Analysis
-
max time kernel
149s -
max time network
157s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
27/03/2025, 11:05
General
-
Target
d8452b39b1962239e9dbe12e8a9d8d0ee098b9c8de8a8d55b5a95b67b552102f.apk
-
Size
161KB
-
MD5
de6ef70d8f9e0af2071a9ba1be902a37
-
SHA1
fb4bc1d9b1b6f1f22331dee8ba300d32b2563649
-
SHA256
d8452b39b1962239e9dbe12e8a9d8d0ee098b9c8de8a8d55b5a95b67b552102f
-
SHA512
a2cc63f788caa00678a6d90ac655b71ee28f8bb999239fe71475ce87a78180bffe4ae114b825d319995741b1bc005111ba8fa72d1d20686c9bb4baf169776879
-
SSDEEP
3072:SQZGjcHoU3QiCxEH14Xj4JKBLRP9cuTqUcanhXEcMYZ4JBpEFRrCVJnacL:SQZGjcOBQSj4CcuTqfanh9Z4TiFRrCHT
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the SMS messages. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
net.homeclasswindwater.daymaildayeye1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the SMS messages.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Tries to add a device administrator.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/net.homeclasswindwater.daymaildayeye/app_yahkvtrmc/atdvwcobv.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/net.homeclasswindwater.daymaildayeye/app_yahkvtrmc/oat/x86/atdvwcobv.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5df89eecea8d42ef21924343b957ba365
SHA113818b1cd0fb1307e12a9266603c6c0ad9e730e4
SHA2562e3407ed8bc813e4679e74fbecabdac355bac9e16d59fce72d88c57c4a15d779
SHA512a920ebed16b0f1e0ed75eb16a52e0ed81690910f4fa7d30351127e391f0424796c234018abfed7645434457f83f0cc2df2096001b9ef13e54dd640d804910834
-
Filesize
119KB
MD5e7450ad159371368be4b278c0f53791a
SHA126b36d079c5443fab49846b68e46ac45c3124b84
SHA2569a881daeeee59578e028f34f914ad95dc2755e191fd7684530d0859cab1fdb72
SHA512bca39a143f6e27e6e512aca58ee1c4161eec27d9b34493d5a95ec5a8b3bd8c846690feadbb1e8e4d50d3acd3a1e87a3643c35be80d51be1c891fda5093a19f41
-
Filesize
119KB
MD5f3aebfbe829f689f446f22b4192cf3f2
SHA1526cf9685769c7aca25543467e2010e1c843d3f6
SHA2565f293e8a9c5301c9b85c1ae8e9f190e0861b417b135354f438795885e9d9a514
SHA51257f52d1e7301ff4c92d6d6306772f7f50f2773fe0f8eeadb8d128b11658e13d8cdd08b79211350097dd34cf6e4d61a71f1eadf7446e93abcc8bc1143f3b92628
-
Filesize
180B
MD506444e3dd0f6f3f95b35abbb545508f3
SHA19709d39592c84a75ce5b39e7d44977c07c2834b5
SHA2568d8818d226112188a0e9aeaa87215c5141bd879255113ac025eb733d1537da81
SHA5122ab159aeede6aa86e75488eebe4e93fe76eccb2adb610788cd3fc4a1f8936cc29d765931e4e39d059cb22597531882abb8a402e9181c4d914111a13b863037af
-
Filesize
176B
MD574cf3dda2720a14870dcb5489f294870
SHA10da6098e12b7b7d49ea0a16a4deef0cfd53e8c14
SHA256a5a341d9efb7559c59cdeb85ab93aebceee0add4b54ef299cf57a635e9d5d0ca
SHA512ff3bedf00e1511e1c34f7bf882072abc31f6987200bb186a72fea7e61bc9309c9187c466770cb16dab7b203c246a557bcf43c79f750ea0ce9426034499a83a52
-
Filesize
176B
MD542d33ae43a940aa22fbce06a583d267a
SHA17c24de24814e15a62ce0a40c2e38e673e241b204
SHA256643bbe0a2687e5b9c8265987a80c1cc80c83fc6b8bb45486d823ec8b097fe954
SHA5126c2c1b62f9cc4516d00de997aad8b2d410faf1e0699e7a38fa9f7f38a7b7b2559868e9905b5725fd60083c3625cb92c6bfa9830481aecef06aa4b3b0df42839f
-
Filesize
180B
MD5617814e52918695c3f050badf5062425
SHA153651efd71580fdbf6b000d36496cb4ceed9779f
SHA25650df752f8a8698eb58867e1131c1e3e6f360be36e54f4c720f1318e0f04f63be
SHA512cb42c41ffe600d1a45db281b0a01cd9c78c72565ee65f7de8e840827ec67bf1141e284c94cf552e5cfc28ad799019cf13bdc7fa708b0cc693c98225400ed11bf