Analysis Report U8ORVHRPpY

Overview

General Information

Joe Sandbox Version:	26.0.0
Analysis ID:	830907
Start date:	03.04.2019
Start time:	20:08:52
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	U8ORVHRPpY
Cookbook file name:	defaultandroidfilecookbook.jbs
Analysis system description:	Android 7.1 Nougat
APK Instrumentation enabled:	true
Detection:	MAL
Classification:	mal68.troj.adwa.spyw.evad.and@0/252@2/0
Warnings:	Show All No interacted views Not all executed log events are in report (maximum 10 identical API calls) Not all non-executed APIs are in report Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing dynamic data code.

Detection

Strategy	Score	Range	Reporting	Whitelisted	Detection
Threshold	68	0 - 100	Report FP / FN	false

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Mitre Att&ck Matrix

Signature Overview

Click to jump to signature section

Privilege Escalation:

Requests root access

Show sources

Source: Lcom/p;->a()Z	Method string: "/system/bin/su"
Source: Lcom/p;->a()Z	Method string: "/system/xbin/su"

Spreading:

Has permission to change the WIFI configuration including connecting and disconnecting

Show sources

Source: submitted apk

Request permission: android.permission.CHANGE_WIFI_STATE

Accesses external storage location

Show sources

Source: com.Loader$t;->a:8	API Call: android.os.Environment.getExternalStorageState
Source: com.Loader$t;->a:15	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.c;-><clinit>:20	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.j;-><init>:3	API Call: android.os.Environment.getExternalStorageState
Source: com.j;-><init>:7	API Call: android.os.Environment.getExternalStorageDirectory

Networking:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.1.92:41270 -> 40.101.46.210:587

Uses the command line tool ping to scan for other devices in the same network

Show sources

Source: com.Loader;->ping:785

API Call: java.lang.Runtime.exec ping -c 4

Checks an internet connection is available

Show sources

Source: com.Loader$al$1;->a:29	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.Loader$o;->onReceive:185	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.Loader$o;->onReceive:194	API Call: android.net.wifi.WifiManager.isWifiEnabled
Source: com.Loader;->h:532	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.Loader;->h:550	API Call: android.net.wifi.WifiManager.getConnectionInfo
Source: com.Loader;->h:586	API Call: android.net.wifi.WifiManager.getConnectionInfo
Source: com.Loader;->h:603	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: com.Loader;->onStop:766	API Call: android.net.wifi.WifiManager.getConnectionInfo
Source: com.p;->a:749	API Call: android.net.wifi.WifiManager.isWifiEnabled

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.76.188

Enables or disables WIFI

Show sources

Source: com.Loader;->a:180	API Call: android.net.wifi.WifiManager.setWifiEnabled
Source: com.p;->a:750	API Call: android.net.wifi.WifiManager.setWifiEnabled

Opens an internet connection

Show sources

Source: a.b;->a:20	API Call: java.net.URL.openConnection("https://twitter.com/sadwqewqeqw")
Source: com.sun.mail.util.SocketFetcher;->createSocket:138	API Call: java.net.Socket.connect("smtp-mail.outlook.com/40.101.46.210:587")
Source: com.b.a.a.q;->d:7	API Call: java.net.Socket.connect (not executed)
Source: javax.activation.URLDataSource;->getContentType:4	API Call: java.net.URL.openConnection (not executed)
Source: javax.activation.URLDataSource;->getOutputStream:14	API Call: java.net.URL.openConnection (not executed)
Source: com.Loader$u$1$1;->run:5	API Call: java.net.URL.openConnection (not executed)
Source: com.sun.mail.util.SocketFetcher;->createSocket:136	API Call: java.net.Socket.connect (not executed)

Performs DNS lookups (Java API)

Show sources

Source: com.sun.mail.util.logging.MailHandler;->verifySettings0:820	API Call: java.net.InetAddress.getByName (not executed)
Source: javax.mail.Service;->connect:77	API Call: java.net.InetAddress.getByName (not executed)
Source: javax.mail.URLName;->getHostAddress:79	API Call: java.net.InetAddress.getByName (not executed)
Source: com.sun.mail.util.SocketFetcher;->getSocket:191	API Call: java.net.InetAddress.getByName (not executed)

Scans for WIFI networks

Show sources

Source: com.Loader;->c:311	API Call: android.net.wifi.WifiManager.startScan
Source: com.Loader;->h:557	API Call: android.net.wifi.WifiManager.getScanResults

Uses SMTP (mail sending)

Show sources

Source: global traffic

TCP traffic: 192.168.1.92:41270 -> 40.101.46.210:587

Downloads files from webservers via HTTP

Show sources

Source: global traffic	HTTP traffic detected: GET /sadwqewqeqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /account/suspended HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sadwqewqeqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /account/suspended HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sadwqewqeqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /account/suspended HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sadwqewqeqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /account/suspended HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sadwqewqeqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /account/suspended HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sadwqewqeqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /account/suspended HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sadwqewqeqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /account/suspended HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) Chrome/41.0.2272.118Accept: text/html,/;q=0.8Accept-Encoding: gzipAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cache-Control: no-cacheHost: twitter.comConnection: Keep-Alive

Found strings which match to known social media urls

Show sources

Source: dex.dr	String found in binary or memory: https://twitter.com/%s equals www.twitter.com (Twitter)
Source: android	String found in binary or memory: https://twitter.com/sadwqewqeqw equals www.twitter.com (Twitter)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: twitter.com

Posts data to webserver

Show sources

Source: unknown

HTTP traffic detected: HTTP/1.1 302 Foundcache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0connection: closecontent-length: 103

Urls found in memory or binary data

Show sources

Source: dex.dr, android	String found in binary or memory: http://127.0.0.1:
Source: main.xml	String found in binary or memory: http://schemas.android.com/apk/res/android
Source: dex.dr	String found in binary or memory: https://google.com/
Source: dex.dr	String found in binary or memory: https://twitter.com/%s
Source: android	String found in binary or memory: https://twitter.com/sadwqewqeqw

Uses HTTP for connecting to the internet

Show sources

Source: a.b;->a:42

API Call: com.android.okhttp.internal.huc.HttpsURLConnectionImpl.connect

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 42676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42648
Source: unknown	Network traffic detected: HTTP traffic on port 42662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42644
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42640
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42642
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42664
Source: unknown	Network traffic detected: HTTP traffic on port 42654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42660
Source: unknown	Network traffic detected: HTTP traffic on port 42648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42646 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42658
Source: unknown	Network traffic detected: HTTP traffic on port 42638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42638
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42676
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42674

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Has permission to record audio in the background

Show sources

Source: submitted apk

Request permission: android.permission.RECORD_AUDIO

Records audio/media

Show sources

Source: com.j;->a:48

API Call: android.media.MediaRecorder.start

Accesses the audio/media managers

Show sources

Source: com.j;->a:36

API Call: android.media.MediaRecorder.<init>

E-Banking Fraud:

Contains package name strings related to banking (usually for identifying banking APKs)

Show sources

Source: Lcom/c;-><clinit>()V

Method String: com.wooribank.pib.smart, com.kbstar.kbbank, com.ibk.neobanking, com.sc.danb.scbankapp, com.shinhan.sbanking, com.hanabank.ebk.channel.android.hananbank

Has functionalty to add an overlay to other apps

Show sources

Source: com.Loader$am;->run:25	API Call: WindowManager.addView
Source: com.Loader;->start:1059	API Call: WindowManager.addView

Has permission to query the list of currently running applications

Show sources

Source: submitted apk

Request permission: android.permission.GET_TASKS

Spam, unwanted Advertisements and Ransom Demands:

Sends E-Mail

Show sources

Source: com.Loader$al;->run:49	API Call: javax.mail.Transport.sendMessage
Source: com.Loader$o$e;->run:30	API Call: javax.mail.Transport.sendMessage
Source: com.sun.mail.util.logging.MailHandler;->verifySettings0:753	API Call: javax.mail.Transport.sendMessage
Source: javax.mail.Transport;->send0:29	API Call: javax.mail.Transport.sendMessage
Source: javax.mail.Transport;->send0:40	API Call: javax.mail.Transport.sendMessage

Dials phone numbers

Show sources

Source: com.Loader$w;->a:31

API Call: android.content.Context.startActivity

Has permission to perform phone calls in the background

Show sources

Source: submitted apk

Request permission: android.permission.CALL_PHONE

Has permission to send SMS in the background

Show sources

Source: submitted apk

Request permission: android.permission.SEND_SMS

Has permission to write to the SMS storage

Show sources

Source: submitted apk

Request permission: android.permission.WRITE_SMS

Has permissions to monitor, redirect and/or block calls

Show sources

Source: submitted apk

Request permission: android.permission.PROCESS_OUTGOING_CALLS

May block phone calls / Accesses private ITelephony interface

Show sources

Source: com.Loader$b;->onCallStateChanged:59

API Call: java.lang.Class.getDeclaredMethod("getITelephony")

Sends SMS using SmsManager

Show sources

Source: com.n;->b:54

API Call: android.telephony.SmsManager.sendMultipartTextMessage

Operating System Destruction:

Deletes other packages

Show sources

Source: com.Loader$c$2$1;->b:31

API Call: android.content.Context.startActivity

Lists and deletes files in the same context

Show sources

Source: com.Loader$ao;->run:12

API Calls in same method context: File.listFiles,File.delete

Change of System Appearance:

May access the Android keyguard (lock screen)

Show sources

Source: AndroidManifest.xml

String found in binary or memory: android.permission.SEND_SMS#android.permission.DISABLE_KEYGUARD android.permission.READ_CONTACTS$android.permission.CHANGE_WIFI_STATE$android.permission.ACCESS_WIFI_STATE

Acquires a wake lock

Show sources

Source: com.Loader;->start:958

API Call: android.os.PowerManager$WakeLock.acquire

Mutes ringtone sound

Show sources

Source: com.Loader$b;->onCallStateChanged:83	API Call: android.media.AudioManager.setRingerMode("0")
Source: com.Loader$o;->onReceive:342	API Call: android.media.AudioManager.setRingerMode("0")
Source: com.Loader$q$1;->a:19	API Call: android.media.AudioManager.setRingerMode("0")
Source: com.Loader$w;->a:10	API Call: android.media.AudioManager.setRingerMode("0")
Source: com.n;->b:53	API Call: android.media.AudioManager.setRingerMode("0")

System Summary:

Executes native commands

Show sources

Source: com.Loader;->ping:785

API Call: java.lang.Runtime.exec ("ping -c 4 ")

Requests permissions only permitted to signed APKs

Show sources

Source: submitted apk	Request permission: android.permission.BROADCAST_SMS
Source: submitted apk	Request permission: android.permission.PACKAGE_USAGE_STATS
Source: submitted apk	Request permission: android.permission.STOP_APP_SWITCHES

Requests potentially dangerous permissions

Show sources

Source: submitted apk	Request permission: android.permission.CALL_PHONE
Source: submitted apk	Request permission: android.permission.CHANGE_NETWORK_STATE
Source: submitted apk	Request permission: android.permission.CHANGE_WIFI_STATE
Source: submitted apk	Request permission: android.permission.GET_TASKS
Source: submitted apk	Request permission: android.permission.INTERNET
Source: submitted apk	Request permission: android.permission.MODIFY_AUDIO_SETTINGS
Source: submitted apk	Request permission: android.permission.MODIFY_PHONE_STATE
Source: submitted apk	Request permission: android.permission.PROCESS_OUTGOING_CALLS
Source: submitted apk	Request permission: android.permission.READ_CONTACTS
Source: submitted apk	Request permission: android.permission.READ_PHONE_STATE
Source: submitted apk	Request permission: android.permission.READ_SMS
Source: submitted apk	Request permission: android.permission.RECEIVE_MMS
Source: submitted apk	Request permission: android.permission.RECEIVE_SMS
Source: submitted apk	Request permission: android.permission.RECORD_AUDIO
Source: submitted apk	Request permission: android.permission.SEND_SMS
Source: submitted apk	Request permission: android.permission.SYSTEM_ALERT_WINDOW
Source: submitted apk	Request permission: android.permission.WAKE_LOCK
Source: submitted apk	Request permission: android.permission.WRITE_EXTERNAL_STORAGE
Source: submitted apk	Request permission: android.permission.WRITE_SMS

Classification label

Show sources

Source: classification engine

Classification label: mal68.troj.adwa.spyw.evad.and@0/252@2/0

Reads shares settings

Show sources

Source: com.Loader$i;->b:10	API Call: "addr_accounts": luckyone1232\|sadwqewqeqw\|gyugyu87418490
Source: com.Loader$i;->b:24	API Call: "account": sadwqewqeqw
Source: com.Loader;->a:145	API Call: "addr_url": https://twitter.com/%s
Source: com.Loader;->a:158	API Call: "addr_encoding": utf-8
Source: com.Loader;->a:165	API Call: "addr_pattern": <title>abcd([\u4e00-\u9fa5]+?)
Source: com.Loader$i;->b:73	API Call: "last_addr":
Source: com.Loader$al;->run:22	API Call: "last_addr":
Source: a.a;->a:5	API Call: android.content.SharedPreferences.getString
Source: com.Loader$ag;->a:8	API Call: android.content.SharedPreferences.getString
Source: com.Loader$b;->onCallStateChanged:48	API Call: android.content.SharedPreferences.getBoolean
Source: com.Loader$b;->onCallStateChanged:82	API Call: android.content.SharedPreferences.getBoolean
Source: com.Loader$k$1;->a:10	API Call: android.content.SharedPreferences.getBoolean
Source: com.Loader$o;->onReceive:293	API Call: android.content.SharedPreferences.getString
Source: com.Loader$o;->onReceive:318	API Call: android.content.SharedPreferences.getString
Source: com.Loader$o;->onReceive:398	API Call: android.content.SharedPreferences.getBoolean
Source: com.Loader$o;->onReceive:445	API Call: android.content.SharedPreferences.getBoolean
Source: com.Loader;->h:650	API Call: android.content.SharedPreferences.getBoolean
Source: com.Loader;->start:1029	API Call: android.content.SharedPreferences.getString

Data Obfuscation:

Found very long method strings

Show sources

Source: Lcom/Loader;-><init>()V

Method string: \n body {\n font-family: Roboto-Regular, HelveticaNeue, Arial, sans-serif;\n }\n\n label {\n color: #222;\n line-height: 16px;\n font-size: 100%;\n text-decoration: none;\n Length: 5599

Obfuscates method names

Show sources

Source: U8ORVHRPpY

Total valid method names: 45%

Uses reflection

Show sources

Source: ufD.xYi.yjjrPRGGCzuskzfe;->onCreate:59	API Call: Real call: null
Source: ufD.xYi.yjjrPRGGCzuskzfe;->onCreate:59	API Call: Real call: public static final com.Loader com.Loader.create()
Source: ufD.zxYxw.itxjRukzmzkP;->s:12	API Call: Real call: android.app.ApplicationPackageManager@f182408
Source: ufD.zxYxw.itxjRukzmzkP;->s:12	API Call: Real call: public abstract void android.content.pm.PackageManager.setComponentEnabledSetting(android.content.ComponentName,int,int)
Source: ufD.fxiy.kCirszeJvimzuv;->t:19	API Call: Real call: com.Loader@b99d4d8
Source: ufD.fxiy.kCirszeJvimzuv;->t:19	API Call: Real call: public final void com.Loader.start(android.content.Context,android.content.Intent,int[])
Source: com.Loader;->requestIgnoreBatteryOpt:825	API Call: Real call: android.os.PowerManager@470474d
Source: com.Loader;->requestIgnoreBatteryOpt:825	API Call: Real call: public boolean android.os.PowerManager.isIgnoringBatteryOptimizations(java.lang.String)
Source: javax.activation.CommandInfo$Beans;->instantiate:8	API Call: java.lang.reflect.Method.invoke
Source: org.msgpack.core.buffer.b;->a:54	API Call: java.lang.reflect.Method.invoke
Source: org.msgpack.core.buffer.b;->a:65	API Call: java.lang.reflect.Method.invoke
Source: org.msgpack.core.buffer.b;->b:85	API Call: java.lang.reflect.Method.invoke
Source: org.msgpack.core.buffer.b;->b:87	API Call: java.lang.reflect.Method.invoke
Source: org.msgpack.core.buffer.c;-><clinit>:28	API Call: java.lang.reflect.Field.get
Source: com.Loader$ap;->onSignalStrengthsChanged:9	API Call: java.lang.reflect.Method.invoke
Source: com.Loader$b;->onCallStateChanged:63	API Call: java.lang.reflect.Method.invoke
Source: com.Loader;->h:521	API Call: java.lang.reflect.Method.invoke
Source: com.Loader;->start:1039	API Call: java.lang.reflect.Method.invoke
Source: ufD.fxiy.kCirszeJvimzuv;->u:26	API Call: java.lang.reflect.Method.invoke
Source: com.sun.mail.util.MimeUtil;->cleanContentType:22	API Call: java.lang.reflect.Method.invoke
Source: com.sun.mail.util.SocketFetcher;->createSocket:123	API Call: java.lang.reflect.Method.invoke
Source: com.sun.mail.util.SocketFetcher;->getSocketFactory:291	API Call: java.lang.reflect.Method.invoke
Source: com.sun.mail.util.SocketFetcher;->matchCert:309	API Call: java.lang.reflect.Method.invoke
Source: com.sun.mail.util.SocketFetcher;->matchCert:323	API Call: java.lang.reflect.Method.invoke

Persistence and Installation Behavior:

Sets an intent to the APK data type (used to install other APKs)

Show sources

Source: com.b;->a:18

API Call: android.content.Intent.setDataAndType(n/a,"application/vnd.android.package-archive")

Boot Survival:

Has permission to execute code after phone reboot

Show sources

Source: submitted apk

Request permission: android.permission.RECEIVE_BOOT_COMPLETED

Installs a new wake lock (to get activate on phone screen on)

Show sources

Source: com.Loader;->start:952

API Call: android.os.PowerManager.newWakeLock

Hooking and other Techniques for Hiding and Protection:

Removes its application launcher (likely to stay hidden)

Show sources

Source: ufD.zxYxw.itxjRukzmzkP;->s:12

API Call: android.content.pm.PackageManager.setComponentEnabledSetting

Aborts a broadcast event (this is often done to hide phone events such as incoming SMS)

Show sources

Source: com.Loader$o;->onReceive:348

API Call: com.Loader$o.abortBroadcast

Has permission to draw over other applications or user interfaces

Show sources

Source: submitted apk

Request permission: android.permission.SYSTEM_ALERT_WINDOW

Has permission to query the list of currently running applications

Show sources

Source: submitted apk

Request permission: android.permission.GET_TASKS

Has permissions to monitor, redirect and/or block calls

Show sources

Source: submitted apk

Request permission: android.permission.PROCESS_OUTGOING_CALLS

Queries list of running processes/tasks

Show sources

Source: com.Loader;->getTopActivityName$loader_release:718

API Call: android.app.ActivityManager.getRunningTasks

Uses Crypto APIs

Show sources

Source: com.sun.mail.a.b;->a:38	API Call: javax.crypto.Cipher.getInstance
Source: com.sun.mail.a.b;->a:59	API Call: javax.crypto.Cipher.init
Source: com.sun.mail.a.b;->a:61	API Call: javax.crypto.Cipher.doFinal
Source: com.sun.mail.a.b;->a:63	API Call: javax.crypto.Cipher.init
Source: com.sun.mail.a.b;->a:65	API Call: javax.crypto.Cipher.doFinal
Source: com.sun.mail.a.b;->a:67	API Call: javax.crypto.Cipher.init
Source: com.sun.mail.a.b;->a:69	API Call: javax.crypto.Cipher.doFinal
Source: com.sun.mail.a.b;->b:94	API Call: javax.crypto.Cipher.init
Source: com.sun.mail.a.b;->b:96	API Call: javax.crypto.Cipher.doFinal
Source: com.sun.mail.a.b;->b:98	API Call: javax.crypto.Cipher.init
Source: com.sun.mail.a.b;->b:100	API Call: javax.crypto.Cipher.doFinal
Source: com.p;->a:775	API Call: javax.crypto.Cipher.getInstance
Source: com.p;->a:776	API Call: javax.crypto.Cipher.init
Source: com.p;->a:777	API Call: javax.crypto.Cipher.doFinal
Source: com.sun.mail.pop3.Protocol;->getDigest:88	API Call: java.security.MessageDigest.getInstance
Source: com.sun.mail.pop3.Protocol;->getDigest:91	API Call: java.security.MessageDigest.digest
Source: com.sun.mail.smtp.DigestMD5;->authClient:48	API Call: java.security.MessageDigest.getInstance
Source: com.sun.mail.smtp.DigestMD5;->authClient:87	API Call: java.security.MessageDigest.digest
Source: com.sun.mail.smtp.DigestMD5;->authClient:88	API Call: java.security.MessageDigest.update
Source: com.sun.mail.smtp.DigestMD5;->authClient:99	API Call: java.security.MessageDigest.update
Source: com.sun.mail.smtp.DigestMD5;->authClient:102	API Call: java.security.MessageDigest.digest
Source: com.sun.mail.smtp.DigestMD5;->authClient:128	API Call: java.security.MessageDigest.update
Source: com.sun.mail.smtp.DigestMD5;->authClient:134	API Call: java.security.MessageDigest.digest
Source: com.sun.mail.smtp.DigestMD5;->authClient:139	API Call: java.security.MessageDigest.update
Source: com.sun.mail.smtp.DigestMD5;->authClient:197	API Call: java.security.MessageDigest.digest
Source: com.sun.mail.smtp.DigestMD5;->authServer:235	API Call: java.security.MessageDigest.update
Source: com.sun.mail.smtp.DigestMD5;->authServer:241	API Call: java.security.MessageDigest.digest
Source: com.sun.mail.smtp.DigestMD5;->authServer:246	API Call: java.security.MessageDigest.update
Source: com.sun.mail.smtp.DigestMD5;->authServer:248	API Call: java.security.MessageDigest.digest

Malware Analysis System Evasion:

Accesses android OS build fields

Show sources

Source: com.Loader;->c:332	Field Access: android.os.Build$VERSION.RELEASE
Source: com.Loader;->c:334	Field Access: android.os.Build.MODEL
Source: com.Loader;->c:338	Field Access: android.os.Build.DISPLAY

Potential date aware sample found

Show sources

Source: javax.mail.search.DateTerm;->match:13	API Call: java.util.Date.after
Source: javax.mail.search.DateTerm;->match:17	API Call: java.util.Date.after

Queries several sensitive phone informations

Show sources

Source: Lorg/msgpack/core/buffer/c;-><clinit>()V	Method string: "android"
Source: Lcom/Loader$ab;->a([Ljava/lang/Object;)Lc/a/h;	Method string: "imsi"
Source: Lcom/sun/a/a/g;->d(Ljava/lang/String;)V	Method string: "type"
Source: Ljavax/mail/Session;->loadProvidersFromStream(Ljava/io/InputStream;)V	Method string: "version"
Source: Lcom/Loader$at;->a(Lb/d;Lb/e;)V	Method string: "phone"

Queries the unique operating system id (ANDROID_ID)

Show sources

Source: a.a;->a:9

API Call: android.provider.Settings$Secure.getString

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: dex.dr

Binary or memory string: Ljava/lang/VirtualMachineError;

HIPS / PFW / Operating System Protection Evasion:

Uses the DexClassLoader (often used for code injection)

Show sources

Source: ufD.xYi.yjjrPRGGCzuskzfe;->onCreate:47

API Call: dalvik.system.DexClassLoader.<init>("/data/user/0/ufD.wyjyx.vahvh/files/dex")

Language, Device and Operating System Detection:

Queries the WIFI MAC address

Show sources

Source: com.Loader;->h:587

API Call: android.net.wifi.WifiInfo.getMacAddress

Queries the network operator name

Show sources

Source: com.Loader$al$1;->a:19	API Call: android.telephony.TelephonyManager.getNetworkOperatorName returned "Verizon Wireless"
Source: com.Loader;->h:643	API Call: android.telephony.TelephonyManager.getNetworkOperatorName

Queries the unqiue device ID (IMEI, MEID or ESN)

Show sources

Source: a.a;->a:17	API Call: android.telephony.TelephonyManager.getDeviceId
Source: com.Loader$ab;->a:11	API Call: android.telephony.TelephonyManager.getSubscriberId
Source: com.Loader$ab;->a:14	API Call: android.telephony.TelephonyManager.getSimSerialNumber
Source: com.Loader;->a:137	API Call: android.telephony.TelephonyManager.getLine1Number
Source: com.Loader;->c:301	API Call: android.telephony.TelephonyManager.getDeviceId

Stealing of Sensitive Information:

Detected Spyware XLoader

Show sources

Source: Lcom/Loader$o;->onReceive(Landroid/content/Context;Landroid/content/Intent;)V	Method string: "android.intent.action.BATTERY_CHANGED"
Source: Lcom/Loader$o;->onReceive(Landroid/content/Context;Landroid/content/Intent;)V	Method string: "onSms"
Source: Lcom/Loader$o;->onReceive(Landroid/content/Context;Landroid/content/Intent;)V	Method string: "addr_encoding"
Source: Lcom/Loader$o;->onReceive(Landroid/content/Context;Landroid/content/Intent;)V	Method string: "content://sms/inbox"
Source: Lcom/Loader$o;->onReceive(Landroid/content/Context;Landroid/content/Intent;)V	Method string: "android.intent.action.SCREEN_ON"

Checks if a SIM card is installed

Show sources

Source: com.Loader$ae$1;->a:14	API Call: android.telephony.TelephonyManager.getSimState
Source: com.Loader;->c:343	API Call: android.telephony.TelephonyManager.getSimState

Creates SMS data (e.g. PDU)

Show sources

Source: com.Loader$o;->onReceive:83

API Call: android.telephony.SmsMessage.createFromPdu

Has permission to read contacts

Show sources

Source: submitted apk

Request permission: android.permission.READ_CONTACTS

Has permission to read the SMS storage

Show sources

Source: submitted apk

Request permission: android.permission.READ_SMS

Has permission to read the phones state (phone number, device IDs, active call ect.)

Show sources

Source: submitted apk

Request permission: android.permission.READ_PHONE_STATE

Has permission to receive SMS in the background

Show sources

Source: submitted apk

Request permission: android.permission.RECEIVE_SMS

Has permissions to create, read or change account settings (inlcuding account password settings)

Show sources

Source: submitted apk

Request permission: android.permission.GET_ACCOUNTS

Monitors incoming SMS

Show sources

Source: ufD.fxiv.kkrPIvuvzmvi

Registered receiver: android.provider.Telephony.SMS_RECEIVED

Queries MMS data

Show sources

Source: com.Loader;->start:1063	API Call: android.net.Uri.parse("content://mms/#")
Source: com.e;->a:61	API Call: android.net.Uri.parse("content://mms/part")

Queries SIM card contact information

Show sources

Source: com.a;->a:25

API Call: android.net.Uri.parse

Queries SMS data

Show sources

Source: com.Loader$k$1;->a:30	API Call: android.net.Uri.parse("content://sms/")
Source: com.Loader$o;->onReceive:350	API Call: android.net.Uri.parse("content://sms/inbox")
Source: com.Loader$o;->onReceive:370	API Call: android.net.Uri.parse("content://sms")

Queries list of installed packages

Show sources

Source: com.Loader$x;->a:8	API Call: android.content.pm.PackageManager.getInstalledPackages
Source: com.Loader;->getFirstAppDate:697	API Call: android.content.pm.PackageManager.getInstalledPackages
Source: com.Loader;->start:1014	API Call: android.content.pm.PackageManager.getInstalledPackages

Queries phone contact information

Show sources

Source: com.a;->a:11	Field access: android.provider.ContactsContract$CommonDataKinds$Phone.CONTENT_URI
Source: com.p;->a:718	API Call: android.net.Uri.parse content://com.android.contacts/data

Queries stored mail and application accounts (e.g. Gmail or Whatsup)

Show sources

Source: com.Loader$at;->a:22	API Call: android.accounts.Account.name
Source: com.Loader$b$a$a;->onClick:10	API Call: android.accounts.AccountManager.getAccounts
Source: com.Loader$b$a$a;->onClick:14	API Call: android.accounts.Account.type
Source: com.Loader;->c:241	API Call: android.accounts.AccountManager.getAccounts
Source: com.Loader;->c:246	API Call: android.accounts.Account.name
Source: com.Loader;->c:250	API Call: android.accounts.Account.type
Source: com.Loader;->e:449	API Call: android.accounts.AccountManager.getAccounts
Source: com.Loader;->e:454	API Call: android.accounts.Account.type
Source: com.Loader;->e:456	API Call: android.accounts.Account.name

Queries the list of configured WIFI access points

Show sources

Source: com.p$a;->run:3

API Call: android.net.wifi.WifiManager.getConfiguredNetworks

Redirects camera/video feed

Show sources

Source: com.j;->a:44

API Call: android.media.MediaRecorder.setOutputFile

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report U8ORVHRPpY

Overview

General Information

Detection

Confidence

Classification

Mitre Att&ck Matrix

Signature Overview

Privilege Escalation:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

Operating System Destruction:

Change of System Appearance:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Antivirus Detection

Initial Sample

Dropped Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Screenshots

Thumbnails