smsworm | ae583a2f72bfa7fb0f62e20dddc6d13b216826aa6102257cb6c1a75bfe48ff33

General

Target
ae583a2f72bfa7fb0f62e20dddc6d13b216826aa6102257cb6c1a75bfe48ff33
Size 17.6MB
Sample240604-fa8qqsea59
SHA256 ae583a2f72bfa7fb0f62e20dddc6d13b216826aa6102257cb6c1a75bfe48ff33
MD5 8acb8c40dce976146d15ceb757f5b2aa
SHA1 82ffc7fb20dce273fe22161c93ebeaec1f6d248b
SHA512 b5d67d1bf22ef39c6bfb318b09dab831249641da006a46fce9d671c396745e175ded609cb932b15da7ce4a6587c95559eb4dc5dfe4392d0f96cca59b9acb980d
SSDEEP 393216:DVsI39e1pCnfkUu1bxcb80LfQ0Wejue+8x1Uy7Nt:DJte3SpupOb9/WeaezxF/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  ae583a2f72bfa7fb0f62e20dddc6d13b216826aa6102257cb6c1a75bfe48ff33
- Size 17.6MB
- SHA256 ae583a2f72bfa7fb0f62e20dddc6d13b216826aa6102257cb6c1a75bfe48ff33
- MD5 8acb8c40dce976146d15ceb757f5b2aa
- SHA1 82ffc7fb20dce273fe22161c93ebeaec1f6d248b
- SHA512 b5d67d1bf22ef39c6bfb318b09dab831249641da006a46fce9d671c396745e175ded609cb932b15da7ce4a6587c95559eb4dc5dfe4392d0f96cca59b9acb980d
- SSDEEP 393216:DVsI39e1pCnfkUu1bxcb80LfQ0Wejue+8x1Uy7Nt:DJte3SpupOb9/WeaezxF/
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

banker discovery evasion execution impact persistence ransomware
- Renames multiple (53) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks if the Android device is rooted.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  evasion
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
- Checks if the internet connection is available
  discovery
- Schedules tasks to execute at a specified time
  Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
  execution persistence
- Checks the presence of a debugger
  evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  evasion
behavioral1