Android
Analysis Report
app-regular-release.apk
Overview
General Information
Detection
Score: | 52 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Queries the device phone number (MSISDN)
Opens an internet connection
May access the Android keyguard (lock screen)
Lists and deletes files in the same context
Queries a list of installed applications
Detected TCP or UDP traffic on non-standard ports
Has functionalty to add an overlay to other apps
Installs a new wake lock (to get activate on phone screen on)
Queries the unqiue device ID (IMEI, MEID or ESN)
Checks an internet connection is available
Accesses android OS build fields
Installs an application shortcut on the screen
Performs DNS lookups (Java API)
Requests potentially dangerous permissions
Queries several sensitive phone informations
May take a camera picture
Has permission to execute code after phone reboot
Queries the phones location (GPS)
Uses reflection
Classification
⊘No yara matches
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: |
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: |
Source: | TCP traffic: |
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: |
Source: | API Call: | ||
Source: | API Call: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Source: | API Call: | ||
Source: | API Call: |
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | HTTP traffic detected: |
Source: | API Call: |
Source: | API Call: | ||
Source: | API Call: |
Source: | API Calls in same method context: | ||
Source: | API Calls in same method context: | ||
Source: | API Calls in same method context: | ||
Source: | API Calls in same method context: | ||
Source: | API Calls in same method context: |
Source: | String found in binary or memory: |
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: |
Source: | Request permission: | ||
Source: | Request permission: | ||
Source: | Request permission: | ||
Source: | Request permission: |
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: |
Source: | API Call: |
Source: | Classification label: |
Source: | API Call: |
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: |
Source: | Request permission: |
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: | ||
Source: | API Call: |
Source: | Method string: | ||
Source: | Method string: | ||
Source: | Method string: | ||
Source: | Method string: | ||
Source: | Method string: | ||
Source: | Method string: | ||
Source: | Method string: |
Language, Device and Operating System Detection |
---|
Source: | API Call: |
Source: | API Call: | ||
Source: | API Call: |
Source: | API Call: | ||
Source: | API Call: |
Source: | API Call: | ||
Source: | API Call: |
Source: | Request permission: | ||
Source: | Request permission: |
Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact | Resource Development | Reconnaissance |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Valid Accounts | Windows Management Instrumentation | Path Interception | Path Interception | Direct Volume Access | OS Credential Dumping | 1 System Network Connections Discovery | Remote Services | 11 Location Tracking | Exfiltration Over Other Network Medium | 1 Encrypted Channel | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Abuse Accessibility Features | Acquire Infrastructure | Gather Victim Identity Information |
Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Rootkit | LSASS Memory | 11 Location Tracking | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | 1 Non-Standard Port | SIM Card Swap | Obtain Device Cloud Backups | Network Denial of Service | Domains | Credentials |
Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | Obfuscated Files or Information | Security Account Manager | 1 Software Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | 1 Non-Application Layer Protocol | Data Encrypted for Impact | DNS Server | Email Addresses | ||
Local Accounts | Cron | Login Hook | Login Hook | Binary Padding | NTDS | 2 System Information Discovery | Distributed Component Object Model | Input Capture | Traffic Duplication | 2 Application Layer Protocol | Data Destruction | Virtual Private Server | Employee Names |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.