smseye | 07ea0a73b6d33249f26a5393d30dca8977a1775439253d1b98cf4c157f402f88

Analysis

max time kernel
30s
max time network
36s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
28-05-2024 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07ea0a73b6d33249f26a5393d30dca8977a1775439253d1b98cf4c157f402f88.apk
Size

9.4MB
MD5

efb8696f788a650219f1233fcf6be79b
SHA1

72000a7faad1c40d56e49e9c36c2692e31b3ef59
SHA256

07ea0a73b6d33249f26a5393d30dca8977a1775439253d1b98cf4c157f402f88
SHA512

a8a04b77546084b5bb63f5f9e443a24123a4a8c425201dc98c0d37f2c723e122d077c7c50e157ee26ced69a00baf943167ffa67588f48b7aade652485db70fa2
SSDEEP

196608:DP5lb3ljyXEpy8bDRUYTnHb4Jao3GEi/+dM2WR2VCUHufTrkI1LL3aNbAGR90R:DP5lDEXE4ADRUYTHKPaHrf1H3gAG7M

Score

10^/10

smseye collection credential_access discovery evasion impact infostealer spyware trojan

Malware Config

Signatures

Android SMSeye payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-2.dat	family_smseye

SMSeye
SMSeye is an open source Android spyware that targets Android SMS.
trojan infostealer spyware smseye

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	boost.com

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	boost.com

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/boost.com/app_ded/o7fdVOo5SqysRKOrl7HKrwQci0uZDTd3.dex	4630	boost.com
/data/user/0/boost.com/app_ded/o7fdVOo5SqysRKOrl7HKrwQci0uZDTd3.dex	4630	boost.com
/data/user/0/boost.com/app_ded/Vmio7BvfTsxSvl8k0SI3vgRVI0PT9zgA.dex	4630	boost.com
/data/user/0/boost.com/app_ded/Vmio7BvfTsxSvl8k0SI3vgRVI0PT9zgA.dex	4630	boost.com

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	boost.com

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	boost.com

boost.com
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Uses Crypto APIs (Might try to encrypt user data)
PID:4630

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/boost.com/app_ded/Vmio7BvfTsxSvl8k0SI3vgRVI0PT9zgA.dex

Filesize
11.1MB

MD5
b1116567fe537e82e5c08a3fbd98db8b

SHA1
3bacff4f8edd43921427e3217ae2041489fe1331

SHA256
de4605d3af30b44ba2bf50bfc6947524f59a1588a0cc142facc18a03bfe06e58

SHA512
92dc102db13d704d799cac1b22155cdc9cdb0db0405c285ffb9fcc3dafcaa9ff3aef592eef82d75a37cf43d018fae174509e60cb78ef37476835e8c4dab63f96

Download Submit
/data/data/boost.com/app_ded/o7fdVOo5SqysRKOrl7HKrwQci0uZDTd3.dex

Filesize
4.7MB

MD5
a0388eba4cb186208efb2cffd902b58c

SHA1
4c965330b4f8539626103e0662cecf3d17edbbd8

SHA256
25c22ddd7f10ab970d667c53ec0422eee324c1daa08e9f2553c5d0c17d3ce1df

SHA512
a0644699b37e6f3cad73e20a9bf7a8c3a9474aad0ad277236e71394129f414db0ff7e13cdd93f38c063105e8dedf2e5679d8298a4d364345fa96979f0c604f66

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads