289e347eb7eeb710b7f432fe65447c4014892c79fc743ac40a064e1d77100c3a

Analysis

max time kernel
20s
max time network
23s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
07/08/2024, 15:24 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

215c986eafa67fd6529348c91fbb3db5.apk
Size

7.4MB
MD5

215c986eafa67fd6529348c91fbb3db5
SHA1

b93ee1e1e1edcaa0c68d63c64b759d3cb8a186d6
SHA256

289e347eb7eeb710b7f432fe65447c4014892c79fc743ac40a064e1d77100c3a
SHA512

697d191310ac2f4d4bd29cc9be22b620323acc280c5642ccdf509c1dd2c8e7226301f3809b0ca24380d999f2d24ee004efdaf85c668565a6ec9aa51b277c383b
SSDEEP

196608:jKGuv2IYHqQ8J2wF1F/R4YNKvSzilCUNUyTU9M:jOv23n8PF1oYbWlCKUsU9M

Score

6^/10

discovery persistence

Malware Config

Signatures

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	abyssalarmy.smseye

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	abyssalarmy.smseye

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	abyssalarmy.smseye

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	abyssalarmy.smseye

abyssalarmy.smseye
1⤵
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4252

Network

DNS

semanticlocation-pa.googleapis.com

Remote address:

1.1.1.1:53

Request

semanticlocation-pa.googleapis.com

IN A

Response

semanticlocation-pa.googleapis.com

IN A

216.58.201.106

semanticlocation-pa.googleapis.com

IN A

142.250.187.202

semanticlocation-pa.googleapis.com

IN A

216.58.212.202

semanticlocation-pa.googleapis.com

IN A

172.217.169.10

semanticlocation-pa.googleapis.com

IN A

142.250.179.234

semanticlocation-pa.googleapis.com

IN A

216.58.212.234

semanticlocation-pa.googleapis.com

IN A

172.217.169.42

semanticlocation-pa.googleapis.com

IN A

172.217.169.74

semanticlocation-pa.googleapis.com

IN A

216.58.204.74

semanticlocation-pa.googleapis.com

IN A

142.250.178.10

semanticlocation-pa.googleapis.com

IN A

142.250.200.10

semanticlocation-pa.googleapis.com

IN A

142.250.187.234

semanticlocation-pa.googleapis.com

IN A

172.217.16.234

semanticlocation-pa.googleapis.com

IN A

216.58.213.10

semanticlocation-pa.googleapis.com

IN A

142.250.180.10

semanticlocation-pa.googleapis.com

IN A

142.250.200.42
DNS

icicicreditcard.github.io

Remote address:

1.1.1.1:53

Request

icicicreditcard.github.io

IN A

Response

icicicreditcard.github.io

IN A

185.199.108.153

icicicreditcard.github.io

IN A

185.199.109.153

icicicreditcard.github.io

IN A

185.199.110.153

icicicreditcard.github.io

IN A

185.199.111.153
DNS

android.apis.google.com

Remote address:

1.1.1.1:53

Request

android.apis.google.com

IN A

Response

android.apis.google.com

IN CNAME

clients.l.google.com

clients.l.google.com

IN A

216.58.213.14

185.199.108.153:443

icicicreditcard.github.io

tls

1.5kB
10.7kB
14
14
142.250.200.46:443

tls, https

858 B
40 B
1
1
216.58.213.14:443

android.apis.google.com

tls

1.8kB
5.8kB
8
10

224.0.0.251:5353

2.5kB
8
1.1.1.1:53

semanticlocation-pa.googleapis.com

dns

80 B
336 B
1
1

DNS Request

semanticlocation-pa.googleapis.com

DNS Response

216.58.201.106

142.250.187.202

216.58.212.202

172.217.169.10

142.250.179.234

216.58.212.234

172.217.169.42

172.217.169.74

216.58.204.74

142.250.178.10

142.250.200.10

142.250.187.234

172.217.16.234

216.58.213.10

142.250.180.10

142.250.200.42
1.1.1.1:53

icicicreditcard.github.io

dns

71 B
135 B
1
1

DNS Request

icicicreditcard.github.io

DNS Response

185.199.108.153

185.199.109.153

185.199.110.153

185.199.111.153
1.1.1.1:53

android.apis.google.com

dns

69 B
109 B
1
1

DNS Request

android.apis.google.com

DNS Response

216.58.213.14

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.