b4e8b5aa7c3afee74220f66a26387e463d4a5692f30d06035af203dc482511e0

Analysis

max time kernel
135s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
20/10/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
youni.apk
Size 1.3MB
Sample241020-c87pjsvbjd
SHA256 a1c998e1a2b0d636347ad5dc3192ef2c2a2137de49d8024c8ed7717f92de5de8
MD5 f51d1a5d4c80374966663a4e3fcb9585
SHA1 eb729e0f3a6c73f2b4490f2f98d6d5782181ec26
SHA512 4c12776451ca825693fb4af1f595aaf3e1016547552a370915c122352e32af2e01567948704d1d0b1d4a3f1f61ce4a3af6b151e56101e9d783d002f3cb21697a
SSDEEP 24576:DANrM/KjthUFS+3mpYniQUWSeQDxW0X0FxnUsh7d5x9JAQw8xs:DApMGUfmpSgUehKxnZdm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery impact persistence

Malware Config

Signatures

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.snda.youni

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.snda.youni

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.snda.youni

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.snda.youni

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.snda.youni

com.snda.youni
1⤵
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4338
- chmod 777 /storage/emulated/0/snda/sdw/woa/youni/sndawoa.dat
  2⤵
  PID:4410

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

youni.db

Path /data/data/com.snda.youni/databases/youni.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

youni.db-journal

Path /data/data/com.snda.youni/databases/youni.db-journal
Size 512B
SHA256 06102bdea3bfe0607643917da29fe8ed332629875214ed8ce414d219361ae4d2
MD5 179d19474ef1c4607cff5a7a5ec114f1
SHA1 03311ee48efa40a90acfb9974c2476877eef0bc3
SHA512 3ed5328bdd7a01720f235fe5a770999c74d5a0be12102fa56054bfc6b4c7ba16e0742da22a92e98a063d3252c36635fdcf17519323427b3b32a66648046a2c98
MD5 SHA1 SHA512

Submit Download

youni.db-shm

Path /data/data/com.snda.youni/databases/youni.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

youni.db-wal

Path /data/data/com.snda.youni/databases/youni.db-wal
Size 44KB
SHA256 143ea7550ec3d2890eff06632828bf0f75eecadafd72a592d75aae571258be11
MD5 fce41005d84de858ad8c7a3cc9350f4f
SHA1 27250b6dac6ec281f6b135426e26a8a8544f4973
SHA512 f595545cca820ae9963bd6fe63b28831a9ad4f364d0b5a208c3302845955e0dc7f5f8fd6ffc22915a7012e06f706bf0bbc0f4323b57ab10f21d4fdefd3427e08
SSDEEP 48:NxizNSP/2z6qkg4Olvp2MmBAtUB9mB262gCqypNKQSP/2v6KWX:a0PKvf4OlB/mBAu9mUg8KZPb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads