b4e8b5aa7c3afee74220f66a26387e463d4a5692f30d06035af203dc482511e0

Analysis

max time kernel
134s
max time network
154s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
20/10/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
youni.apk
Size 1.3MB
Sample241020-c87pjsvbjd
SHA256 a1c998e1a2b0d636347ad5dc3192ef2c2a2137de49d8024c8ed7717f92de5de8
MD5 f51d1a5d4c80374966663a4e3fcb9585
SHA1 eb729e0f3a6c73f2b4490f2f98d6d5782181ec26
SHA512 4c12776451ca825693fb4af1f595aaf3e1016547552a370915c122352e32af2e01567948704d1d0b1d4a3f1f61ce4a3af6b151e56101e9d783d002f3cb21697a
SSDEEP 24576:DANrM/KjthUFS+3mpYniQUWSeQDxW0X0FxnUsh7d5x9JAQw8xs:DApMGUfmpSgUehKxnZdm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery impact persistence

Malware Config

Signatures

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.snda.youni

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.snda.youni

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.snda.youni

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.snda.youni

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.snda.youni

com.snda.youni
1⤵
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5158

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

youni.db

Path /data/data/com.snda.youni/databases/youni.db
Size 32KB
SHA256 9b90a36e6404df73d03866ecab0c6380c051078fb69662b9de0475d0e5098e0f
MD5 5cdd2e06039d404a0608bdc5c516d023
SHA1 c69c06f63842277062d2b767a362e703e921cac4
SHA512 adf632419ab419c5f764d096dd72f7cce39328e85fa779fec330ccbb5c9897ca5e34bf1f894e90a6f1321ab864fe772d1696ba0f792ed883d891972a1f6725dd
SSDEEP 24:TL5hO4IR/RdPB2DMbmBA21cUB9dd+B2Q1nJYzTYIBqJIZf9PKVGSZGQQQ:T9hOlvp2MmBAtUB9mB262gCqypNKQS
MD5 SHA1 SHA512 SSDEEP

Submit Download

youni.db-journal

Path /data/data/com.snda.youni/databases/youni.db-journal
Size 512B
SHA256 f40e1062c48df1a1e99da76556ed98e03ea348cc78e9556814d16e1da9c84cf1
MD5 81ab907c3a05f7b4ce295e283f1b9c0b
SHA1 5a00a476a641014c40237b658de446ede4d93d1c
SHA512 bafe0c0144c19c439a38d2b92d4973e1ec071fea3a7ddd94457f5d63ebaf277b888d6341e000ddec0b556d7f54b00856808bab1833df20f3e03cff4c3ba28279
MD5 SHA1 SHA512

Submit Download

youni.db-journal

Path /data/data/com.snda.youni/databases/youni.db-journal
Size 8KB
SHA256 042713ef22b1ff12c986c576c475af734f4c751cd2ae8b0ff33bf8a8120d5feb
MD5 25c71333f12f0ec71be350b33c2381cd
SHA1 f8df350c513d4fbb129b3bd70df3aa8f888f5692
SHA512 7ba87d88386cbddee811b2cb287f6504744b6de3a25917e8402e34cdb2ff1af06ad7bd0f75fcb3a428ea8fa44d1cf85bfcf5897a92bd5d71d1d65caf19936c2a
SSDEEP 6:7+/l9an1wcg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKe:7+tncqLiuWdwRmBEyPb5
MD5 SHA1 SHA512 SSDEEP

Submit Download

youni.db-journal

Path /data/data/com.snda.youni/databases/youni.db-journal
Size 8KB
SHA256 41a1f0ce73fb05a5eeb1a147f12720f7bcbc04f4f74ae80211588fb55830fad8
MD5 0333f07fc9335c298e466cabb55b22f8
SHA1 e4159f019a2d52c23238d2dd378a2fa06876c10e
SHA512 447ea7c7d3c514a98cb73fa44ed4bf657baa127a0d3dd9e0618ede7f835a3cf7442810f2978ade693f7cb211642a74c415911b2e65ca13e9d0aca7fc497413e8
SSDEEP 6:7+/l9k3Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKT/H:7+toqLJdTRmBEyPbkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads