Analysis

  • custom tags

    dropperloadersmstrojanexfiltrationspywareratobfuscatedevasionpersistencestealerotpbanker

General

  • Target
    e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000.apk
  • Size 12.5MB
  • Sample260818-3a2nrasemf
  • SHA256 e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Android dropper: runtime DEX/class loading of a staged payload 1 IoCs

    Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.

  • Boot-triggered restart with disguised foreground service 1 IoCs

    Restarts itself on device boot and holds a foreground service with a low-visibility notification channel, keeping the process alive across reboots and outside normal background limits. Malicious use is distinguished by pairing this with surveillance or remote-control primitives.

  • Contact harvesting with SMS self-propagation 1 IoCs

    Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.

  • Covert microphone or camera capture with exfiltration 2 IoCs

    Opens audio or camera capture outside any user-facing recording feature and pairs it with file staging and network transmission. The absence of a foreground recording interface alongside these primitives indicates surveillance rather than a legitimate media function.

  • Notification listener abuse for OTP and message theft 1 IoCs

    Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban

  • Runtime string decryption with reflective method dispatch 1 IoCs

    Combines symmetric decryption or base64 decoding of embedded string tables with reflective class and method resolution, so sensitive API names never appear in plaintext. This defeats naive string-based detection and indicates deliberate anti-analysis engineering.

  • Declares services with permission to bind to the system 5 IoCs
  • Requests dangerous framework permissions 14 IoCs
  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000.apk
    .apk 12.5MB

e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000.apk

  • SHA256 e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Android dropper: runtime DEX/class loading of a staged payload

    Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.

  • Boot-triggered restart with disguised foreground service

    Restarts itself on device boot and holds a foreground service with a low-visibility notification channel, keeping the process alive across reboots and outside normal background limits. Malicious use is distinguished by pairing this with surveillance or remote-control primitives.

  • Contact harvesting with SMS self-propagation

    Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.

  • Covert microphone or camera capture with exfiltration

    Opens audio or camera capture outside any user-facing recording feature and pairs it with file staging and network transmission. The absence of a foreground recording interface alongside these primitives indicates surveillance rather than a legitimate media function.

  • Notification listener abuse for OTP and message theft

    Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban

  • Runtime string decryption with reflective method dispatch

    Combines symmetric decryption or base64 decoding of embedded string tables with reflective class and method resolution, so sensitive API names never appear in plaintext. This defeats naive string-based detection and indicates deliberate anti-analysis engineering.

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

File Signature issue

Digest
bb659b62bfca60dd0791820ec8fa0ad805f70e7380f1939b4d02374b7e10701b9a980bd449fbb914dee75bcbe0b6d69d08591078ce052af9e54f551d9c2d4583
Digest Algorithm
sha512
Digest Matches
Trusted
Not trusted
Signer
CN=Android,OU=Android,O=Google Inc.,L=Mountain View,ST=California,C=US
com.leeqin.coolmms.sms

Android Permissions

e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000.apk

Permissions

android.permission.SEND_SMS

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.RECEIVE_SMS

android.permission.RECEIVE_MMS

android.permission.READ_CONTACTS

android.permission.READ_PROFILE

android.permission.READ_PHONE_STATE

android.provider.Telephony.SMS_RECEIVED

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.CHANGE_NETWORK_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.CAMERA

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECORD_AUDIO

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.SYSTEM_ALERT_WINDOW

com.google.android.c2dm.permission.RECEIVE

com.google.android.providers.gsf.permission.READ_GSERVICES

android.permission.USE_FINGERPRINT

android.permission.FOREGROUND_SERVICE

android.permission.WRITE_SETTINGS

android.permission.Ad_ID

com.google.android.gms.permission.AD_ID

android.permission.USE_BIOMETRIC

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

com.sec.android.provider.badge.permission.READ

com.sec.android.provider.badge.permission.WRITE

com.htc.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.UPDATE_SHORTCUT

com.sonyericsson.home.permission.BROADCAST_BADGE

com.sonymobile.home.permission.PROVIDER_INSERT_BADGE

com.anddoes.launcher.permission.UPDATE_COUNT

com.majeur.launcher.permission.UPDATE_BADGE

com.huawei.android.launcher.permission.CHANGE_BADGE

com.huawei.android.launcher.permission.READ_SETTINGS

com.huawei.android.launcher.permission.WRITE_SETTINGS

android.permission.READ_APP_BADGE

com.oppo.launcher.permission.READ_SETTINGS

com.oppo.launcher.permission.WRITE_SETTINGS

me.everything.badger.permission.BADGE_COUNT_READ

me.everything.badger.permission.BADGE_COUNT_WRITE

com.android.vending.BILLING