e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000

Analysis

max time kernel
130s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
18/08/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000.apk
Size 12.5MB
Sample260818-3a2nrasemf
SHA256 e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000
MD5 7b9390582033785190dad91b967a265a
SHA1 599216e298ba420b46997e427bde6ea2ebf74079
SHA512 fecd03c0e55544d9a20d34d32e2e9233d274790849f24ccfcae622abf18a862e4aa2b78f793fda2798d0678e56d917eb3d3bcc0279c94e380e2ed8b87a2c778c
SSDEEP 196608:hfAr1tqLzPeGYNtb61llSnPr634Jj2rJxS3zmrCYksTy3oxqoAV:h4r3qLzP5YNtbmlS+oJjmGzpsTy3C2
TLSH
T1BCD61296F3ADEC2FC433A033CA6912B645594D659E42EB673409B71C29F3AD48F49BC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

google discovery evasion persistence phishing

Malware Config

Signatures

Detected google phishing page
Potential google account phishing
phishing google

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.leeqin.coolmms.sms/files/audience_network.dex	4273	com.leeqin.coolmms.sms
/data/user/0/com.leeqin.coolmms.sms/files/audience_network.dex	4357	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.leeqin.coolmms.sms/files/audience_network.dex --output-vdex-fd=53 --oat-fd=60 --oat-location=/data/user/0/com.leeqin.coolmms.sms/files/oat/x86/audience_network.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.leeqin.coolmms.sms/files/audience_network.dex	4273	com.leeqin.coolmms.sms

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.leeqin.coolmms.sms

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
17	sites.google.com
18	sites.google.com

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.leeqin.coolmms.sms

com.leeqin.coolmms.sms
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4273
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.leeqin.coolmms.sms/files/audience_network.dex --output-vdex-fd=53 --oat-fd=60 --oat-location=/data/user/0/com.leeqin.coolmms.sms/files/oat/x86/audience_network.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4357

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/com.leeqin.coolmms.sms/databases/google_app_measurement_local.db
Size 16KB
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
SSDEEP 6:l9FCls1ulO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TgEu9zmzrfRmBEyPbBvOwk3
TLSH
T16772C2CE9F102647C6660377B4CAE3916DA4A12D872BEB472BA50464AE42609A861F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.leeqin.coolmms.sms/databases/google_app_measurement_local.db
Size 16KB
SHA256 3b49e8e7555f42da3ba410e4afbdc6ce3385fcc793e56b73fe79b57902c7007a
MD5 953e48499792461d9e19a8795bb7404a
SHA1 a1e4dff8e3b7678701a630c8b69d33a7bf1a820d
SHA512 372e9e63371f8e0ccc8e3cb1547a8bc4cfc0dadc6c301c8f8ae85ecfdbeb177caac8517378ebd94900ea003212fcc9ad4025e344ed89ab706fc2a7a4a2b08311
SSDEEP 3:qqb/NjghzY+/lzyliMlTXm+6JbzthfzMlklKllgIn:LCM+/lulvl6+6JFhfQlrf
TLSH
T17A72928231C1CB16F2379234528787F22430A3847A02811ABA0556481C823D0AA2621B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.leeqin.coolmms.sms/databases/google_app_measurement_local.db
Size 16KB
SHA256 d6e6f80bb19ac5c33921182d84ca475e22967fa9ee119365217da170edc6ae00
MD5 70c068bc5d2e487f1df036a8dc1272d6
SHA1 103dd5036f048c47b39ae1f1cbcc46efbbc9e29b
SHA512 1771f95e66af9fa6176f1e66879150bad5ba8501d8a05e03525a5eeba05f767ac1807f46ecd45aaf66801bebaa2c1bde090bbe07ffa5b7595e843b41168d2613
SSDEEP 6:rLP/gEhV71m/9blDqlrElvlyNQlr25CM+/lulvl6+6JFhfQlrf:rr/gW49blqYFlHI+/0Fl6FbW7
TLSH
T1DA725EA231A4CB16F7374B3851C7D2D2303932522B03C116BE066F0C1DC67D19536707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.leeqin.coolmms.sms/databases/google_app_measurement_local.db
Size 16KB
SHA256 8a9018bc35fffc340a215fc05b218908247b64ab8e4fe07dbca9bbd570bc5b8e
MD5 bf2288353b4e9d680992dcd1a28c9874
SHA1 30c5a7ce59ee78d892410de7020b41412f802aa5
SHA512 6b9ab87a28a2d334a1ad21401d0e3bc4b1f5e24f8d111b2803cc1778925611a17222b77dcf423188f61861fb7ab5e52d7569dabb097da547f4ce1b8f30db14ab
SSDEEP 12:4cOLaJBzOAU00WlCkU49blqYFlHI+/0Fl6FbW7:4cKajzOC9Ez499F+lFky
TLSH
T1D4726DA271A9CA16F7774B3842D7E7E2343532A22F53E216BD0A7F0C2882791D532703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.leeqin.coolmms.sms/databases/google_app_measurement_local.db
Size 16KB
SHA256 4b6630d173909f74c519700b9f1b68f9ac434b26073dae1a9050ba83736a89d9
MD5 fad377d1346191e8cbf1da3821a4603e
SHA1 83bb33a1060f926aa40daf2549c02cd2919ac2cc
SHA512 d5e674dfa36751b16760ed59dc19fb5ace1bcaf49f078c15b6515b893df75a8085e5ecaacd33c0949a1362e217b16ccfc326494c604ef7abc3d45823fa0093b8
SSDEEP 12:SYcOLaJBzOAU00WlCkU49blqYFlHI+/0Fl6FbWv:SYcKajzOC9Ez499F+lFk2
TLSH
T1D6726DA1B1A8CA16F7774B3C42D7E6D2343632A32B53E216BD067F0C2882391C532702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.leeqin.coolmms.sms/databases/google_app_measurement_local.db
Size 16KB
SHA256 7d6b0bf7ff3b3fe75dd6606ed3b417211c9aea134f57d74342cbfd3ebc830a6e
MD5 00a62fb24d06075c6092dbde825759d4
SHA1 cadcb44692a9d6ddec3ef20ab5d8dbf4b3ad2153
SHA512 21b76bb5808e3c55c83b2260c674f3f5d5107c8694b046ce2b71b68be3debd83c03fccd990c09d6959a22e6e61747222ac2ad031309cafe8646b3a3a49e0d787
SSDEEP 3:o1zr/Xy:oy
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.leeqin.coolmms.sms/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 a623a2ed5a80d9a97ca282ae1eccca50f9007c9bb2d4db01d009ce4946addb9b
MD5 aa273fe37ed0420af19a9be7641bf591
SHA1 16f874081eae079a71ab45be520678bfe7cfdec0
SHA512 203ddfc4c893015630617c80b3ea729e3c8c5e47c4440c847535b7a4a492390aeedf34f4cbef908605d06bb26874556468cf9bbf04bbb65865c2eb4e20fb5342
MD5 SHA1 SHA512

Submit Download