Analysis
-
max time kernel
15s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
-
submitted
01-06-2024 17:42
General
-
Target
VideoChat18.apk
-
Size
6.1MB
-
MD5
c431abbfae5c850c815a46e32d30b5de
-
SHA1
749fb3c858be68c622e81ffa75d8a1a4196476f1
-
SHA256
a180eff7572de2e298bf4fe793547ca90a33bfaa734de4dfa9d1e21875fcd1f8
-
SHA512
12919bbe1e09563e45cdf7dae49697e0808ea175fc71f9834bfd47e1e66005181e0b2bb2fb9b12202cfa02600a48b20cd2df3f0f46f8f51b5f3e88cccbd4083e
-
SSDEEP
196608:gPqAhWRal6xLTUase0eK25EkCAYylzVNmnp:gPqAhWoYxLXf0e7oAYgzVNsp
Score
10/10
Malware Config
Signatures
-
smsagent
SmsAgent is an Android malware that targets victim SMS messages using Telegram as its C2.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
Processes
-
com.android.app1⤵
- Checks memory information
- Makes use of the framework's foreground persistence service
- Obtains sensitive information copied to the device clipboard
- Reads the content of SMS inbox messages.
- Acquires the wake lock