smsworm | 2d81efabf6b5aa167fed70bbe07e30fab07569b8a992b8ff9f55b4b86169b84c | Triage

Sharing

General

Target

SnapPlus.apk
Size

12.1MB
Sample

241026-xa5gravrbz
MD5

504d24b231072148bd3573111631ab4e
SHA1

0e5d11da02fcf991989ab28943f4ca96a5c5f81b
SHA256

2d81efabf6b5aa167fed70bbe07e30fab07569b8a992b8ff9f55b4b86169b84c
SHA512

b4dda944b767321cb4a11076d79aa9e267465abe1d62fcc35c0262b04776457b4e787be50b120783ec7934239ee3b5d4449c2bfc76d1d7480c2d45046894a41c
SSDEEP

196608:uTzqgG5BRSzDfFyfVBlFjGMWWmjbwXiMpBdyLih7d+dyfCOO7Qdkc/cbjy6iJp:mq3PfV577m/wSMpBduyfCO3dx/aa

Score

10^/10

smsworm android discovery evasion persistence

Malware Config

Targets

- Target
  
  SnapPlus.apk
- Size
  
  12.1MB
- MD5
  
  504d24b231072148bd3573111631ab4e
- SHA1
  
  0e5d11da02fcf991989ab28943f4ca96a5c5f81b
- SHA256
  
  2d81efabf6b5aa167fed70bbe07e30fab07569b8a992b8ff9f55b4b86169b84c
- SHA512
  
  b4dda944b767321cb4a11076d79aa9e267465abe1d62fcc35c0262b04776457b4e787be50b120783ec7934239ee3b5d4449c2bfc76d1d7480c2d45046894a41c
- SSDEEP
  
  196608:uTzqgG5BRSzDfFyfVBlFjGMWWmjbwXiMpBdyLih7d+dyfCOO7Qdkc/cbjy6iJp:mq3PfV577m/wSMpBduyfCO3dx/aa
Score

8^/10

discovery evasion persistence
- Checks if the Android device is rooted.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about active data network
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Credential Access

Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence

behavioral3

discoveryevasion