Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    14/11/2024, 22:05

General

  • Target

    c622d8c06faef7a38e1332e45597982554ac52567f19fc4b057415197bc1a652.apk

  • Size

    2.0MB

  • MD5

    490bdf848c7c36fe086038f0d8769716

  • SHA1

    ce1ff8f69ff0faa3b8d9bd9fc691300605088857

  • SHA256

    c622d8c06faef7a38e1332e45597982554ac52567f19fc4b057415197bc1a652

  • SHA512

    f95e9b3bdaa8a38b1b12c71b3a2122d3bb5b3b9ee3a17f90af531153871907ba3ea74a778659b3fa4a3c8119f3b48e344dffd4cdf9881716b8541854f10fa718

  • SSDEEP

    49152:KEgQoHJEsFWql04hT80LqoxJhrFapbWic3v59:WE63lRhT8M9Ph+Wic3vn

Malware Config

Signatures

  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

Processes

  • com.shootii.rooomu
    1⤵
    • Reads the content of SMS inbox messages.
    • Makes use of the framework's foreground persistence service
    PID:4246

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.shootii.rooomu/app_sslcache/m6295070150-default-rtdb.firebaseio.com.443

    Filesize

    8KB

    MD5

    8a5a2dc6eeca336faafef331866db45f

    SHA1

    4b03dd1693ddd35d1ec8eda2c5e240046cd6dc62

    SHA256

    77fba891821de42dc5727968ac9669942803780bb0b7c65cf662f01ed03b2bcb

    SHA512

    da630edea4381594d73f6bc6a1a62fad8493bcc40a6210b51f519f243ec477788515c9200014e006ac3d3d9edfe87dac6e36a569a10b8bae2f622e60dae56b25

  • /data/data/com.shootii.rooomu/files/profileInstalled

    Filesize

    24B

    MD5

    535777644acd6b542c14ec83c6fef65c

    SHA1

    e9eaa58d948b29e7dd0067ad75c25c21cf9d5912

    SHA256

    c6e2e32985034a5d60d3d2d79689b82c391886f8e37e2da3d0de47733c287afe

    SHA512

    f7512e654286d71b6f99ce1bc3a3cd900ac81a54cdddfbedf65c0c3a513ad6c33fe13d2c3b81992e0b4ac980380dc6ffe47fa1413249e89ce305b1b8619189c6

  • /data/data/com.shootii.rooomu/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

    Filesize

    8B

    MD5

    deb63ca142556e207ae3c247460d0409

    SHA1

    5db9866b929d3de6488c9f2e943484df451a2f91

    SHA256

    03534ecd54812b9da36b391c4c473e400781caa13b07651ff0bdd86bc9f77f6e

    SHA512

    2e7630efb0fa896729e5230b434cd172c3700e5f0971a0dc9bd73405b59358353a03eb74abca66cc66b1714540ce9bd2ad6545a005b8a8d51ab9ae3085998c56

  • /data/misc/profiles/cur/0/com.shootii.rooomu/primary.prof

    Filesize

    1KB

    MD5

    8d7dac347876fb9353edaaccac204323

    SHA1

    14d8b02b52fd914f4e52a705bad8aa21ff4489ba

    SHA256

    01517c2da8691eb6e0138c1b3bebd5f380811d4925a57093d37954617982b82d

    SHA512

    42daeac48f93ce48abe36a16906b13086192eb7a76aa1a401911d375ff9dbe32ecf1d85f6522cba9ee5b172e8680acae242622889a8086f680694dcd4e76328a

  • /data/misc/profiles/cur/0/com.shootii.rooomu/primary.prof

    Filesize

    2KB

    MD5

    da2a3aca48816ff170b5bdecf5f5b7a2

    SHA1

    6d9971e3669635e8f6c28c4fd66cc181dddaf1b1

    SHA256

    2464947164c33b64be4ec546af5a7d350b75e440db8c7cf67082eb101580ec33

    SHA512

    e3593f836f9ddfc6d491504c7d99321043821f9b30d593721bd3f17e9dd2a216b360cb9284fd3cba91ebd560f3260573c601c6fad53afbb7b755b597ec1f11f6