smsworm | 1d9871425ec0e2701967381e9700acbb4f0cb2a3c5c3c60f25116ac9ba0524e3 | Triage

Sharing

General

Target

Tiktok-Pro .apk
Size

2.4MB
Sample

240413-t1ahhshh2y
MD5

5bf513f7fd5186eaa1be8fab370bd510
SHA1

ae0fe8d9b41b9941628f34a06bef62faf5741727
SHA256

1d9871425ec0e2701967381e9700acbb4f0cb2a3c5c3c60f25116ac9ba0524e3
SHA512

7e3c2ffa5377e4f2ed532298e0a15d683756a5b2f07a1c4a4fe6f89850dc0c9ecdd4ccd065623fe9bed573d86c75664e0b6db7cfbdf472ba4cc7a10f0c5f29c5
SSDEEP

49152:fg2An8lMaux6jVMCpctcRmLhkEdVMoAeMUKuG2n5rwMhwJ:TlG6j2m0eEdVMreiuGChwJ

Score

10^/10

smsworm android collection discovery evasion persistence

Malware Config

Targets

- Target
  
  Tiktok-Pro .apk
- Size
  
  2.4MB
- MD5
  
  5bf513f7fd5186eaa1be8fab370bd510
- SHA1
  
  ae0fe8d9b41b9941628f34a06bef62faf5741727
- SHA256
  
  1d9871425ec0e2701967381e9700acbb4f0cb2a3c5c3c60f25116ac9ba0524e3
- SHA512
  
  7e3c2ffa5377e4f2ed532298e0a15d683756a5b2f07a1c4a4fe6f89850dc0c9ecdd4ccd065623fe9bed573d86c75664e0b6db7cfbdf472ba4cc7a10f0c5f29c5
- SSDEEP
  
  49152:fg2An8lMaux6jVMCpctcRmLhkEdVMoAeMUKuG2n5rwMhwJ:TlG6j2m0eEdVMreiuGChwJ
Score

7^/10

collection discovery evasion persistence
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Reads the contacts stored on the device.
  collection
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Protected User Data

Contact List

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectiondiscoveryevasionpersistence

behavioral2

collectiondiscoveryevasionpersistence