Malware Analysis Report

2024-12-01 03:00

Sample ID 241107-y5klhayapn
Target 6ecd1e9488a3a03950a92a13f86693711954cbcb20a2c9f4e3d0b0cdd3e498ec
SHA256 6ecd1e9488a3a03950a92a13f86693711954cbcb20a2c9f4e3d0b0cdd3e498ec
Tags
collection discovery evasion persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

6ecd1e9488a3a03950a92a13f86693711954cbcb20a2c9f4e3d0b0cdd3e498ec

Threat Level: Shows suspicious behavior

The file 6ecd1e9488a3a03950a92a13f86693711954cbcb20a2c9f4e3d0b0cdd3e498ec was found to be: Shows suspicious behavior.

Malicious Activity Summary

collection discovery evasion persistence

Queries the phone number (MSISDN for GSM devices)

Reads the content of SMS inbox messages.

Requests dangerous framework permissions

Acquires the wake lock

Makes use of the framework's foreground persistence service

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-07 20:22

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-07 20:22

Reported

2024-11-07 20:25

Platform

android-x86-arm-20240624-en

Max time kernel

124s

Max time network

132s

Command Line

com.myidentifier

Signatures

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of SMS inbox messages.

collection
Description Indicator Process Target
URI accessed for read content://sms/inbox N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.myidentifier

Network

Country Destination Domain Proto
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 myidentifier.digital udp
US 199.59.243.227:443 myidentifier.digital tcp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.169.78:443 android.apis.google.com tcp
GB 142.250.178.10:443 semanticlocation-pa.googleapis.com tcp
US 199.59.243.227:443 myidentifier.digital tcp
US 199.59.243.227:443 myidentifier.digital tcp

Files

/data/data/com.myidentifier/no_backup/androidx.work.workdb-journal

MD5 e20ad2b3d0c9f494a69ef49be54a12ad
SHA1 55b729d168396c186cfdcb2f9606110ebc5ac256
SHA256 8dd7f6049fe3b26461425491ae0a9361a56215c5b36dc9011b5b75e91cb11890
SHA512 ca5d639121b800bf205f9df66431def08fe780870394db589d724c8c56f1216f672da4f83972034323375c55e536b04382cb4cca607aafda855b01d42288368a

/data/data/com.myidentifier/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.myidentifier/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.myidentifier/no_backup/androidx.work.workdb-wal

MD5 d5bbad705a2916d6126feb1ed9b520ca
SHA1 01d28066050512eee913b012d37c56beef6df769
SHA256 779bd9bb0db414d49fc4ab8b5a20ce06802b84fb43db7c09be6b5ca301c79123
SHA512 c716674161c48f8e767fa02ff06b96ba1c7a5276fa8a9c087a509a962644a1229f09e033995e791e976a764a8fc01a33595748c442274368dde0d83753b07c04

/data/data/com.myidentifier/no_backup/androidx.work.workdb-wal

MD5 7a48f217b61cad2595afe495e93efe45
SHA1 a30438b00d0a78bde687f9ed8c078d18ebb3c876
SHA256 ca6f4eb5222fb9eb664cddd093ddd226bc6586d9e63e3c54a646dc7761b01d6f
SHA512 0d2fb6ec74aab482ee0ac2e152c56c30d704a09eb3246b1b4b0344aa7a621689c05400f6a4a6dfb7707892ae6264431ab2e458c11f669261be853cca7634da1d

/data/data/com.myidentifier/no_backup/androidx.work.workdb-wal

MD5 f73446bf34dada1c2da237a3c3876e84
SHA1 6edf030848490ee554f51217d3656484b419a9c8
SHA256 9e5ad3d883afec6afce6ec803b7f63e473f08b3377dc88ed239a88acfe764941
SHA512 d038c5852bd7df95a3ad02355d37a79e7cbd937960ab2ce8a42fe11e9fcf71758d2024ba544427021604c3b976a72908e7e9fbc09b43db50d53600e9344ab041

/data/data/com.myidentifier/databases/RKStorage-journal

MD5 52bbca7b4b6d3d63e53806ed9dbdcdc9
SHA1 45cf286032e945944dc94888ce182d45996cb9af
SHA256 75b19bd6dba632eee555f3a04b80c13c1af408ef3fb6e953eff275fc8579c219
SHA512 921a6851fd84b7e53698fa78d9fdbbf1ddf1347d6f0889214725ae6103d8177d160e686489802c860127f4a0b5a018241b498262f38a1af6c4f5228ffe788128

/data/data/com.myidentifier/databases/RKStorage-wal

MD5 029f5b9782304f02acf5ed2b6f7d69be
SHA1 9f4314bfc25d3480889c217dde1123364fd6cec6
SHA256 b8fd3862dacb325075294a4fd7a11033c9ae42d5973d82440f045b370d882df2
SHA512 783924066d0e4a2b84722e1469a5740bf87020a8714fab8e4ece0c97edd6662173871173d7dfedcca79287c8df633ddb8df29c5c836fa13ad87368988522fd16

/data/data/com.myidentifier/cache/http-cache/journal.tmp

MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-07 20:22

Reported

2024-11-07 20:25

Platform

android-x64-20240624-en

Max time kernel

125s

Max time network

156s

Command Line

com.myidentifier

Signatures

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of SMS inbox messages.

collection
Description Indicator Process Target
URI accessed for read content://sms/inbox N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.myidentifier

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.8:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 myidentifier.digital udp
US 199.59.243.227:443 myidentifier.digital tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.206:443 android.apis.google.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
US 199.59.243.227:443 myidentifier.digital tcp
GB 172.217.16.238:443 tcp
GB 216.58.201.98:443 tcp
US 199.59.243.227:443 myidentifier.digital tcp

Files

/data/data/com.myidentifier/no_backup/androidx.work.workdb-journal

MD5 9f6b86163666369f632def348c6c4b50
SHA1 d50dc565950da17292eb5d1de5209c5faca5e0e2
SHA256 6422b28d7ba8aaec7deb78efbfc9341455fc3c423d7609b2dba0e898662e305c
SHA512 75c90a5dd2352e8e0d5ffd13ee59b23c55e9fc77c9e9713817b6a7efed9edff6a82a22fbef312199b66ce9363646316d02d843c64594a737c1e6e41aa43f367d

/data/data/com.myidentifier/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.myidentifier/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.myidentifier/no_backup/androidx.work.workdb-wal

MD5 307cd5691c30c9d1a23026a39893a149
SHA1 109a8682ce0aa923eb434d477eb1f915a6e4a221
SHA256 acd72d5cee9a63d6dd0b1a9069a9ece5687f53e8e3653e4e2aa59cc00ae5dffc
SHA512 bb2d883880c3463f18cd28dbd54663b1524ea4b4844762579549ecf1b53ca72592a6f11ae5eba6e20bb70a7f1bf736a0b434ab75792e43efd24e1e2da98bcc66

/data/data/com.myidentifier/no_backup/androidx.work.workdb-wal

MD5 5895215fbcff742e3a6918269be7906d
SHA1 e4897e641ec1ef01f398adbaedc723b4638375ca
SHA256 b028559ec952d1a25f4c14302a6d141b629bed435c169cf3b2daa7dcac835339
SHA512 49815d1b9f04e060629fbce50cd09999a4dbab008d32eb496e2c50ece03d4aab085cf7b7167c1bd6884c4180cd8c0737f3909e8ab2ae14a9ad6a5ec186b8a66a

/data/data/com.myidentifier/no_backup/androidx.work.workdb-wal

MD5 5a3bbc1e7447ea6455304457ea096dc7
SHA1 34cbebca9fb0125f903ab4c2419556f8188d0f2d
SHA256 e4beecc70c9c49538925cbae8b05376b075718fa2850e8045857b8ae793658a1
SHA512 35ceb0de9e88de106fed0379c947c56829c06272a8a4b887c6e9dfc5831950f5a86e4fe6c8a1cf739d13fe9c93d55d0d47ebb1797ca676d4d09c59553e34cb00

/data/data/com.myidentifier/databases/RKStorage-journal

MD5 e75d8d9b5d376265c8214e78d010c0c5
SHA1 8dbd4e553a90b57d8e71991c75c8d8902a554c30
SHA256 31585e106dae60e368a7f5a463dcf21a26badc7a4a1e514c01d78b87048d5564
SHA512 6de78492b4c9fff63631eaefbb11e78bd53f8185b20bf0bd3f398700fea1a07743ad6bd03d300423adae4dfafad474ca08f76067842595428f1eaccc18c46743

/data/data/com.myidentifier/databases/RKStorage

MD5 60a13b2692af8f25ad8913e443a55da5
SHA1 3638e4f2d3eb4e0a873abe3e86ca9bd4dfc1778e
SHA256 e087fcf750a2c94eec08a6be333790d9e286dbef296bdc987c3fa935a7579c71
SHA512 15ddc3215c96ea6641c381a5de2838f87efff7df20e57fbd305e6fc43e8254bcea38b2c118fb94cc33c919c38f87ee2ce6dfed8a498fbc25f7b6079e38e816e5

/data/data/com.myidentifier/databases/RKStorage-journal

MD5 c9760c66d5fd8afe91f370e33f5161fc
SHA1 675de0c8b189fb1647d13f3b25207d7c937ee779
SHA256 6c68cd584dc13cf7737c02d6c9eb01d153091b3227e590914d232887b96f7488
SHA512 041e5cdb17d6f38a7b893bf42f6e688936f5ecfd5d7647d70864dab47336065d169609156385a2f4fe4cb4679f7808cb63535e71f585268a174016bb2ad0b14d

/data/data/com.myidentifier/databases/RKStorage-journal

MD5 226780fab4084f324dbda1500b127d6f
SHA1 10b8171e1eb251bd737036272c12ef0b10e651ee
SHA256 e0666e88b0be411602ae0989e2cfd178527a81827806337a58db582707c2f8d9
SHA512 50b1480dec1a4145f8eff4688c73bdd37e1c9c952980484457a485725c0565ab8c3b13500e6a6303e0ebc635f7d098497c3d3b23491b275c057f8e1bdfb706f2

/data/data/com.myidentifier/databases/RKStorage-journal

MD5 f20e6f8c05c4b23c5f3d094cd297e484
SHA1 b7a45acd16f3fa95e1bbc29a11e2f626925dbe21
SHA256 ecc5553b4be3a26f0f2efd6bc80ff5b08b24455bf773b09d79f5ff06fe6db947
SHA512 c240a79577fe07376505701510312939b7320d891e4007ba49cbc1a6999e3d0590e51861da8f7ad2cfe63ce416f2dcbe5b6106a631fd13961a7e1d6f9cdf0b24

/data/data/com.myidentifier/cache/http-cache/journal.tmp

MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6