smsfactory | 81d22a908f7989dbafa747a6cc3ce42a1068d5bed9f34cc69fa86672b4d57e19

Analysis

max time kernel
149s
max time network
161s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
20/04/2024, 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc0f20db5f8098e42d845492fcf3fca4_JaffaCakes118.apk
Size

4.9MB
MD5

fc0f20db5f8098e42d845492fcf3fca4
SHA1

380e9f9d17c1f13e66d367f4f8726200e2dee07c
SHA256

81d22a908f7989dbafa747a6cc3ce42a1068d5bed9f34cc69fa86672b4d57e19
SHA512

d4fee4bd9bdaa012b57346c407a5e46eeb8908727686bd7022faf704a3baba81b6b6380b260e2f672fd8967b39a4d6f2008b6bf5e629efd163f01a30663d14a1
SSDEEP

98304:UxQ993O4ZwUzMnKTI5qkVe6/7Tr/njx/3lIM1bfzyck/IISqf+HW6sR:KQ993zwU6+I5DE07TrPV/3lImKj7g26y

Score

10^/10

smsfactory discovery evasion impact infostealer trojan

Malware Config

Signatures

SMSFactory
SMSFactory is an Android SMS trojan malware first seen in Jun 2022.
trojan infostealer smsfactory

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.kongregate.mobile.bitheroes.google.hack

Acquires the wake lock 2 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kongregate.mobile.bitheroes.google.hack:Metrica
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kongregate.mobile.bitheroes.google.hack

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.kongregate.mobile.bitheroes.google.hack
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.kongregate.mobile.bitheroes.google.hack:Metrica

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.kongregate.mobile.bitheroes.google.hack:Metrica
Framework API call	javax.crypto.Cipher.doFinal	com.kongregate.mobile.bitheroes.google.hack

com.kongregate.mobile.bitheroes.google.hack
1⤵
- Checks memory information
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4598

com.kongregate.mobile.bitheroes.google.hack:Metrica
1⤵
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4644

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact