1e724a5af76927106ee92421412af62698707d1d44a9891f91b3c6902f1780cd

Analysis

max time kernel
29s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
25/03/2025, 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e724a5af76927106ee92421412af62698707d1d44a9891f91b3c6902f1780cd.apk
Size

8.4MB
MD5

689ec6a5d7ce2f763f163a429edf5504
SHA1

4b04cb90e3141a0060f98507fcd180cb68db0e0e
SHA256

1e724a5af76927106ee92421412af62698707d1d44a9891f91b3c6902f1780cd
SHA512

33730ff2403db5f60fd2ff9d4d2987a903d280892b8297ae8694a6e2eac9089285642be8218385e5a611ff273c7b5c23e1afa89ef170f7f722f015264b5a2f6b
SSDEEP

196608:1+97L8E4QzRu1gl22jAGYcvW0Whqvy0B7e8HBivRJcKQR4I976U:1KAE4QlzMivHKg7e8HBivR+dR4wT

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.comeback.myside.sms

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.comeback.myside.sms/cache/1582435991586.jar	4636	com.comeback.myside.sms

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.comeback.myside.sms

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.comeback.myside.sms

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.comeback.myside.sms

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.comeback.myside.sms

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.comeback.myside.sms

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.comeback.myside.sms

com.comeback.myside.sms
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4636

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.comeback.myside.sms/cache/1582435991586.jar

Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/user/0/com.comeback.myside.sms/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit
/data/user/0/com.comeback.myside.sms/files/UnityAdsStorage-private-data.json

Filesize
623B

MD5
a37a7192f94b9f06e8e79ca7c8e60279

SHA1
d180de1aa501751646e5ae4ad771f2e17e9bdf2a

SHA256
26b623c2835670421e9e9f99ac8a6bfaa5180b955ac140b0fe21b03a389c0034

SHA512
b0cba38e9e5e53047fd9c78704add467ee9080088b2010c9c8d8360991c066f40e11769949cb315a65d95245c92db771e65f4e333a6809b5c207dd1d0efc1f3b

Download Submit
/data/user/0/com.comeback.myside.sms/files/UnityAdsStorage-private-data.json

Filesize
1KB

MD5
6b263f5b4f3a7d1b16a53ab19d0d9473

SHA1
1fc4e13e2fa3d864936d737477d9dcf1cec75be3

SHA256
2451557f1d38a38cf87cd7ebde778cdbb53e7f42f394e60bc07cc148a962e118

SHA512
51a6caffefaa25dab21039a2f199b41043a9cba9589bbb1cf8e5111c94c2a1a8a980170ed5377292d0edf9120c2a54dc5ecb345bfac1cdd8f11ec4950cdb6a86

Download Submit
/data/user/0/com.comeback.myside.sms/files/UnityAdsStorage-private-data.json

Filesize
41B

MD5
16d3e6eac0e79222a9b368edac765b34

SHA1
48d5e621fcdd84108f5750d6905180b622715b11

SHA256
3a518b70256a689906d6740062462e3124aad6e55c5aa47339a87a56e4933ee7

SHA512
d0aaacf86100135241426e2a0e9ba44414aa456cd708124e2f9c3a8037e008870cbcb506d316e4fe7cfe1d6dc3073393989a6f3c29f7cfabd6b0f65057afe747

Download Submit
/data/user/0/com.comeback.myside.sms/files/UnityAdsStorage-public-data.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
/storage/emulated/0/Android/data/com.comeback.myside.sms/cache/UnityAdsCache/UnityAdsCache-1ed34218cfae9d273f4f4fd7b0785c805ed5255e675115812f66cc54f39f85a8.mp4 (deleted)

Filesize
3.0MB

MD5
01d301e0015cd9d8de7c19b18885effa

SHA1
f45c69ccecdba3e44764afbc9041bb9e87d80eef

SHA256
129177677bd8a1b4a4e6da307bea1d57070a6343b05767595e4b72a1307fa5fa

SHA512
924562df96c8da828a3ab5f2a1c6be5fc9cb98867e3a6d2390b07859a279d413547afe0cfa2aea6af5e5df8a836acbf845120cba12d99a3c1941f29412772dc2

Download Submit
/storage/emulated/0/Android/data/com.comeback.myside.sms/cache/UnityAdsCache/UnityAdsTest.txt (deleted)

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/storage/emulated/0/Android/data/com.comeback.myside.sms/cache/UnityAdsCache/UnityAdsWebApp.html (deleted)

Filesize
2.1MB

MD5
28bbeac9b1b79342f3dee8550b135db1

SHA1
8d49e6f7c4e8ca375adab0a558e8df20cc6257af

SHA256
596c86caada11d00bf88a4e1e7276483e3e44adba93c5d11a326b18abe3cee34

SHA512
e62a2542dfd002f2c01cd716b77992fe416ac9eeea8ca9d25e94cbf5118445ae02a182650893fa9755cb3e7d554b610c799395cc5cf8020ba0ac3e2f1401c0fc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads