Analysis
- user interaction
yes - max time kernel
4s - max time network
152s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
05/07/2026, 00:42
Behavioral task
behavioral1
Sample
sms-spy-v4.apk
Resource
android-33-x64-arm64-20260325-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
sms-spy-v4.apk
Resource
android-x64-20260325-en
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
sms-spy-v4.apk
Resource
android-x64-arm64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
sms-spy-v4.apk
Resource
android-34-x64-arm64-20260325.1-en
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
sms-spy-v4.apk
Resource
android-35-x64-arm64-20260325-en
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
sms-spy-v4.apk
Resource
android-x86-arm-20260325-en
0 signatures
150 seconds
General
- Target sms-spy-v4.apk
- Size 6.2MB
- Sample260705-a2falsbt7l
- SHA256 f96b65847305870abebd89773decbf4c4c25f9c8140dbb0368629458323f8d07
- MD5 e867b38c94d30cbac387a53614245c8e
- SHA1 b0bd0b5371a4421e20a69b7661453ba2ad6ec16d
- SHA512 a4af00b2e57276137f8291d7fefb94dbc2dd4fc2435725a04ab2c64a005171f83866b08c2fca7782fd1e9f121805382dd621397cfe008ac485d20101c55a14ba
- SSDEEP 98304:c6juUO8ftRrdz4RW2g7U8Avke75EEppppTuE3iO6eHvjJCpXujHaFZyOT2UyJLtL:c6yA4RF8AsytupmvjJCpXmaFZTOEeH
- TLSH T1FE66F185FB48D92BC477743245AA5722568B8E068E83D753AA443E0C6CB7AC40F5EFCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.androidxddevs.smsspyv4 - Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/data/phones com.androidxddevs.smsspyv4 - Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://sms/inbox com.androidxddevs.smsspyv4 - Reads the content of the call log. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://call_log/calls com.androidxddevs.smsspyv4 - Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.androidxddevs.smsspyv4 - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.androidxddevs.smsspyv4 - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.androidxddevs.smsspyv4
Processes
-
com.androidxddevs.smsspyv41⤵
- Obtains sensitive information copied to the device clipboard
- Reads the contacts stored on the device.
- Reads the content of SMS inbox messages.
- Reads the content of the call log.
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Checks CPU information
- Checks memory information
PID:4889