1e724a5af76927106ee92421412af62698707d1d44a9891f91b3c6902f1780cd

Analysis

max time kernel
28s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
25/03/2025, 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e724a5af76927106ee92421412af62698707d1d44a9891f91b3c6902f1780cd.apk
Size

8.4MB
MD5

689ec6a5d7ce2f763f163a429edf5504
SHA1

4b04cb90e3141a0060f98507fcd180cb68db0e0e
SHA256

1e724a5af76927106ee92421412af62698707d1d44a9891f91b3c6902f1780cd
SHA512

33730ff2403db5f60fd2ff9d4d2987a903d280892b8297ae8694a6e2eac9089285642be8218385e5a611ff273c7b5c23e1afa89ef170f7f722f015264b5a2f6b
SSDEEP

196608:1+97L8E4QzRu1gl22jAGYcvW0Whqvy0B7e8HBivRJcKQR4I976U:1KAE4QlzMivHKg7e8HBivR+dR4wT

Score

8^/10

defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.comeback.myside.sms

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.comeback.myside.sms/cache/1582435991586.jar	4331	com.comeback.myside.sms

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.comeback.myside.sms

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.comeback.myside.sms

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.comeback.myside.sms

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.comeback.myside.sms

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.comeback.myside.sms

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.comeback.myside.sms

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.comeback.myside.sms

com.comeback.myside.sms
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4331

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.comeback.myside.sms/cache/1582435991586.jar

Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/data/com.comeback.myside.sms/files/UnityAdsStorage-private-data.json

Filesize
41B

MD5
16d3e6eac0e79222a9b368edac765b34

SHA1
48d5e621fcdd84108f5750d6905180b622715b11

SHA256
3a518b70256a689906d6740062462e3124aad6e55c5aa47339a87a56e4933ee7

SHA512
d0aaacf86100135241426e2a0e9ba44414aa456cd708124e2f9c3a8037e008870cbcb506d316e4fe7cfe1d6dc3073393989a6f3c29f7cfabd6b0f65057afe747

Download Submit
/data/data/com.comeback.myside.sms/files/UnityAdsStorage-private-data.json

Filesize
623B

MD5
9a7a4f52e123182cd434ec0f9f1f97d8

SHA1
ba2acab5f8a7042a60c385bd5deaeb82b67f6e71

SHA256
72c4aafc1b8b3f5bb4ea30bcff1cf72d5cd7fb6556b6be22db1628beb5aceb3f

SHA512
7738d25e7b03587e312b003e758461d259c0a9cacf58488142c32567ca6817ee8df0fc4ee0c25d8fbe04012cab10f896833b5ee64faf211bc5c04d5f1b50bcf3

Download Submit
/data/data/com.comeback.myside.sms/files/UnityAdsStorage-private-data.json

Filesize
1KB

MD5
26c061ee4586115c7b82c324af9e94a0

SHA1
c63f019d7ea9c865b15038a001f5570bb3a8df91

SHA256
7ed3ad44f5c54d8c77bb3d8e2db8c03d10df3d7f5606632d103cdd3ed6f555a2

SHA512
046ce18660bbcff02a79f6e53b11519a9d07a1f33687ab2946f77439bdc13df65082781b0e8c39ce6a8055958f2981d49e77c5382977c10166145170a566ad40

Download Submit
/data/data/com.comeback.myside.sms/files/UnityAdsStorage-public-data.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
/data/user/0/com.comeback.myside.sms/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit
/storage/emulated/0/Android/data/com.comeback.myside.sms/cache/UnityAdsCache/UnityAdsCache-7efb68910366068a1dab9c5cf2775e3064ac2e1f09b8e45fca9971b3aed01672.mp4

Filesize
1.1MB

MD5
f0e33775312dfd6363d9836966b699a2

SHA1
0e8fee2d2b6727438d77e1cc7675d7058fdc181a

SHA256
3b81aee34d161f844dba01b9c8478bbef73bec9f030d572d37d8bdf0efff7f10

SHA512
8c36bcf8620942cad2a2352a7beb06425dfc2afcb29756031a098afcbca6b8807688d366c36b504e48acdef03f97d8f056fd124d86f5787e2646f5bde5b92c3b

Download Submit
/storage/emulated/0/Android/data/com.comeback.myside.sms/cache/UnityAdsCache/UnityAdsTest.txt

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/storage/emulated/0/Android/data/com.comeback.myside.sms/cache/UnityAdsCache/UnityAdsWebApp.html

Filesize
2.1MB

MD5
28bbeac9b1b79342f3dee8550b135db1

SHA1
8d49e6f7c4e8ca375adab0a558e8df20cc6257af

SHA256
596c86caada11d00bf88a4e1e7276483e3e44adba93c5d11a326b18abe3cee34

SHA512
e62a2542dfd002f2c01cd716b77992fe416ac9eeea8ca9d25e94cbf5118445ae02a182650893fa9755cb3e7d554b610c799395cc5cf8020ba0ac3e2f1401c0fc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads