db-journal

Filesize
512B

MD5
26379be9bbeecd294d48564a29270704

SHA1
33247008f3aca2e7db6db00d44242712c004466e

SHA256
fe37ac853456f22ab9d162250a36a8486860e34a22ffae863d46cfcb75e210e1

SHA512
3d70c023e03cde6a31fbd806f1cf0d08517c6b813e79b25e3b9f677fde3eed6dedbf4138eee11ff50e3371311b75786feb234a11cc8311dbb5bed7bbba47589d

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db-shm

Filesize
32KB

MD5
acb32515a7c9095313e7c30c3f99a360

SHA1
0623c120500fbdab522cbf455476e9fb243e65ce

SHA256
532e6d6c8ccaf793e5555be152cb27a781b26ae55bb204fb06359d16dd3f603a

SHA512
27ab1c41e387ed3b594099aa68d152e61f9be863fc6c0b929d2987ccad50560c8d66adb78de8a3374ca0f7040365c6669e43e78975b5a8bca857c0a25f42540c

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db-wal

Filesize
8KB

MD5
a15b6f687af683f3dec2df6bff9bc994

SHA1
8fa39fed75591d3545ab92927055025afc1fe30e

SHA256
4e009b3774c8748cbaf6c22b8f3140de03ab086ac1702ad0b2bd52bf5660ed64

SHA512
035d65c9429fd22573e1c251d55f5d46def8d71a9315e7169281d7d5f4b069dacaeb6d9bdca5f69c9aa6a8c0f2dddd6c884b8223646154d08c7aa7d108c141cc

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db-wal

Filesize
201KB

MD5
6f26cbb5376a90aaa7ff91f89ab05681

SHA1
87760cfa602d287227d17290902e2c944ed417e7

SHA256
776961e6c99c1bef7b4c7896555858103a29f81efa0c8ed7e3e1970f76570be0

SHA512
357d0fee982903761c851e6e7dc8233b5b47efc4be40e82d5773709a011a846adce4ea9bca01e4b218da97c0b52c450ae1ace0694bcb9867d20c1b9049a32896

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db-wal

Filesize
8KB

MD5
d4fe3caf8b32b07d216e5281ccd6dba9

SHA1
3312f798245347d636a40442c7cf1069c34d8108

SHA256
91f9776eb9102ee337cb3db67c951754041b28809bba37619973ac5081b35f49

SHA512
0551704697bf678e4c797cb75cc53206aa6b69ec8eba8b03679e14d6728a54ff525b7af3c30674fab76fe93da14d3b0b923866a97b279952237d9a94e316d3f3

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db-wal

Filesize
32KB

MD5
bd1c95a4f3c8869362ac4a77ae85a895

SHA1
a4b94f8f854a6754dd4017d5116ac646c36ddedd

SHA256
b9f74f088d4b4ffe63013503a5d572f317ffbf359932c5c26a261dc1f35aed4c

SHA512
f74df83b3f2a6b13466c9481554e84b1011aa3d6733ec79cad283caaf9ba831ec8ce8202d1104afdf33e67798c3cb62d538d002a4a74a55a34fcf00d22ece54b

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db-wal

Filesize
8KB

MD5
1293abd90382a7957aa1ba9a1058dc27

SHA1
57ffc2254df2859bfbba46d258bc669d5ac614f2

SHA256
be17d8d671f828ce3479a44690b5099909bb8df892846bd8ef3c842561d9a2ab

SHA512
a2b6acf5c83d9709f1835a4a008e3527a0893f9e2a822de95cca124f94b3e0e4b1db45ecaefcfe679d9edadfae398912d56d0be4dfbc2c716a618d842881baeb

Download Submit
/data/data/com.enflick.android.TextNow.hack/no_backup/metrica_client_data.db-wal

Filesize
20KB

MD5
35a1ed68e4212d5985a6ac3f86721861

SHA1
0f1afc4e8214e47066884a8ee0ffa15df5f71745

SHA256
4c68f86c8c7c1b66a690f1755f46031ddc84fd87ab438c9fc4750d6867f74e0a

SHA512
9d6b7ea10b4899774343a1811abfc88d8705fabc815055b4672a4d68c9b6ad5a8c6ac07a3626a2a2dbd2d6f563f17cef6af3635a34427acd3a83133541c2678c

Download Submit