1e724a5af76927106ee92421412af62698707d1d44a9891f91b3c6902f1780cd

Analysis

max time kernel
93s
max time network
150s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
25/03/2025, 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e724a5af76927106ee92421412af62698707d1d44a9891f91b3c6902f1780cd.apk
Size

8.4MB
MD5

689ec6a5d7ce2f763f163a429edf5504
SHA1

4b04cb90e3141a0060f98507fcd180cb68db0e0e
SHA256

1e724a5af76927106ee92421412af62698707d1d44a9891f91b3c6902f1780cd
SHA512

33730ff2403db5f60fd2ff9d4d2987a903d280892b8297ae8694a6e2eac9089285642be8218385e5a611ff273c7b5c23e1afa89ef170f7f722f015264b5a2f6b
SSDEEP

196608:1+97L8E4QzRu1gl22jAGYcvW0Whqvy0B7e8HBivRJcKQR4I976U:1KAE4QlzMivHKg7e8HBivR+dR4wT

Score

8^/10

collection credential_access defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.comeback.myside.sms

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.comeback.myside.sms/cache/1582435991586.jar	5065	com.comeback.myside.sms

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.comeback.myside.sms

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.comeback.myside.sms

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.comeback.myside.sms

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.comeback.myside.sms

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.comeback.myside.sms

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.comeback.myside.sms

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.comeback.myside.sms

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.comeback.myside.sms

com.comeback.myside.sms
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5065

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.comeback.myside.sms/cache/1582435991586.jar

Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/data/com.comeback.myside.sms/files/UnityAdsStorage-private-data.json

Filesize
627B

MD5
da21ea656642244af2bdf1acd45f7050

SHA1
8eaf352b2be080b0d05d7006498a09f6347eed34

SHA256
5d3fcf77a2bd99f9c6eefdc585d25cbd429199dc6fc068b6318fa3086f921797

SHA512
db63d34dce8aee93baf93558ebe5590669fb3674e1461e350b3acaf8acc699f0060704834a2bd5d346457cc71f23929af0086fcabfc87516253502cc84fd6c57

Download Submit
/data/data/com.comeback.myside.sms/files/UnityAdsStorage-private-data.json

Filesize
1KB

MD5
d2717e7a0aa7c618787d3fbdcce2cedd

SHA1
06d1ea6a9804e2171686e97a0cd0823d6138a1b4

SHA256
76bdf325d3b4bc2d61913ba074ce1d8cae3b903d9d752e29ccfddf0d6f879690

SHA512
7572396fa15de546fa659f831bdf5bcbccedba49e2b8b018a66aa316b8bf80e14e94a91faa7b77681da2044fe9a02fb2e5e49debb392969c9af8ab3a4a3ca1d0

Download Submit
/data/data/com.comeback.myside.sms/files/UnityAdsStorage-private-data.json

Filesize
41B

MD5
16d3e6eac0e79222a9b368edac765b34

SHA1
48d5e621fcdd84108f5750d6905180b622715b11

SHA256
3a518b70256a689906d6740062462e3124aad6e55c5aa47339a87a56e4933ee7

SHA512
d0aaacf86100135241426e2a0e9ba44414aa456cd708124e2f9c3a8037e008870cbcb506d316e4fe7cfe1d6dc3073393989a6f3c29f7cfabd6b0f65057afe747

Download Submit
/data/data/com.comeback.myside.sms/files/UnityAdsStorage-public-data.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
/data/user/0/com.comeback.myside.sms/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit
/storage/emulated/0/Android/data/com.comeback.myside.sms/cache/UnityAdsCache/UnityAdsCache-7efb68910366068a1dab9c5cf2775e3064ac2e1f09b8e45fca9971b3aed01672.mp4

Filesize
1.1MB

MD5
f0e33775312dfd6363d9836966b699a2

SHA1
0e8fee2d2b6727438d77e1cc7675d7058fdc181a

SHA256
3b81aee34d161f844dba01b9c8478bbef73bec9f030d572d37d8bdf0efff7f10

SHA512
8c36bcf8620942cad2a2352a7beb06425dfc2afcb29756031a098afcbca6b8807688d366c36b504e48acdef03f97d8f056fd124d86f5787e2646f5bde5b92c3b

Download Submit
/storage/emulated/0/Android/data/com.comeback.myside.sms/cache/UnityAdsCache/UnityAdsTest.txt

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/storage/emulated/0/Android/data/com.comeback.myside.sms/cache/UnityAdsCache/UnityAdsWebApp.html

Filesize
2.1MB

MD5
28bbeac9b1b79342f3dee8550b135db1

SHA1
8d49e6f7c4e8ca375adab0a558e8df20cc6257af

SHA256
596c86caada11d00bf88a4e1e7276483e3e44adba93c5d11a326b18abe3cee34

SHA512
e62a2542dfd002f2c01cd716b77992fe416ac9eeea8ca9d25e94cbf5118445ae02a182650893fa9755cb3e7d554b610c799395cc5cf8020ba0ac3e2f1401c0fc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads