Malware Analysis Report

2024-10-19 12:06

Sample ID 240521-f9e8gadd4y
Target com.apk
SHA256 a2f0430bebf1a55da1d7aab31021a90b49290df5bead76ee49f27ee37bd1e03a
Tags
wyrmspy collection discovery evasion infostealer persistence rat stealth trojan credential_access
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a2f0430bebf1a55da1d7aab31021a90b49290df5bead76ee49f27ee37bd1e03a

Threat Level: Known bad

The file com.apk was found to be: Known bad.

Malicious Activity Summary

wyrmspy collection discovery evasion infostealer persistence rat stealth trojan credential_access

Wyrmspy family

WyrmSpy payload

WyrmSpy

Removes its main activity from the application launcher

Makes use of the framework's Accessibility service

Reads the contacts stored on the device.

Registers a broadcast receiver at runtime (usually for listening for system events)

Makes use of the framework's foreground persistence service

Reads the content of the call log.

Queries information about the current Wi-Fi connection

Queries the phone number (MSISDN for GSM devices)

Checks if the internet connection is available

Requests dangerous framework permissions

Declares services with permission to bind to the system

Reads information about phone network operator.

Declares broadcast receivers with permission to handle system events

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-21 05:34

Signatures

WyrmSpy payload

Description Indicator Process Target
N/A N/A N/A N/A

Wyrmspy family

wyrmspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to write and read the user's call log data. android.permission.WRITE_CALL_LOG N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Allows an application to write the user's calendar data. android.permission.WRITE_CALENDAR N/A N/A
Allows an application to collect component usage statistics. android.permission.PACKAGE_USAGE_STATS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-21 05:34

Reported

2024-05-21 06:05

Platform

android-x86-arm-20240514-en

Max time kernel

176s

Max time network

185s

Command Line

com.android.core.service.hms

Signatures

WyrmSpy

trojan infostealer rat wyrmspy

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the contacts stored on the device.

collection
Description Indicator Process Target
URI accessed for read content://com.android.contacts/contacts N/A N/A

Reads the content of the call log.

collection
Description Indicator Process Target
URI accessed for read content://call_log/calls N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Reads information about phone network operator.

discovery

Processes

com.android.core.service.hms

Network

Country Destination Domain Proto
GB 142.250.187.195:443 tcp
N/A 224.0.0.251:5353 udp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
GB 216.58.204.78:443 tcp
GB 216.58.201.98:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp
SG 8.219.55.216:443 tcp

Files

/data/data/com.android.core.service.hms/cache/config-journal

MD5 39db26453ae1d050bfe6e7cd7961a757
SHA1 2222063cd49f8ee6e4a7410d050f9cff58a6613e
SHA256 9672a35f0b2f0989161610f0eb5c703463c9874c4b6a96644db7d88c90ee912b
SHA512 741b6cdd80a81a6b0f894a9df3c8bb2ced7563451d6db3173f4a68d12062f1f941b4a6179c33fcf96804cd03eb4f48fff6bf355d99623abdccd8435db19f7aa1

/data/data/com.android.core.service.hms/cache/config

MD5 ec0699a2a426d8c8c9c76e33b0d1a186
SHA1 8e0c8f4b7a650dab625431d8a79bccf3f899f1ca
SHA256 bdfce87fd3f04e6b49cb8c95cd20ed189997e8bdc383b4fa7655b37730b9db3d
SHA512 e3c9bb66b056336401406b33e4debf3de3c7b3b4d1f2328a64f2bf45a0d383de24a9ecacd68bdeb2756da5089d443ad605a8bfeaf7caa026091be65784b0c440

/data/data/com.android.core.service.hms/cache/config-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.android.core.service.hms/cache/config-wal

MD5 95dc9b24d1bc778ae3bf38bbf365fcd4
SHA1 bf9c34c1d66f4f20e9789c650241fe76bc47f106
SHA256 d5e22eaff8ba51b13a51ff0e853592a23b8069e7ebaa77b2fd9699fa80be4abc
SHA512 055ee6d4c7315580386bdf6be0875e6ce0f150f07cfb9b37379f1c425e9ae5bd89058b352dacc42eb6bbe3d56d1f2c911fe878bb414e894f11fe6a958759fc92

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-21 05:34

Reported

2024-05-21 06:05

Platform

android-x86-arm-20240514-en

Max time kernel

172s

Max time network

131s

Command Line

com.android.aliveservices

Signatures

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Processes

com.android.aliveservices

Network

Country Destination Domain Proto
GB 172.217.169.74:443 tcp
N/A 224.0.0.251:5353 udp
GB 216.58.212.227:443 tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.206:443 android.apis.google.com tcp

Files

/data/data/com.android.aliveservices/files/mmkv/KaClientKv

MD5 620f0b67a91f7f74151bc5be745b7110
SHA1 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
SHA256 ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
SHA512 2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d