Analysis Report

Overview

General Information

Joe Sandbox Version:	20.0.0
Analysis ID:	347718
Start time:	09:52:40
Joe Sandbox Product:	Cloud
Start date:	22.08.2017
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	soniac_vv.0.3_apkpure.com.apk
Cookbook file name:	defaultandroidfilecookbook.jbs
Analysis system description:	Android x86 5.1
Detection:	MAL
Classification:	mal76.evad.spyw.troj.andAPK@0/251@10/0
Warnings:	Show All No interacted views Not all executed log events are in report (maximum 10 identical API calls) Not all resource files were parsed

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	76	0 - 100	Report FP / FN

Classification

Signature Overview

Click to jump to signature section

Change of System Appearance:

Acquires a wake lock

Show sources

Source: sys.arshad.sys.AutoStartUp;->onCreate:19

API Call: android.os.PowerManager$WakeLock.acquire

Mutes ringtone sound

Show sources

Source: sys.arshad.sys.MainActivity$b$32;->run:23

API Call: android.media.AudioManager.setRingerMode("0")

Sets a new wallpaper

Show sources

Source: sys.arshad.sys.MainActivity$12;->run:7

API Call: android.app.WallpaperManager.setBitmap

May access the Android keyguard (lock screen)

Show sources

Source: android

String found in binary or memory: keyguard

Location Tracing:

Queries the phones location (GPS)

Show sources

Source: sys.arshad.sys.MainActivity$18;->onLocationChanged:3	API Call: android.location.Location.getLongitude
Source: sys.arshad.sys.MainActivity$18;->onLocationChanged:5	API Call: android.location.Location.getLatitude

Operating System Destruction:

Deletes call logs/history

Show sources

Source: sys.arshad.sys.MainActivity$19;->run:24

API Call: android.content.ContentResolver.delete

Deletes other packages

Show sources

Source: sys.arshad.sys.MainActivity$13;->run:15	API Call: sys.arshad.sys.MainActivity.startActivity
Source: sys.arshad.sys.MainActivity$14;->run:13	API Call: sys.arshad.sys.MainActivity.startActivity

Kills background processes

Show sources

Source: sys.arshad.sys.MainActivity$b$14;->run:14

API Call: android.app.ActivityManager.killBackgroundProcesses

Spam, unwanted Advertisements and Ransom Demands:

Dials phone numbers

Show sources

Source: sys.arshad.sys.MainActivity$6;->run:17

API Call: sys.arshad.sys.MainActivity.startActivity

Has permission to perform phone calls in the background

Show sources

Source: submitted apk

Request permission: android.permission.CALL_PHONE

Has permission to send SMS in the background

Show sources

Source: submitted apk

Request permission: android.permission.SEND_SMS

Has permissions to monitor, redirect and/or block calls

Show sources

Source: submitted apk

Request permission: android.permission.PROCESS_OUTGOING_CALLS

Sends SMS using SmsManager

Show sources

Source: sys.arshad.sys.MainActivity$b$16;->run:27

API Call: android.telephony.SmsManager.sendTextMessage

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Accesses the audio/media managers

Show sources

Source: sys.arshad.sys.MainActivity$b$20;->run:37	API Call: android.media.AudioRecord.<init>
Source: sys.arshad.sys.MainActivity$b;->t:141	API Call: android.media.MediaRecorder.<init>
Source: sys.arshad.sys.MainActivity;->A:50	API Call: android.media.MediaRecorder.<init>

Has permission to record audio in the background

Show sources

Source: submitted apk

Request permission: android.permission.RECORD_AUDIO

Has permission to take photos

Show sources

Source: submitted apk

Request permission: android.permission.CAMERA

Records audio/media

Show sources

Source: sys.arshad.sys.MainActivity$b$20;->run:44	API Call: android.media.AudioRecord.startRecording
Source: sys.arshad.sys.MainActivity$b;->t:162	API Call: android.media.MediaRecorder.start
Source: sys.arshad.sys.MainActivity;->A:63	API Call: android.media.MediaRecorder.start

E-Banking Fraud:

Has functionalty to add an overlay to other apps

Show sources

Source: sys.arshad.sys.PhotoTakingService;->a:11

API Call: WindowManager.addView

Networking:

Downloads files from webservers via HTTP

Show sources

Source: global traffic	HTTP traffic detected: GET /generate_204 HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: connectivitycheck.android.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /generate_204 HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: connectivitycheck.android.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /generate_204 HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: connectivitycheck.android.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /generate_204 HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: connectivitycheck.android.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /generate_204 HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: connectivitycheck.android.comConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /generate_204 HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; VirtualBox Build/LMY48W)Host: connectivitycheck.android.comConnection: Keep-AliveAccept-Encoding: gzip

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: arshad93.ddns.net

Urls found in memory or binary data

Show sources

Source: abc_tint_spinner.xml, abc_action_menu_layout.xml	String found in binary or memory: http://schemas.android.com/apk/res-auto
Source: abc_action_menu_layout.xml	String found in binary or memory: http://schemas.android.com/apk/res-auto((android.support.v7.widget.actionmenuview
Source: abc_activity_chooser_view_list_item.xml, abc_btn_borderless_material.xml, abc_list_selector_holo_light.xml	String found in binary or memory: http://schemas.android.com/apk/res/android

Checks an internet connection is available

Show sources

Source: sys.arshad.sys.MainActivity;->d:181	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: sys.arshad.sys.MainActivity$9;->run:14	API Call: android.net.wifi.WifiManager.getConnectionInfo
Source: sys.arshad.sys.MainActivity$b$44;->run:33	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: sys.arshad.sys.MainActivity$b$44;->run:35	API Call: android.net.NetworkInfo.isConnected
Source: sys.arshad.sys.MainActivity;->G:148	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: sys.arshad.sys.MainActivity;->L:174	API Call: android.net.ConnectivityManager.getActiveNetworkInfo

Enables or disables WIFI

Show sources

Source: sys.arshad.sys.MainActivity$b$2;->run:4	API Call: android.net.wifi.WifiManager.setWifiEnabled
Source: sys.arshad.sys.MainActivity$b$47;->run:4	API Call: android.net.wifi.WifiManager.setWifiEnabled
Source: sys.arshad.sys.MainActivity$b;->g:277	API Call: android.net.wifi.WifiManager.setWifiEnabled
Source: sys.arshad.sys.MainActivity$b;->g:279	API Call: android.net.wifi.WifiManager.setWifiEnabled

Performs DNS lookups (Java API)

Show sources

Source: sys.arshad.sys.MainActivity$b$20;->run:20

API Call: java.net.InetAddress.getByName (not executed)

Scans for WIFI networks

Show sources

Source: sys.arshad.sys.MainActivity$b$a$1;->run:21	API Call: android.net.wifi.WifiManager.getScanResults
Source: sys.arshad.sys.MainActivity$b;->p:85	API Call: android.net.wifi.WifiManager.startScan

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Show sources

Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)

Tries to resolve many domain names, but no domain seems valid

Show sources

Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arshad93.ddns.net replaycode: Name error (3)

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: arshad93.ddns.net

Boot Survival:

Has permission to execute code after phone reboot

Show sources

Source: submitted apk

Request permission: android.permission.RECEIVE_BOOT_COMPLETED

Installs a new wake lock (to get activate on phone screen on)

Show sources

Source: sys.arshad.sys.AutoStartUp;->onCreate:17

API Call: android.os.PowerManager.newWakeLock

Starts/registers a service/receiver on phone boot (autostart)

Show sources

Source: sys.arshad.sys.BootComplete;->onReceive:6

API Call: sys.arshad.sys.MainActivity.startService("Intent { cmp=sys.arshad.sys/.AutoStartUp }")

Remote Access Functionality:

Detected Android Bot / Trojan SonicSpy

Show sources

Source: Lsys/arshad/sys/MainActivity$9;->run()V	Method string: "!s!c!r!e!a!m!"
Source: Lsys/arshad/sys/MainActivity$b$40;->run()V	Method string: "{screamHacker}"

Uses DownloadManager to fetch additional components

Show sources

Source: sys.arshad.sys.MainActivity$4;->run:25

API Call: android.app.DownloadManager.enqueue

Stealing of Sensitive Information:

Has permission to query the current location

Show sources

Source: submitted apk	Request permission: android.permission.ACCESS_COARSE_LOCATION
Source: submitted apk	Request permission: android.permission.ACCESS_FINE_LOCATION

Creates SMS data (e.g. PDU)

Show sources

Source: sys.arshad.sys.IncomingSms;->onReceive:6

API Call: android.telephony.SmsManager.createFromPdu

Has permission to read contacts

Show sources

Source: submitted apk

Request permission: android.permission.READ_CONTACTS

Has permission to read the SMS storage

Show sources

Source: submitted apk

Request permission: android.permission.READ_SMS

Has permission to read the call log

Show sources

Source: submitted apk

Request permission: android.permission.READ_CALL_LOG

Has permission to read the default browser history

Show sources

Source: submitted apk

Request permission: com.android.browser.permission.READ_HISTORY_BOOKMARKS

Has permission to read the phones state (phone number, device IDs, active call ect.)

Show sources

Source: submitted apk

Request permission: android.permission.READ_PHONE_STATE

Has permission to receive SMS in the background

Show sources

Source: submitted apk

Request permission: android.permission.RECEIVE_SMS

Has permissions to create, read or change account settings (inlcuding account password settings)

Show sources

Source: submitted apk

Request permission: android.permission.GET_ACCOUNTS

Monitors incoming Phone calls

Show sources

Source: sys.arshad.sys.PhonecallReceiver

Registered receiver: android.intent.action.PHONE_STATE

Monitors incoming SMS

Show sources

Source: sys.arshad.sys.IncomingSms

Registered receiver: android.provider.Telephony.SMS_RECEIVED

Queries a list of installed applications

Show sources

Source: sys.arshad.sys.MainActivity$b$21;->run:6

API Call: android.content.pm.PackageManager.getInstalledApplications

Queries camera information

Show sources

Source: sys.arshad.sys.MainActivity$b$8;->run:7	API Call: android.hardware.Camera.open
Source: sys.arshad.sys.MainActivity;->i:434	API Call: android.hardware.Camera.open
Source: sys.arshad.sys.PhotoTakingService$1$1;->run:17	API Call: android.hardware.Camera.open

Queries list of installed packages

Show sources

Source: sys.arshad.sys.MainActivity$b$39;->run:6

API Call: android.content.pm.PackageManager.getInstalledPackages

Queries phone contact information

Show sources

Source: sys.arshad.sys.MainActivity$b$1;->run:29	Field access: android.provider.ContactsContract$PhoneLookup.CONTENT_FILTER_URI
Source: sys.arshad.sys.MainActivity$b$12;->run:26	Field access: android.provider.ContactsContract$PhoneLookup.CONTENT_FILTER_URI
Source: sys.arshad.sys.MainActivity$b$23;->run:26	Field access: android.provider.ContactsContract$CommonDataKinds$Phone.CONTENT_URI

Queries stored mail and application accounts (e.g. Gmail or Whatsup)

Show sources

Source: sys.arshad.sys.MainActivity$8;->run:10	API Call: android.accounts.AccountManager.getAccounts
Source: sys.arshad.sys.MainActivity$8;->run:12	API Call: android.accounts.Account.type
Source: sys.arshad.sys.MainActivity$8;->run:16	API Call: android.accounts.Account.name

Reads boot loader settings of the device

Show sources

Source: Lsys/arshad/sys/MainActivity$b$22;->run()V

Method string: "BOOTLOADER : "

Redirects camera/video feed

Show sources

Source: sys.arshad.sys.MainActivity$b;->t:156	API Call: android.media.MediaRecorder.setOutputFile
Source: sys.arshad.sys.MainActivity;->A:59	API Call: android.media.MediaRecorder.setOutputFile

Monitors outgoing Phone calls

Show sources

Source: sys.arshad.sys.PhonecallReceiver

Registered receiver: android.intent.action.NEW_OUTGOING_CALL

Persistence and Installation Behavior:

Creates files

Show sources

Source: sys.arshad.sys.MainActivity;->a:352	API Call: android.content.ContextWrapper.openFileOutput
Source: sys.arshad.sys.MainActivity;->o:242	API Call: android.content.ContextWrapper.openFileOutput
Source: sys.arshad.sys.MainActivity;->o:242	API Call: android.content.ContextWrapper.openFileOutput
Source: sys.arshad.sys.MainActivity$2;->onReceive:10	API Call: sys.arshad.sys.MainActivity.openFileOutput
Source: sys.arshad.sys.MainActivity$5;->run:4	API Call: sys.arshad.sys.MainActivity.openFileOutput
Source: sys.arshad.sys.MainActivity$b$15;->run:8	API Call: java.io.FileWriter.<init>
Source: sys.arshad.sys.MainActivity$b$37;->run:11	API Call: sys.arshad.sys.MainActivity.openFileOutput
Source: sys.arshad.sys.MainActivity$b$37;->run:44	API Call: sys.arshad.sys.MainActivity.openFileOutput

Data Obfuscation:

Obfuscates method names

Show sources

Source: soniac_vv.0.3_apkpure.com.apk

Total valid method names: 3%

Uses reflection

Show sources

Source: sys.arshad.sys.MainActivity;->I:164

API Call: java.lang.reflect.Method.invoke

Spreading:

Accesses external storage location

Show sources

Source: sys.arshad.sys.MainActivity$b$28;->run:10	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$28;->run:61	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$28;->run:64	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$28;->run:72	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$28;->run:80	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$28;->run:88	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$28;->run:96	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$28;->run:104	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$28;->run:112	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$28;->run:120	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$28;->run:128	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$37;->run:18	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$37;->run:28	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$43;->run:3	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b$43;->run:13	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b;->t:122	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity$b;->t:133	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity;->A:17	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity;->A:27	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity;->A:38	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity;->A:65	API Call: android.os.Environment.getExternalStorageDirectory
Source: sys.arshad.sys.MainActivity;->o:233	API Call: android.os.Environment.getExternalStorageDirectory

Has permission to change the WIFI configuration including connecting and disconnecting

Show sources

Source: submitted apk

Request permission: android.permission.CHANGE_WIFI_STATE

Scans the access points for available WIFI networks

Show sources

Source: sys.arshad.sys.MainActivity$b;->p:85

API Call: android.net.wifi.WifiManager.startScan

System Summary:

Classification label

Show sources

Source: classification engine

Classification label: mal76.evad.spyw.troj.andAPK@0/251@10/0

Executes native commands

Show sources

Source: sys.arshad.sys.a;->a:4

API Call: java.lang.Runtime.exec

Requests potentially dangerous permissions

Show sources

Source: submitted apk	Request permission: android.permission.ACCESS_COARSE_LOCATION
Source: submitted apk	Request permission: android.permission.ACCESS_FINE_LOCATION
Source: submitted apk	Request permission: android.permission.CALL_PHONE
Source: submitted apk	Request permission: android.permission.CAMERA
Source: submitted apk	Request permission: android.permission.CHANGE_WIFI_STATE
Source: submitted apk	Request permission: android.permission.INTERNET
Source: submitted apk	Request permission: android.permission.PROCESS_OUTGOING_CALLS
Source: submitted apk	Request permission: android.permission.READ_CONTACTS
Source: submitted apk	Request permission: android.permission.READ_PHONE_STATE
Source: submitted apk	Request permission: android.permission.READ_SMS
Source: submitted apk	Request permission: android.permission.RECEIVE_SMS
Source: submitted apk	Request permission: android.permission.RECORD_AUDIO
Source: submitted apk	Request permission: android.permission.SEND_SMS
Source: submitted apk	Request permission: android.permission.SYSTEM_ALERT_WINDOW
Source: submitted apk	Request permission: android.permission.WAKE_LOCK
Source: submitted apk	Request permission: android.permission.WRITE_CONTACTS
Source: submitted apk	Request permission: android.permission.WRITE_EXTERNAL_STORAGE
Source: submitted apk	Request permission: android.permission.WRITE_SETTINGS
Source: submitted apk	Request permission: com.android.browser.permission.READ_HISTORY_BOOKMARKS

Malware Analysis System Evasion:

Accesses android OS build fields

Show sources

Source: sys.arshad.sys.MainActivity$9;->run:9	Field Access: android.os.Build$VERSION.RELEASE
Source: sys.arshad.sys.MainActivity$9;->run:10	Field Access: android.os.Build.MODEL
Source: sys.arshad.sys.MainActivity$b$22;->run:21	Field Access: android.os.Build$VERSION.RELEASE
Source: sys.arshad.sys.MainActivity$b$22;->run:25	Field Access: android.os.Build.MODEL
Source: sys.arshad.sys.MainActivity$b$22;->run:26	Field Access: android.os.Build.BOARD
Source: sys.arshad.sys.MainActivity$b$22;->run:28	Field Access: android.os.Build.BRAND
Source: sys.arshad.sys.MainActivity$b$22;->run:29	Field Access: android.os.Build.DEVICE
Source: sys.arshad.sys.MainActivity$b$22;->run:30	Field Access: android.os.Build.DISPLAY
Source: sys.arshad.sys.MainActivity$b$22;->run:31	Field Access: android.os.Build.FINGERPRINT
Source: sys.arshad.sys.MainActivity$b$22;->run:33	Field Access: android.os.Build.HOST
Source: sys.arshad.sys.MainActivity$b$22;->run:34	Field Access: android.os.Build.ID
Source: sys.arshad.sys.MainActivity$b$22;->run:35	Field Access: android.os.Build.MANUFACTURER
Source: sys.arshad.sys.MainActivity$b$22;->run:36	Field Access: android.os.Build.PRODUCT
Source: sys.arshad.sys.MainActivity$b$22;->run:38	Field Access: android.os.Build.TAGS
Source: sys.arshad.sys.MainActivity$b$22;->run:39	Field Access: android.os.Build.TYPE
Source: sys.arshad.sys.MainActivity$b$22;->run:41	Field Access: android.os.Build.USER
Source: sys.arshad.sys.MainActivity$b$22;->run:42	Field Access: android.os.Build.CPU_ABI

Hooking and other Techniques for Hiding and Protection:

Has permission to draw over other applications or user interfaces

Show sources

Source: submitted apk

Request permission: android.permission.SYSTEM_ALERT_WINDOW

Has permission to terminate background processes of other applications

Show sources

Source: submitted apk

Request permission: android.permission.KILL_BACKGROUND_PROCESSES

Has permissions to monitor, redirect and/or block calls

Show sources

Source: submitted apk

Request permission: android.permission.PROCESS_OUTGOING_CALLS

Queries list of running processes/tasks

Show sources

Source: sys.arshad.sys.MainActivity$b$14;->run:6	API Call: android.app.ActivityManager.getRunningAppProcesses
Source: sys.arshad.sys.MainActivity$b$34;->run:86	API Call: android.app.ActivityManager.getRunningAppProcesses

Removes its application launcher (likely to stay hidden)

Show sources

Source: sys.arshad.sys.AutoStartUp;->onCreate:22	API Call: android.content.pm.PackageManager.setComponentEnabledSetting
Source: sys.arshad.sys.MainActivity;->c:387	API Call: android.content.pm.PackageManager.setComponentEnabledSetting

Language, Device and Operating System Detection:

Queries the SIM provider ISO country code

Show sources

Source: sys.arshad.sys.MainActivity$b$22;->run:50

API Call: android.telephony.TelephonyManager.getSimCountryIso

Queries the network operator ISO country code

Show sources

Source: sys.arshad.sys.MainActivity$b$22;->run:49

API Call: android.telephony.TelephonyManager.getNetworkCountryIso

Queries the unqiue device ID (IMEI, MEID or ESN)

Show sources

Source: sys.arshad.sys.MainActivity$9;->run:5	API Call: android.telephony.TelephonyManager.getDeviceId
Source: sys.arshad.sys.MainActivity$b$22;->run:22	API Call: android.telephony.TelephonyManager.getSimSerialNumber
Source: sys.arshad.sys.MainActivity$b$22;->run:23	API Call: android.telephony.TelephonyManager.getDeviceId
Source: sys.arshad.sys.MainActivity$b$22;->run:24	API Call: android.telephony.TelephonyManager.getLine1Number
Source: sys.arshad.sys.MainActivity$b;->onProgressUpdate:328	API Call: android.telephony.TelephonyManager.getDeviceId
Source: sys.arshad.sys.MainActivity$b;->onProgressUpdate:352	API Call: android.telephony.TelephonyManager.getDeviceId
Source: sys.arshad.sys.MainActivity$b;->onProgressUpdate:360	API Call: android.telephony.TelephonyManager.getDeviceId

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Screenshot

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Classification

Signature Overview

Change of System Appearance:

Location Tracing:

Operating System Destruction:

Spam, unwanted Advertisements and Ransom Demands:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Networking:

Boot Survival:

Remote Access Functionality:

Stealing of Sensitive Information:

Persistence and Installation Behavior:

Data Obfuscation:

Spreading:

System Summary:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Language, Device and Operating System Detection:

Antivirus Detection

Initial Sample

Dropped Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Screenshot