e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000

Analysis

max time kernel
129s
max time network
151s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
18/08/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000.apk
Size 12.5MB
Sample260818-3a2nrasemf
SHA256 e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000
MD5 7b9390582033785190dad91b967a265a
SHA1 599216e298ba420b46997e427bde6ea2ebf74079
SHA512 fecd03c0e55544d9a20d34d32e2e9233d274790849f24ccfcae622abf18a862e4aa2b78f793fda2798d0678e56d917eb3d3bcc0279c94e380e2ed8b87a2c778c
SSDEEP 196608:hfAr1tqLzPeGYNtb61llSnPr634Jj2rJxS3zmrCYksTy3oxqoAV:h4r3qLzP5YNtbmlS+oJjmGzpsTy3C2
TLSH
T1BCD61296F3ADEC2FC433A033CA6912B645594D659E42EB673409B71C29F3AD48F49BC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

google discovery evasion persistence phishing

Malware Config

Signatures

Detected google phishing page
Potential google account phishing
phishing google

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.leeqin.coolmms.sms/files/audience_network.dex	5031	com.leeqin.coolmms.sms
/data/user/0/com.leeqin.coolmms.sms/files/audience_network.dex	5031	com.leeqin.coolmms.sms

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.leeqin.coolmms.sms

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	sites.google.com
13	sites.google.com

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.leeqin.coolmms.sms

com.leeqin.coolmms.sms
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5031

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/com.leeqin.coolmms.sms/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
TLSH
T11F727DCEDF002202C1360733F4C9D3901D60921D8336DA0767940460AD02108A451F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.leeqin.coolmms.sms/databases/google_app_measurement_local.db
Size 16KB
SHA256 32fbcd3b89fd63086f5382492a8f2adb4a37bc021f42ede6eb032d97307a4e1c
MD5 1b4870cd9d03b8459a00f7381275558d
SHA1 2a0b7327fa1870480c325c2ed69d8a710aa54313
SHA512 50472f06deeda368c6e7433670d501295d274d271fbaa1ecf3bacddef908b956c0d69f9a6981b4b14ceba2df9c99f941f91a0d634a421ce8e965373fb4f25e65
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6A7W:TLiEy9zmzrfRmBEyPbP/P+/0Fl6sW7
TLSH
T16C7268CDBA105B03D273477670CB93E11C30A3188333DA077B540468AD43284A082F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.leeqin.coolmms.sms/databases/google_app_measurement_local.db
Size 16KB
SHA256 b69478bd6de1fbd512d2c79413191235bdda45f79d7e7e59faef21853c5a44e1
MD5 16ee74e7ad98905cf1dbf8fe92055415
SHA1 e57b85f67ad11d6be271bd23e7e0d4d029de8c41
SHA512 354f4d7c935dfb2959b805a0d4556813cdd22d63763f3cbb4049405b40dc64421abbde9e58172e8ec7c683149e462bf6d73b6c5427efaae0177d5c384723a7be
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFlHJ+/0Fl6sW7:TLQpmzr0GSP/h1499FPlFG
TLSH
T15E725999BA209F13E3330B3560CBE3D12C3473254723D6077E051E6C6D433855052F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.leeqin.coolmms.sms/databases/google_app_measurement_local.db
Size 16KB
SHA256 7e26d9e3049e20265fb4160f6d9ea5637bc87b51c9cede3729bdbe0cfdaf08cd
MD5 ffef77bc8da5f18dbe343be3c3424c02
SHA1 5f0f9ff3abdb30e2ada726a419248cf46f5d4e42
SHA512 7bff3700ac776143d61a188bc2f1ef08fa7cb9796429ccec38a53a4f82fca1bc9d47b15cbe5607d9e3569eb509092affc70b45ada9a9e2eae3eaa8628935b5e8
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/6cOLaJBzOAU00WlOIa49blqYFlHJ+/0Fl6sW7:TLEvpmzr0GSP/6cKajzOC9Ra499FPlFG
TLSH
T16772269AB664DA17F2374B3961DBE3E22C3432761B23E607BE162F1C2D433919162B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.leeqin.coolmms.sms/databases/google_app_measurement_local.db
Size 16KB
SHA256 015da1cd52493633241e64b3c8553b8cc089a0ed5e8fa25cfb20948a32d8bed0
MD5 e63cd738c94d66da999c74f2bfc378db
SHA1 072e7a806b31dc1ddce94d4cccb07a6585bd75cd
SHA512 47c2a14e82264cddd539637c188b063d1098688a8c24f264e74d099333bfa78eefdd7b74fdd9ade4f47d913ea891bb66c330ac2a15003fe8d871f21738010c65
SSDEEP 24:TL6Xpmzr0GSP/wYcKajzOC9Ra499FPlFy:T2XArSP/wYZa3Oox5/y
TLSH
T14572F299BA64DA13F2374B3962DAE3D22C3532260723EA16BE562F1C2D423919062B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.leeqin.coolmms.sms/databases/google_app_measurement_local.db
Size 16KB
SHA256 4c481242f6fc9ef5b430c95d4fbe3a2cc463ceb5aca324c3d47882dd0fdc274d
MD5 9a12ded5f32ec234b50ff0cb58a44dfe
SHA1 5163aff5689724838f05278d03e9eae5504ec371
SHA512 5427f2155338d8113501ec35ce5ac0157bfe322ab212066052c74d6d8a6a867612f91eee955397d2d752aaf27664f22a8bf1550d4518c12187aa10de4cc47f4c
SSDEEP 6:l9bNFlgls1qlvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/Wy:TLuEev9zmzrfRmBEyPbP/W
TLSH
T14D722B8D9F103603C67307B3B4CD93916E14A21D8337AF472FA80478AD834499061F64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download