Analysis
-
max time kernel
47s -
max time network
51s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
07-07-2024 22:11
General
-
Target
df60d389db28c5f9fa5005ca8df31659f59bcde022f80cbbda2b5250d9467226.apk
-
Size
6.4MB
-
MD5
686abc81706deaed8a6490802177757a
-
SHA1
94807a943fb9f7a375985ede8f27b3f88ef58774
-
SHA256
df60d389db28c5f9fa5005ca8df31659f59bcde022f80cbbda2b5250d9467226
-
SHA512
05aa626c3716df9af5214cf2be2420265d30d5bca14e4154e8df7670bda2a70b580d05ebe61180686895f6a366f510dfe198f64ba3e2bc4f38d69054652b1b2d
-
SSDEEP
98304:oPqAsMI4H5Eojp/abJSf5799fx2zHsjbR6x4icMLJaYyCZ2zjn8aYsr4GB:oPqAd5ppuc99x4z6Ux4KLAYylzj8/srn
Malware Config
Signatures
-
smsagent
SmsAgent is an Android malware that targets victim SMS messages using Telegram as its C2.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.android.app1⤵
- Obtains sensitive information copied to the device clipboard
- Reads the content of SMS inbox messages.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Checks CPU information
- Checks memory information