Analysis
-
max time kernel
570s -
max time network
602s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
24/03/2025, 12:30
General
-
Target
rex.apk
-
Size
5.9MB
-
MD5
7592b1770a1d0d5e669f8823d7ce6227
-
SHA1
afcad66bb5bff1d2398404ff9120b0b0302fa8c8
-
SHA256
0b9a995068927a901a45dfc103d707f47615ecac92706ae9169f4329b65569a5
-
SHA512
e8f34c11f88a8d13a5f985b753d6e9f91b21be0e3f92aad30daf98205190a221a92b732701ec94ab1c2c0018eac62e358cee09d37198b88f8907f2d64b6bca0d
-
SSDEEP
98304:yKd2ZrR7Wa+1Q2EVHlfv0wSZQV6Ipst7YhbDAhtlLxxFKyRbg3O+GCXnmqU:TNY0n9IeZwbDAhtl1eyFImqU
Score
8/10
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the SMS messages. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Reads the content of the SMS messages.
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Checks CPU information
- Checks memory information