xamalicious | hxxps://www[.]mediafire[.]com/file/nudqui5lxmksqa7/Lyricify_1[.]4[.]3_by_xiaomicustom[.]apk/file

Analysis

max time kernel
569s
max time network
524s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
26-01-2025 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/nudqui5lxmksqa7/Lyricify_1.4.3_by_xiaomicustom.apk/file

Score

10^/10

xamalicious infostealer spyware trojan

Malware Config

Signatures

Android Xamalicious payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-5.dat	family_xamalicious

Xamalicious
Xamalicious is an Android backdoor malware implemented with Xamarin framework first seen in December 2023.
trojan infostealer spyware xamalicious
Xamalicious family
xamalicious

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Checks CPU information 2 TTPs 3 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome
File opened for read	/proc/cpuinfo	com.android.chrome
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 3 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome
File opened for read	/proc/meminfo	com.android.chrome
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4606

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:5342

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:5553

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/dom-0.html

Filesize
239KB

MD5
febcf263bd353c7c3c69e755362a7a56

SHA1
ce8ce04ee0e749582cea0c07b1b337da61afe89b

SHA256
fb15350a92da10667be4fe56456d5397c32cbc3896d861413436f74641fad595

SHA512
8ec8a7923eaaa28f60b29f67943b1ad41131c9c53c284b973437ad8742bed38e611a4b4239959f6043f2cf2da31ab9981c3855eadd78d68d76b6a3ef3c285a02

Download Submit
files/dom-1.html

Filesize
101KB

MD5
b85a5a24da6d6221e861c52cd9a4d665

SHA1
1ee992624afbf27d06a9d2a71be57c81506ea4ab

SHA256
7e7c8eb77ddfbe61d4b22bf5796a4a6f52d7731ddd34096ef3b8fe85096af794

SHA512
8f9372a6cd6d3cdf2af2e15164d396151e5b78a5e852eea9b0bb79c1a863c1f4a9f10dbbc75cbde06035099fbe7eba57c2d0ba466a2616c7ec3ebe8b67c19391

Download Submit
/storage/emulated/0/Download/.pending-1738522675-Lyricify 1.4.3 by xiaomicustom.apk

Filesize
34.1MB

MD5
bb0a53c82aaee150993400e972ef5976

SHA1
260e667dc8e97dac36e7bb5adf69563b60751f78

SHA256
990c2a1e59505922512dc8339d9069bb64b196d5da5947b336140bfd4afa2ba6

SHA512
a6f831e11e94bcf096b49166dd04ed96a5af1092c3875935a2dd7962655df6526946741b58667fe27203aa58e27a1f47bf61d368310ae6a06a21ce59bad00f91

Download Submit
/storage/emulated/0/Download/.pending-1738522675-Lyricify 1.4.3 by xiaomicustom.apk (deleted)

Filesize
512KB

MD5
59071590099d21dd439896592338bf95

SHA1
6a521e1d2a632c26e53b83d2cc4b0edecfc1e68c

SHA256
07854d2fef297a06ba81685e660c332de36d5d18d546927d30daad6d7fda1541

SHA512
eedb6cadbceb2c991fc6f68dccb80463b3f660c5358acd7d705398ae2e3df2b4327f0f6c6746486848bd2992b379776483a98063ae96edb45877bb0314874668

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads