9bf89b33609973d48c7d09d5774c39bfcefd3922202db0d872f12b3ffdb28529

Analysis

max time kernel
150s
max time network
161s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
10-04-2024 12:56

Target

9bf89b33609973d48c7d09d5774c39bfcefd3922202db0d872f12b3ffdb28529.apk
Size

1.7MB
MD5

69d3ce972e66635b238dc17e632474ec
SHA1

8f1a2907c27b7a736817bfdb54d662a7770ad328
SHA256

9bf89b33609973d48c7d09d5774c39bfcefd3922202db0d872f12b3ffdb28529
SHA512

e86459dbd262807f260c389566335723cf53a94ed06ca68890fb0ef63d4164eef8aa84181dc31fdd8922b681a9360e506bef5dfce8cab5c0ba66c0208c8cbac6
SSDEEP

49152:uJXz0WuZnKSGZ9DtaT0L3VvbciZCfr9BsNUCngFfE:YXAbNKVZ9DT7VvoiQr9WzQfE

Score

7^/10

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

Foreground Persistence

Processes:

com.newsm.secursm2

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.newsm.secursm2

com.newsm.secursm2
1⤵
- Makes use of the framework's foreground persistence service
PID:4459

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

/data/user/0/com.newsm.secursm2/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/user/0/com.newsm.secursm2/files/db.db

Filesize
28KB

MD5
ab6446f174e940245fd0164d5db956f2

SHA1
38cf7231bb9fbddf15e121fa6029bac43e919767

SHA256
61c9a65322262a48b78ccda80b46e58a21f297806d937413d76c1d24bc318658

SHA512
cb18437ed00c21dda71331e21ebfbf453e85f988a2ae9a6c63369acc27e8ff0473e558e9cfb3bcb09ce7d0a58679e643ac63b3220d11eb717317a5e6499dea88

Download Submit
/data/user/0/com.newsm.secursm2/files/db2.db

Filesize
8KB

MD5
892fc89a414bf19397f74885b2c4b55c

SHA1
c91f904e6b44c1269c8042e1516bff541579163c

SHA256
ac042632d715d92b86cacd6a357bb2d1a2582d635b4984896bbd1e1353ca20e0

SHA512
bedd2d9cd5ee251d21e7bbab0ed5c8539a79ed2ecb192b19307ddf096bbd06b58dc64bb19972261da261099dce53f1bbe3ba6f5177c3303915c888312411b6c7

Download Submit