smsagent | Phone_Elytra[.]apk

General

Target
Phone_Elytra.apk
Size 9.7MB
Sample261110-e7xjasyzfs
SHA256 d2ce31ae5842975733ec5692fd9ad202b856e6bfcdbb752ca645b9ac79aaba2b
MD5 34f885153a14ad547756e50c6ae4237d
SHA1 dd2cb155cd4a18b3f6a20bb6171eb3dd4ab0c5c2
SHA512 44ee7632e89b9a4575c1e29b9531635d76bbe1f4311a0cd170dbb9e6162968673b10f19938dc75b35337bcedb76571ae843dd48aa8c72e706969ab317097e7a5
SSDEEP 196608:XziA51iXC5EzIZQ/5mLNKaB1yxepDLj7eNBR3qzX6NrxzyXb+fHrEpwh:DiA51UCyziQ/qNKzEXNurxzYKQpwh
TLSH
T138A61225F32DA543F457DB31933E615A2A489FF44244F7257E0AF0AA6EE3AE5C109F80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan infostealer spyware smsagent

Malware Config

Signatures

Family: smsagent
SmsAgent is an Android malware that targets victim SMS messages using Telegram as its C2.
trojan infostealer spyware smsagent

SmsAgent payload 2 IoCs

resource	yara_rule
sample	family_smsagent
sample	family_smsagent

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
Phone_Elytra.apk

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
Phone_Elytra.apk

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Phone_Elytra.apk

File Explorer

Phone_Elytra.apk

.apk 9.7MB

Phone_Elytra.apk

SHA256 d2ce31ae5842975733ec5692fd9ad202b856e6bfcdbb752ca645b9ac79aaba2b
MD5 34f885153a14ad547756e50c6ae4237d
SHA1 dd2cb155cd4a18b3f6a20bb6171eb3dd4ab0c5c2
SHA512 44ee7632e89b9a4575c1e29b9531635d76bbe1f4311a0cd170dbb9e6162968673b10f19938dc75b35337bcedb76571ae843dd48aa8c72e706969ab317097e7a5
SSDEEP 196608:XziA51iXC5EzIZQ/5mLNKaB1yxepDLj7eNBR3qzX6NrxzyXb+fHrEpwh:DiA51UCyziQ/qNKzEXNurxzYKQpwh
TLSH
T138A61225F32DA543F457DB31933E615A2A489FF44244F7257E0AF0AA6EE3AE5C109F80
MD5 SHA1 SHA512 SSDEEP TLSH

android

SmsAgent payload
Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

N/A

Digest Algorithm

N/A

Digest Matches

Not matched

Trusted

Not trusted

Signer

CN=Tasker User 1349764720,OU=Tasker Users,O=Android Developers,L=Anon,ST=Anon,C=US

com.mac.catexecutor.phoneelytra

Android Permissions

Phone_Elytra.apk

Permissions

android.permission.READ_MEDIA_AUDIO

android.permission.READ_MEDIA_VIDEO

android.permission.DISABLE_KEYGUARD

android.permission.FOREGROUND_SERVICE

android.permission.READ_MEDIA_IMAGES

android.permission.QUERY_ALL_PACKAGES

android.permission.SYSTEM_ALERT_WINDOW

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.ACCESS_FINE_LOCATION

android.permission.SCHEDULE_EXACT_ALARM

android.permission.INTERNET

android.permission.WAKE_LOCK

android.permission.ACCESS_WIFI_STATE

android.permission.READ_EXTERNAL_STORAGE

Phone_Elytra.apk

File Signature issue

net.dinglisch.android.taskerm.Kid

net.dinglisch.android.taskerm.ProxyTransparent

net.dinglisch.android.taskerm.DummyActivity

net.dinglisch.android.taskerm.SceneActivity

net.dinglisch.android.taskerm.SceneActivityResize

net.dinglisch.android.taskerm.AppSelect

net.dinglisch.android.taskerm.FileSelect

com.joaomgcd.taskerm.genericaction.ActivityGenericAction

com.joaomgcd.taskerm.genericaction.ActivityGenericActionForResult

net.dinglisch.android.taskerm.ExecuteService

net.dinglisch.android.taskerm.MonitorService

net.dinglisch.android.taskerm.MyAccessibilityService

com.joaomgcd.taskerm.plugin.ServiceRequestQuery

com.joaomgcd.taskerm.plugin.ServicePluginFinished

com.joaomgcd.taskerm.genericaction.ServiceGenericAction

com.joaomgcd.taskerm.genericaction.ServiceGenericActionJobs

net.dinglisch.android.taskerm.ReceiverStaticAlwaysOn

net.dinglisch.android.taskerm.ReceiverStaticInternal

androidx.core.content.FileProvider

Sharing

General

Malware Config

Signatures

File Explorer

Phone_Elytra.apk

File Signature issue

net.dinglisch.android.taskerm.Kid

net.dinglisch.android.taskerm.ProxyTransparent

net.dinglisch.android.taskerm.DummyActivity

net.dinglisch.android.taskerm.SceneActivity

net.dinglisch.android.taskerm.SceneActivityResize

net.dinglisch.android.taskerm.AppSelect

net.dinglisch.android.taskerm.FileSelect

com.joaomgcd.taskerm.genericaction.ActivityGenericAction

com.joaomgcd.taskerm.genericaction.ActivityGenericActionForResult

net.dinglisch.android.taskerm.ExecuteService

net.dinglisch.android.taskerm.MonitorService

net.dinglisch.android.taskerm.MyAccessibilityService

com.joaomgcd.taskerm.plugin.ServiceRequestQuery

com.joaomgcd.taskerm.plugin.ServicePluginFinished

com.joaomgcd.taskerm.genericaction.ServiceGenericAction

com.joaomgcd.taskerm.genericaction.ServiceGenericActionJobs

net.dinglisch.android.taskerm.ReceiverStaticAlwaysOn

net.dinglisch.android.taskerm.ReceiverStaticInternal

androidx.core.content.FileProvider

Android Permissions

Phone_Elytra.apk