b64a46693b6cd3d73deb4015243ca3b9c4ad4b1d222e64815ac598a2611604fb

Analysis

max time kernel
132s
max time network
150s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
25/03/2025, 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

based.apk
Size

2.2MB
MD5

45ef961c0d925aa3ca1e7f943ca673cb
SHA1

ce377d305a967ef4d4c474e0723826109d8a6bd4
SHA256

b64a46693b6cd3d73deb4015243ca3b9c4ad4b1d222e64815ac598a2611604fb
SHA512

2b5df5e6f957c218e37dac575d3451c80e887e209aa6e4f7dd8517c214da41cacfb717ad7c1157ccb0873c9792286ac4d90c69959ee2cb7eaff9151213cf63a5
SSDEEP

49152:WQgtYfKUctQ8v2FUFAkHJHCwz2G4ckvbXdvsAS5G5gvY4Rl:pgtbbQ8v2FtwTB4tXRsA9Ol

Score

7^/10

collection discovery execution persistence

Malware Config

Signatures

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.example.reverseshell2

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.example.reverseshell2

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.example.reverseshell2

com.example.reverseshell2
1⤵
- Reads the content of SMS inbox messages.
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4498

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads